Service class
What an allowed device receives: an optional bandwidth profile, with download and upload limits per device, plus the firewall rules scoped to that class.
Decide who connects, how, and for how long.
URUFI keeps three questions apart: how a person or device signs in, whether your policy allows it, and how the gateway treats its traffic.
Guest and subscriber access
Guests use your branded portal. They create an account with a phone number and password, then activate a plan.
Sign in
Your access starts here
Phone numberAfter a card or trial is activated
Plan active
- Plan
- Day pass
- Time remaining
- 5 h 42 min
- Expires
- Today, 18:30
- Available access
- Portal access
When the plan ends, the device returns to the portal.
How a plan is activated
- Prepaid card
- A 14-digit PIN, generated in the Console in batches for one plan. You sell or hand out cards your way; the portal does not take payments.
- Free trial
- An optional plan you offer, limited per phone number and device.
- Renewal
- A new card extends access from the current expiry.
Signing in identifies the guest. Access policy decides whether the device gets on and which service class it receives.
- Your logo, colors and terms
- Arabic and English
- Phone check by one-time code, when enabled
Certificate-based access
For staff, managed devices and subscribers on a secure network. Each certificate belongs to one device and is checked by RADIUS on the site's gateway.
- 1Issue
From the portal's Secure tab, or by an operator in the Console.
- 2Install
The device user installs the profile or credential file.
- 3Connect
The access point sends EAP-TLS to RADIUS on the site's gateway.
- 4Authorize
Access policy allows or denies; the gateway enforces the result.
Where certificates come from
- Captive portal, Secure tab
- For subscribers whose plan includes secure access: a profile for iOS and macOS, or a password-protected credential file for Android and other devices.
- Console
- Operators issue a credential for a known device as an Apple profile, PKCS#12 file or PEM bundle.
What happens when something changes
- Valid certificate, matching allow rule
- Connected, with the rule's service class and expiry.
- Certificate revoked
- Refused during authentication once the gateway receives the revocation.
- Plan or session expired
- Access ends at its expiry, even while the site is offline.
- Identity or device disabled
- Denied by the access decision.
- No matching rule
- Denied by default.
Certificates are valid for one year. Access points need WPA2 or WPA3-Enterprise and must be added as RADIUS clients. Installation is done on the device; URUFI does not manage devices.
Policy and enforcement
Access policies are ordered rules. The first rule that matches decides. If none match, access is denied.
| Order | Rule | Matches | Effect | Service class |
|---|---|---|---|---|
| 1 | Block lost tablet | Device: Tablet 07 | Deny | — |
| 2 | Staff on secure Wi-Fi | Human · EAP-TLS · Staff Wi-Fi | Allow | Staff |
| 3 | Day pass guests | Captive account · Guest Wi-Fi · Day pass plan | Allow | Guest 10 Mbps |
| — | No rule matched | Anything else | Deny | — |
Firewall
A separate ordered rule list on the gateway, with walled-garden entries for the portal. Review it alongside access policy; a broad firewall rule can still widen what clients reach.
Network access modes
Each network has one mode. The mode controls what happens before a device is authorized; the sign-in method belongs to the device.
| Mode | Before authorization | Typical use |
|---|---|---|
| Open | Admitted without an access decision. | Trusted segments |
| Captive | Gets an address; plain web requests go to the portal. | Guest and subscriber networks |
| Authorized | Only devices with a current allow decision pass. No portal. | Certificate networks and known devices |
The gateway enforces these modes for the networks behind it, whether they are Wi-Fi SSIDs or wired ports mapped to a network. URUFI does not publish a vendor compatibility list.
Start with one site.
Try URUFI Cloud free on one gateway, with no credit card. Prepare the gateway with the installation guide.