Providing internet access to guests always presents the network owner with a choice: either provide everyone with the same static password, risking security, or constantly change access keys. Modern network infrastructure offers more elegant solutions that allow for the creation of temporary access points Or use portal-based authorization mechanisms. This is especially relevant for cafes, hotels, coworking spaces, and even large private homes where outsiders are often present.
Function implementation one-time password It depends on your router's capabilities. Consumer devices most often use the concept of an isolated guest network with an expiration timer, while enterprise equipment supports complex authentication scenarios. Understanding the differences between these approaches will help you choose the optimal method for securing your channel.
In this article, we will examine in detail the technical aspects of setting up temporary access, and consider the operation of the protocol Captive Portal We'll also provide recommendations on configuring equipment from various vendors. You'll learn how to limit session time and bandwidth for guests while preserving the primary bandwidth for personal use.
How temporary access works in Wi-Fi networks
Technically, creating a one-time password that expires immediately after the first connection is difficult to implement in the standard WPA2/WPA3 protocol without a dedicated RADIUS server. This term is usually used to describe guest networks (Guest Network), which operate independently of the main infrastructure. In these segments, the administrator can set rules limiting the lifetime of the session or the encryption key itself.
The key element here is client isolation. When a guest connects to such a network, they have no access to local resources, printers, or files on other devices. This creates a secure perimeter where, even if a guest's device is infected with a virus, the main network remains safe. Network segmentation — the first step towards proper access organization.
There are two main approaches to implementing temporary access:
- 🔐 Temporary encryption key: The administrator manually changes the password in the router settings after a specified time interval.
- 🕒 Session timer: The user enters a permanent password, but their access is lost after a certain period of time (for example, 1 hour), after which re-authorization is required.
- 🌐 Captive Portal: When connecting, a page opens in the browser where you need to enter the code sent via SMS or generated by the system.
⚠️ Note: Standard home routers often don't automatically generate new passwords on a schedule. The one-time password feature is often implemented by limiting the key's validity period rather than automatically rotating it.
The choice of method depends on how often you have guests and the level of security you require. A simple guest network is sufficient for home use, while a business requires more sophisticated control.
Setting up a guest network on home routers
Most modern routers from manufacturers such as Keenetic, MikroTik, TP-Link And Asus, have a built-in guest network feature. This is the simplest way to simulate one-time access. You create a separate SSID (network name), assign a password, and set time limits.
Let's look at the sequence of actions using a typical interface as an example. First, you need to log into the router control panel, usually accessible at 192.168.0.1 or 192.168.1.1After logging in, find the section responsible for wireless networks. It's important not to confuse the settings for the main network and the guest network.
☑️ Check before setting up a guest network
In the guest network menu, activate the option Isolation (Client Isolation). This will prevent data exchange between guest devices. Next, set a time limit. Some models allow you to set a schedule, for example, from 10:00 AM to 8:00 PM, effectively creating a "one-time" access period during the day.
For increased security, we recommend using a separate subnet for guests. This logically separates visitor traffic from the owner's. In advanced settings, you can also limit the maximum speed (Bandwidth Control) to prevent guests from overloading the network.
Using Captive Portal for Authorization
Technology Captive Portal (Authorization Portal) is the de facto standard for setting up access points in public spaces. Its operating principle is simple: a device connects to an open or semi-open network, but any internet request is redirected to a dedicated page. Here, the user must enter a code received via SMS, email, or issued by the administrator.
Implementing a Captive Portal requires more powerful hardware than typical home routers. Access points are often used for this purpose. Ubiquiti UniFi, MikroTik with a hotspot server or specialized cloud solutions. The system generates unique vouchers that can be valid for a one-time use or for a specific period.
The authorization process looks like this:
- The user selects a Wi-Fi network.
- The browser opens and the welcome page appears.
- Enter your login and password (or just the password).
- The server checks the credentials and grants access.
How does portal redirection work?
Technically, the router intercepts DNS or HTTP requests from an unauthorized client and redirects them to the local web server's IP address. Until the client authenticates, its MAC address is blocked from accessing the outside world.
A key advantage is the ability to integrate with user databases. You can issue a guest a code that is valid for exactly 60 minutes, after which the session is forcibly terminated. This is the equivalent. one-time password in its pure form.
Limit session time and traffic
Even if your router doesn't support complex voucher systems, you can set up restrictions that will make guest network usage temporary. Lease Time The lease time (Leasing Time) in the DHCP server determines how long a device can hold an IP address. Reducing this value to a minimum will force devices to reconnect more frequently, which is useful for resetting statistics.
A more effective method is to set traffic limits. If a guest downloads 1 GB of data, their access can be completely blocked until the administrator resets the counters. This is an effective measure against abuse. The setting can usually be found in the "Control" or "QoS" sections.
Comparison of access restriction methods:
| Method | Difficulty of setup | Security | Suitable equipment |
|---|---|---|---|
| Changing your password manually | Low | Average | Any router |
| Guest network with timer | Average | High | Keenetic, MikroTik, Asus |
| Captive Portal (Vouchers) | High | Maximum | Business access points, servers |
| MAC address filtering | High (labor-intensive) | Low (easy to counterfeit) | Any router |
Using a combination of methods produces the best results. For example, a guest network, speed limiting, and a manual password reset once a week. This approach strikes a balance between convenience and security.
Implementation via RADIUS server and 802.1X
For professional level security, a protocol is used 802.1X In conjunction with a RADIUS server. This is an enterprise-level standard that enables issuing unique certificates or logins/passwords for each user. In this scenario, the "one-time password" can actually be a one-time token.
Deploying such an infrastructure requires a dedicated server (for example, based on FreeRADIUS or Windows Server NPS). The router in this setup acts merely as an access point, transmitting credentials to the server for verification. This allows for detailed logging: who, when, and for how long was online.
The main advantages of using RADIUS:
- 🛡️ Centralized management: All users are stored in one database.
- 📉 Flexible policies: You can set different access rights for different user groups.
- 🔑 Dynamic keys: Encryption keys can be updated in real time.
For a home user or small office, this setup is often overkill. However, if you're setting up a network for an event or temporary office, using cloud services with RADIUS support (e.g., Ubiquiti Cloud or MikroTik User Manager) may be justified.
⚠️ Warning: Configuring a RADIUS server requires in-depth knowledge of network protocols. A configuration error can completely block network access. Always test changes on a single test device.
Common problems and solutions
When setting up temporary access, users often encounter device compatibility issues. Some older smartphones may display the Captive Portal page incorrectly or fail to reconnect automatically after a session expires. In such cases, clearing the DNS cache or network (Forget Network) on the client can help.
Another common problem is session "stickiness." The router thinks the user is still active, even though they've already left. This can be resolved by setting more aggressive idle timeouts. If the device doesn't transmit packets for 5-10 minutes, the connection is forcibly terminated.
It's also important to consider security standard compatibility. If you configure your guest network to use only WPA3, older devices may simply not see it or be unable to connect. It's recommended to use promiscuous mode or a separate SSID for legacy devices, if necessary.
In conclusion, implementing a one-time or temporary password system is a balancing act between security and convenience. For most scenarios, a properly configured guest network with client isolation and time limits is sufficient.
Questions and Answers (FAQ)
Is it possible to make the password only last for 1 hour and then disappear on its own?
Automatic password reset at the router level is not possible without third-party software. However, you can set a session timer: after one hour, the device will be disconnected, and to reconnect, you'll need to re-enter the password (or a new password if you've changed it).
Is it safe to give guests access to a guest network?
Yes, if Client Isolation/AP Isolation is enabled. In this mode, guest devices cannot see each other and, most importantly, cannot see your personal computers, NAS storage devices, and printers on the main network.
Which router is best for setting up a hotspot?
The leaders in this segment are devices from MikroTik (hAP and RB series) thanks to the built-in HotSpot server, as well as equipment Ubiquiti And Keenetic (Giga and Ultra series), which have user-friendly interfaces for creating temporary access profiles.
What should I do if guests can't access the password entry page?
Often, the browser blocks redirection to the authorization page due to the secure HTTPS protocol. Try visiting any unsecured website, for example, http://neverssl.com or http://captive.apple.comto force the login window to appear.