Setup Nile Guest Service (Add-On)

13 min

Nile Guest Access is an optional add-on to the Nile Access Service. It gives visitors secure internet access while keeping them completely separate from your corporate network. All guest traffic is tunneled from your site to the nearest Nile point of presence (PoP) and goes out to the internet from there. You don't need to build or manage guest VLANs, DMZ segments, guest firewalls, or guest DHCP servers.

Use Nile Guest Access for:

Visitors, customers, contractors, and partners who need internet access.

Employee-owned devices that should stay off the corporate network.

Events, meetings, and training sessions that need temporary access.

Guest networks where you want to block risky or unwanted websites, using URL filtering.

Choose how guests log in. You select the method in the Guest Authentication Option field of the guest SSID. Each method has its own steps below.

Guest Authentication Option	How guests connect	Best for
Click through	Guests accept your terms and conditions.	Open guest Wi-Fi with the simplest login.
Email approval	Guests request access, and an employee approves it by email.	Employee-hosted visitors.
Access Code	Guests enter a code that the admin created. The code can be shared by all guests or unique to each guest.	Events, conferences, and managed visits.
SMS - Access Code	Guests enter a phone number and receive a one-time code by SMS.	Guests who need quick self-service access.

For more details, refer to Nile Guest Service

Prerequisites

Complete the following before you configure the guest SSID.

Subscribe to Nile Guest Service. After you subscribe, Nile automatically creates the DHCP server, client subnets, guest segment, and a guest SSID named Nile. You don't create the guest SSID yourself.

Prepare your terms and conditions. You enter them in the Terms and Conditions editor on the guest SSID.

Open firewall ports. Allow outbound UDP 6081 and TCP 443 from the Nile Service Block (NSB) gateway to the Nile Portal.

Configure SSO (Optional). Integrate your identity provider (IdP) with Nile. For IdP integration, refer to Integrations > Identity Providers (IdP): Google Workspace, Okta, Microsoft Entra ID, or Azure Active Directory.

Enable SMS (SMS - Access Code only). SMS login is turned on for each tenant. To enable it for your country, contact Nile Support.

Configure the Guest SSID

When Guest Access is enabled, Nile adds a guest SSID named Nile to your wireless services. A red exclamation mark next to the name shows that the SSID still needs to be configured. All guest settings, including login method, session timeout, Walled Garden, and URL filtering, are set on this SSID.

The guest SSID page has three tabs: Guest service, URL filtering, and Advanced.

Follow these steps for every login method, then complete the extra settings for the method you chose.

In the left navigation, select Network Setup > Wireless.

In Wireless Services, find the guest SSID (named Nile by default) and click the pencil icon to edit it.

On the Guest service tab, set the following:

Name: Enter the SSID name that guests will see, for example, Company-Guest.

Guest Authentication Option: Select Click through, Email approval, Access Code, or SMS - Access Code.

DNS server 1 and DNS server 2: The defaults are 8.8.8.8 and 8.8.4.4. Keep them, or enter your own DNS servers.

Guest session timeout: Enter a number and select the unit, such as Hours. The default is 24 hours.

Enable SSO: Optional. Turn this on to let employees sign in through your identity provider.

Walled Garden: Optional. Click Add to list websites that guests can reach before they log in. See Allow websites before login (Walled Garden) below.

Terms and Conditions: Expand this section and enter your terms in the editor. The editor supports basic formatting, such as bold, italic, underline, links, and lists.

Optional: Open the URL filtering tab and the Advanced tab to control which websites guests can visit. See the URL Filtering section below.

Click Save. To discard your changes, click Cancel.

Option 1: Click through

Guests accept your terms and conditions to get access. This is the simplest login method.

Configure the guest SSID as described above, and select Click through in Guest Authentication Option.

Click Save.

Guest experience: The guest connects to the guest SSID, is shown the captive portal page, accepts your terms and conditions, and gets internet access.

Option 2: Email approval

Guests request access and an employee approves it by email. You can let guests choose any sponsor, or limit approvals to a list of approved sponsors.

Normal approval (any host)

Configure the guest SSID as described above, and select Email approval in Guest Authentication Option.

Leave the Restrict approvers toggle off.

Optional: Change Self approval timeout. The default is 90 days.

Click Save.

Guest experience: The guest enters their name and email, plus the Sponsor name and Sponsor email of the employee they are visiting. The guest agrees to the Terms of service and clicks Request Access. The sponsor gets an email to approve or deny the request.

Restricted approval (approved sponsors only)

Configure the guest SSID as described above, and select Email approval in Guest Authentication Option.

Turn on the Restrict approvers toggle.

For each approved sponsor, enter the Sponsor name and Sponsor email, and click ADD. You can also select a Sponsor Geoscope (optional) to link the sponsor to a location.

Optional: Change Self approval timeout. The default is 90 days.

Click Save.

Guest experience: The guest enters only their own name and email, agrees to the Terms of service, and clicks Request Access. The request goes only to the listed sponsors.

Notes:

After the guest clicks Request Access, the page shows the message "An employee from your organization must approve your request for Internet access."

Self approval timeout controls how long a session lasts when an employee approves their own request. The default is 90 days.

Option 3: Access Code

Guests enter an access code that you create. You can create one code for all guests, or a separate code for each guest. Both types are time-bound.

Shared access code (all guests)

Use this for short events, meetings, and training sessions where you don't need to track individual guests.

Configure the guest SSID as described above, and select Access Code in Guest Authentication Option.

Turn on the Use generic access code toggle. The Access Code Options table shows the columns Access Code, Expires, Start Time, End Time, and Generated.

Click the '+' icon above the table to add the code.

Enter the code.

If the code should expire, turn on Expires, then select the Start time and End time from the calendar.

Click Save in the Add Access Code window.

Click Save on the guest SSID page.

User-specific access code (one code per guest)

Use this for employee-hosted visitors, contractors, partners, and managed events. Each code is linked to the guest's name and email, so you can trace who used it.

Configure the guest SSID as described above, and select Access Code in Guest Authentication Option.

Make sure the Use generic access code toggle is off. The Access Code Options table shows the columns Access Code, Guest Name, Guest Email, Expires, Start Time, End Time, and Generated.

Click the '+' icon above the table to add an access code. In the Add Access Code window:

Enter the Access Code, or leave it blank to generate a random access code.

Enter the Guest Name.

Enter the Guest Email ID.

Turn on Expires if needed, then select the Start time and End time from the calendar.

Click Save.

Repeat step 3 for each guest.

Click Save on the guest SSID page.

Guest experience: The guest connects to the guest SSID and is redirected to the guest page. With a shared code, the guest enters the code. With a user-specific code, the guest enters their email address and their own code. Access is granted if the code is valid and within its time window.

Notes:

To change or remove a code, select it in the table and click the pencil icon or the trash icon. You can search the table by access code.

Share codes by email, verbally, on signage, or as a QR code.

Option 4: SMS - Access Code

Guests enter their phone number and receive a one-time code by SMS.

Configure the guest SSID as described above, and select SMS - Access Code in Guest Authentication Option.

Under Customer Login Page, choose the fields that guests fill in. Phone Number is always required. You can also select Name and Email ID.

Under Allowed Device Count, enter the number of devices each access code can be used on. The default is 1, and the maximum is 5.

Under Access Code Time Limit, enter the Duration and select the Time Unit, such as Hours. The default is 1 hour.

Click Save.

Guest experience: The guest enters their phone number with the country code, receives a one-time code by SMS, and enters it to connect.

Note: Nile manages SMS delivery, so you don't need to set up an SMS provider or phone numbers. To enable SMS login for your country, contact Nile Support.

URL Filtering

URL filtering controls which websites guests can open after they connect. It is set on the guest SSID page, on two tabs: URL filtering for the filtering level, and Advanced for your own allowed and blocked websites.

Step 1: Choose a filtering level

In Network Setup > Wireless, open the guest SSID and select the URL filtering tab.

Select one of the following levels. Each level also applies the levels below it.

Level	What it does
Strict	Blocks everything in Moderate, along with other potentially harmful sites.
Moderate	Blocks everything in Low, and adult sites.
Low	Blocks online threats, including malware and spyware sites.
None	Allows full web access, with no filtering or restrictions.

Step 2: Add your own allowed and blocked websites

Select the Advanced tab. The URL Filters section has two lists: Allowed URLs by URL filtering and Blocked URLs by URL filtering. Use one list or the other, but not both.

To allow specific websites, click Add under Allowed URLs by URL filtering and enter each website.

To block specific websites, click Add under Blocked URLs by URL filtering and enter each website, for example, youtube.com.

To remove a website from a list, click the trash icon next to it.

Click Save.

Note: URL filtering is different from the Walled Garden. The Walled Garden lists websites guests can reach before they log in. URL filtering controls which websites guests can browse once they are connected. For more details, see URL Filtering.

Customize and Control Guest Access

Use the Walled Garden to let guests reach specific websites, such as help pages or login portals, before they log in.

In Network Setup > Wireless, open the guest SSID and select the Guest service tab.

Under Walled Garden, click Add. The list is labeled Allowed URLs before authentication.

Enter the website you want to allow.

Click Save.

Brand the guest page

In the left navigation, select Global Settings > Guest Portal.

Under Theme, set the Primary Color and Secondary Color.

Under Logo, drag and drop your logo or click choose file to upload. Supported formats are .png, .jpg, and .jpeg, and the maximum file size is 5 MB.

Under Background, select Image or Color. If you select Color, set the Background Color.

To go back to the default look, click Restore to default.

Click PREVIEW to see the page. Use the buttons at the top to switch between desktop and mobile, and between the Click Through, Email Approval, and Access Code pages.

Monitor guests

In the Nile Portal, you can see connected guest devices, user and device details, and traffic flow, in the same way as for employee traffic.

Notes

Guest traffic goes out to the internet through a Nile PoP. External websites and apps may see an IP location that differs from the guest's physical location. This is expected, and it can affect apps that use MFA or location checks.

If your firewall policy requires allow lists, allow the regional Guest PoP IP addresses and FQDNs that Nile publishes. See Guest Access.