Why offering guest internet is a legal matter
In Türkiye, Law No. 5651 places an obligation on mass-use providers — hotels, malls, hospitals, cafés, schools and similar businesses that offer internet access to visitors — to keep access records and produce them on request. Broadcasting an open WiFi network, or handing every guest the same shared password, does not meet that obligation: the record has to be tied to an identity.
In practice, the guest must pass through an authentication step, and that identity must be stored together with the connection details.
How a captive portal works
- The device joins the WiFi and gets an IP over DHCP.
- The user tries to open a web address.
- The access point or controller redirects this unauthenticated device to the portal page.
- The user completes authentication.
- The RADIUS server marks the MAC address as authenticated and traffic is allowed.
Underneath, standard RADIUS (RFC 2865/2866) handles authentication and accounting. CoA support (Change of Authorization, RFC 3576) makes it possible to terminate a session or update a quota on the fly — which is exactly what you need to cut off a guest who has exhausted their quota.
Which authentication method?
- SMS OTP: a one-time code sent to a phone number. The strongest identity binding, and the common choice for hotels and hospitals.
- Voucher: a time-limited code printed at reception. Practical for hotels and campsites; can be single-use or multi-use.
- Sponsor approval: an employee approves their visitor. Suitable for corporate offices.
- Social login (OAuth 2.0): lowest friction, but a weaker identity binding than SMS.
- E-mail verification: preferred by businesses that want to collect marketing consent.
Offering several methods in parallel, matched to guest segments, works better than forcing one.
What has to be recorded
- IP address and MAC address
- Verified identity (phone number or e-mail)
- User-Agent
- Session start and end timestamps
Storing the records is not enough — their integrity must be protected. Encrypting the logs and stamping them with a hash such as SHA-256 lets you demonstrate they have not been altered. Retention is configured against the legal minimum, and the system must be able to answer a query for a specific date and IP quickly when an audit arrives.
A hotspot does not work without bandwidth management
One guest running a large download in a hundred-person lobby makes the connection unusable for everyone. Traffic shaping is mandatory, not optional.
In practice, per-user or per-group download and upload limits are applied with the HTB (Hierarchical Token Bucket) algorithm, on top of daily quotas and monthly cumulative tracking. When a quota is exceeded you can throttle or disconnect; throttling usually gives a better guest experience — the internet becomes slow rather than "broken". Defining a separate peak-hour profile also helps: lowering per-user limits between 20:00 and 23:00 in a hotel protects the overall experience.
Content filtering and guest isolation
Content filtering: blocking malicious sites at the DNS layer protects both the guest and the business, and different filter profiles can apply to different areas.
Network isolation: the guest network must be separated from the corporate network by VLAN, and guests must not see each other (client isolation). Otherwise one guest device becomes an attack surface against the others — a setting that should never be skipped in hotels and hospitals.
Turning the portal into a marketing channel
The captive portal is the one digital surface where the business meets the guest directly. Campaign sliders, promotional video or static banners can run there with start and end dates and measured impressions and clicks. On the analytics side, unique visitors, average session length, repeat visit rate, device type mix and peak hours produce concrete signals about footfall for a mall or occupancy patterns for a hotel.
Hardware compatibility
You can usually deploy a hotspot without replacing your existing wireless infrastructure. All common platforms speak standard RADIUS: Mikrotik RouterOS, Ubiquiti UniFi, Cisco WLC, TP-Link Omada and OpenWRT, in standalone or controller mode.
Our Hotspot Appliance
Marta Teknoloji's Hotspot Appliance brings every component in this guide into one package: a fully customisable multilingual captive portal (TR, EN, AR, DE), SMS OTP / e-mail / social / sponsor / voucher authentication, HTB-based bandwidth and quota management, integrity-protected compliant record keeping, DNS-based content filtering integration, an advertising engine and visitor analytics. It is compatible with Mikrotik, UniFi, Cisco and Omada, and multi-site deployments are managed from a single central panel.
Contact us to design a compliant guest network on top of your existing wireless infrastructure.