Datto Networking: Using an internally-hosted splash page with RADIUS authentication



This article describes how to set up and edit a splash page hosted on your Datto Access Point that uses a RADIUS server for user authentication.


  • Datto Network Manager


A splash page is the page users will land on when they first use the Web through your network. This article shows you how to set up and edit a splash page, set up authentication on an external server, and host the page on your Datto access point.


Configure the RADIUS Server

The RADIUS server is the external server that handles authentication for your website. When users log in, your splash page will communicate with the RADIUS server to verify user identity. You must set up the RADIUS server before following the steps below. If you already have a configured RADIUS server, you may use it without configuring another server.

Standard RADIUS servers are available from the FreeRADIUS project (external link) and within Microsoft Windows Server.

The RADIUS server is not part of the Datto Networking suite; you must set up your RADIUS server according to the instructions provided by its vendor.

1. In the Navigation menu, select the SSID you are using. 

mceclip1.pngFigure 1: The Navigation window (click to enlarge)

2. Configure the RADIUS server to provide access for the users that you wish to be able to authenticate. At a minimum, you must provide a username and password for each.

You can also configure the maximum upload and download bandwidth and session timeout length for each user. These are set using the attributes WISPr-Bandwidth-Max-UpWISPr-Bandwidth-Max-Down, and SESSION_TIMEOUT.

3. Note the IP address (or Hostname) and the secret of the RADIUS server; you will need these in the steps below.

Configure Datto Network Manager

In Network Manager, the splash page and authentication are specified separately for each SSID.

1. In the Datto Network Manager's Navigation menu, select the SSID on which you the splash page will operate (see Figure 1, above).

2. Click Captive Portal from the section options.

mceclip3.pngFigure 2: SSID section options(click to enlarge)

3. Select Custom for the type of splash page, then click the Edit Splash Page button.

mceclip2.pngFigure 3: Captive Portal configuration options (click to enlarge)

4. Edit the splash page as needed. Be sure to include the current form for RADIUS Access. You may change the form heading and prompt, but you must leave the form controls unchanged. Save the splash page when finished.

Figure 4: RADIUS server access (click to enlarge)

Link the splash page with the RADIUS server

On Datto Network Manager's Splash Page Authentication card, configure the following settings:

  • Splash page authentication type: Select RADIUS from the drop-down menu.
  • Server address 1: Enter the IP address or hostname of the RADIUS server.
  • Server address 2: Enter the IP address or hostname of a secondary RADIUS server, if configured.
  • Server secret: Enter the secret the RADIUS server gave you after configuration.
  • NAS ID: A NAS ID may be used to pass additional information about an authentication request to the RADIUS server. If you have a NAS ID, enter it here.
  • Block clients after: Set how many password attempts a user gets before their username is blocked
  • Block duration of: Specify the length of time a username is blocked. We suggest setting this to at least 10 minutes; otherwise, you may experience incorrectly decrypted passwords that are decrypted incorrectly.

When finished, click the Save Changes button in the upper right-hand corner of the screen.

mceclip6.pngFigure 5: Splash page authentication (click to enlarge)

Test the Configuration

The splash page and RADIUS configuration are now complete.

  • Unauthenticated users should see the splash page.
  • The User Name and Password users enter into the splash page form will be authenticated for the RADIUS server.
  • Only those users successfully authenticated by the RADIUS server will be allowed access to the Internet.

Fail-Safe Behavior

If a server configuration or runtime error occurs, Network Manager is designed to fail-safe. If the specified RADIUS server cannot be reached or is not configured correctly, Network Manager will give the user temporary access.

Was this article helpful?

0 out of 0 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage