---
title: Setup Nile Guest Service (Add-On)
slug: setup-nile-guest-service-add-on
createdAt: 2026-11-02T12:48:49.231Z
---

Nile Guest Access is an optional add-on to the Nile Access Service. It gives visitors secure internet access while keeping them completely separate from your corporate network. All guest traffic is tunneled from your site to the nearest Nile point of presence (PoP) and goes out to the internet from there. You don't need to build or manage guest VLANs, DMZ segments, guest firewalls, or guest DHCP servers.

**Use Nile Guest Access for:**

- Visitors, customers, contractors, and partners who need internet access.
- Employee-owned devices that should stay off the corporate network.
- Events, meetings, and training sessions that need temporary access.
- Guest networks where you want to block risky or unwanted websites, using URL filtering.

## Guest Login Methods

Choose how guests log in. You select the method in the **Guest Authentication Option** field of the guest SSID. Each method has its own steps below.

| Guest Authentication Option | How guests connect                                                                                        | Best for                                   |
| --------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| Click through               | Guests accept your terms and conditions.                                                                  | Open guest Wi-Fi with the simplest login.  |
| Email approval              | Guests request access, and an employee approves it by email.                                              | Employee-hosted visitors.                  |
| Access Code                 | Guests enter a code that the admin created. The code can be shared by all guests or unique to each guest. | Events, conferences, and managed visits.   |
| SMS - Access Code           | Guests enter a phone number and receive a one-time code by SMS.                                           | Guests who need quick self-service access. |

For more details, refer to [Nile Guest Service](https://docs.nilesecure.com/nile-guest-service)

## Prerequisites

Complete the following before you configure the guest SSID.

- **Subscribe to Nile Guest Service.** After you subscribe, Nile automatically creates the DHCP server, client subnets, guest segment, and a guest SSID named **Nile**. You don't create the guest SSID yourself.
- **Prepare your terms and conditions.** You enter them in the **Terms and Conditions** editor on the guest SSID.
- **Open firewall ports.** Allow outbound UDP 6081 and TCP 443 from the Nile Service Block (NSB) gateway to the Nile Portal.
- **Configure SSO (Optional).** Integrate your identity provider (IdP) with Nile. For IdP integration, refer to Integrations > Identity Providers (IdP): Google Workspace, Okta, Microsoft Entra ID, or Azure Active Directory.
- **Enable SMS (SMS - Access Code only).** SMS login is turned on for each tenant. To enable it for your country, contact Nile Support.

## Configure the Guest SSID

When Guest Access is enabled, Nile adds a guest SSID named **Nile** to your wireless services. A red exclamation mark next to the name shows that the SSID still needs to be configured. All guest settings, including login method, session timeout, Walled Garden, and URL filtering, are set on this SSID.

The guest SSID page has three tabs: **Guest service**, **URL filtering**, and **Advanced**.

Follow these steps for every login method, then complete the extra settings for the method you chose.

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Wireless**.
3. In **Wireless Services**, find the guest SSID (named **Nile** by default) and click the pencil icon to edit it.
4. On the **Guest service** tab, set the following:
   - **Name**: Enter the SSID name that guests will see, for example, Company-Guest.
     - **Guest Authentication Option**: Select **Click through**, **Email approval**, **Access Code**, or **SMS - Access Code**.
     - **DNS server 1** and **DNS server 2**: The defaults are 8.8.8.8 and 8.8.4.4. Keep them, or enter your own DNS servers.
     - **Guest session timeout**: Enter a number and select the unit, such as **Hours**. The default is 24 hours.
     - **Enable SSO**: Optional. Turn this on to let employees sign in through your identity provider.
     - **Walled Garden**: Optional. Click **Add** to list websites that guests can reach before they log in. See Allow websites before login (Walled Garden) below.
     - **Terms and Conditions**: Expand this section and enter your terms in the editor. The editor supports basic formatting, such as bold, italic, underline, links, and lists.
5. **Optional:** Open the **URL filtering** tab and the **Advanced** tab to control which websites guests can visit. See the URL Filtering section below.
6. Click **Save**. To discard your changes, click **Cancel**.

### Option 1: Click through

Guests accept your terms and conditions to get access. This is the simplest login method.

1. Configure the guest SSID as described above, and select **Click through** in **Guest Authentication Option**.
2. Click **Save**.

**Guest experience:** The guest connects to the guest SSID, is shown the captive portal page, accepts your terms and conditions, and gets internet access.

### Option 2: Email approval

Guests request access and an employee approves it by email. You can let guests choose any sponsor, or limit approvals to a list of approved sponsors.

**Normal approval (any host)**

1. Configure the guest SSID as described above, and select **Email approval** in **Guest Authentication Option**.
2. Leave the **Restrict approvers** toggle off.
3. **Optional:** Change **Self approval timeout**. The default is 90 days.
4. Click **Save**.

**Guest experience:** The guest enters their name and email, plus the **Sponsor** name and **Sponsor email** of the employee they are visiting. The guest agrees to the **Terms of service** and clicks **Request Access**. The sponsor gets an email to approve or deny the request.

**Restricted approval (approved sponsors only)**

1. Configure the guest SSID as described above, and select **Email approval** in **Guest Authentication Option**.
2. Turn on the **Restrict approvers** toggle.
3. For each approved sponsor, enter the **Sponsor name** and **Sponsor email**, and click **ADD**. You can also select a **Sponsor Geoscope (optional)** to link the sponsor to a location.
4. **Optional:** Change **Self approval timeout**. The default is 90 days.
5. Click **Save**.

**Guest experience:** The guest enters only their own name and email, agrees to the **Terms of service**, and clicks **Request Access**. The request goes only to the listed sponsors.

**Notes:**

- After the guest clicks **Request Access**, the page shows the message "An employee from your organization must approve your request for Internet access."
- **Self approval timeout** controls how long a session lasts when an employee approves their own request. The default is 90 days.

### Option 3: Access Code

Guests enter an access code that you create. You can create one code for all guests, or a separate code for each guest. Both types are time-bound.

**Shared access code (all guests)**

Use this for short events, meetings, and training sessions where you don't need to track individual guests.

1. Configure the guest SSID as described above, and select **Access Code** in **Guest Authentication Option**.
2. Turn on the **Use generic access code** toggle. The **Access Code Options** table shows the columns Access Code, Expires, Start Time, End Time, and Generated.
3. Click the '**+**' icon above the table to add the code.
4. Enter the code.
5. If the code should expire, turn on **Expires**, then select the **Start time** and **End time** from the calendar.
6. Click **Save** in the **Add Access Code** window.
7. Click **Save** on the guest SSID page.

**User-specific access code (one code per guest)**

Use this for employee-hosted visitors, contractors, partners, and managed events. Each code is linked to the guest's name and email, so you can trace who used it.

1. Configure the guest SSID as described above, and select **Access Code** in **Guest Authentication Option**.
2. Make sure the **Use generic access code** toggle is off. The **Access Code Options** table shows the columns Access Code, Guest Name, Guest Email, Expires, Start Time, End Time, and Generated.
3. Click the '**+**' icon above the table to add an access code. In the **Add Access Code** window:
   - Enter the **Access Code**, or leave it blank to generate a random access code.
     - Enter the **Guest Name**.
     - Enter the **Guest Email ID**.
     - Turn on **Expires** if needed, then select the **Start time** and **End time** from the calendar.
     - Click **Save**.
4. Repeat step 3 for each guest.
5. Click **Save** on the guest SSID page.

**Guest experience:** The guest connects to the guest SSID and is redirected to the guest page. With a shared code, the guest enters the code. With a user-specific code, the guest enters their email address and their own code. Access is granted if the code is valid and within its time window.

**Notes:**

- To change or remove a code, select it in the table and click the pencil icon or the trash icon. You can search the table by access code.
- Share codes by email, verbally, on signage, or as a QR code.

### Option 4: SMS - Access Code

Guests enter their phone number and receive a one-time code by SMS.

1. Configure the guest SSID as described above, and select **SMS - Access Code** in **Guest Authentication Option**.
2. Under **Customer Login Page**, choose the fields that guests fill in. **Phone Number** is always required. You can also select **Name** and **Email ID**.
3. Under **Allowed Device Count**, enter the number of devices each access code can be used on. The default is 1, and the maximum is 5.
4. Under **Access Code Time Limit**, enter the **Duration** and select the **Time Unit**, such as **Hours**. The default is 1 hour.
5. Click **Save**.

**Guest experience:** The guest enters their phone number with the country code, receives a one-time code by SMS, and enters it to connect.

**Note:** Nile manages SMS delivery, so you don't need to set up an SMS provider or phone numbers. To enable SMS login for your country, contact Nile Support.

## URL Filtering

URL filtering controls which websites guests can open after they connect. It is set on the guest SSID page, on two tabs: **URL filtering** for the filtering level, and **Advanced** for your own allowed and blocked websites.

### Step 1: Choose a filtering level

1. In **Network Setup > Wireless**, open the guest SSID and select the **URL filtering** tab.
2. Select one of the following levels. Each level also applies the levels below it.

| Level    | What it does                                                               |
| -------- | -------------------------------------------------------------------------- |
| Strict   | Blocks everything in Moderate, along with other potentially harmful sites. |
| Moderate | Blocks everything in Low, and adult sites.                                 |
| Low      | Blocks online threats, including malware and spyware sites.                |
| None     | Allows full web access, with no filtering or restrictions.                 |

### Step 2: Add your own allowed and blocked websites

1. Select the **Advanced** tab. The **URL Filters** section has two lists: **Allowed URLs by URL filtering** and **Blocked URLs by URL filtering**. Use one list or the other, but not both.
2. To allow specific websites, click **Add** under **Allowed URLs by URL filtering** and enter each website.
3. To block specific websites, click **Add** under **Blocked URLs by URL filtering** and enter each website, for example, youtube.com.
4. To remove a website from a list, click the trash icon next to it.
5. Click **Save**.

**Note:** URL filtering is different from the Walled Garden. The Walled Garden lists websites guests can reach before they log in. URL filtering controls which websites guests can browse once they are connected. For more details, see [URL Filtering](https://docs.nilesecure.com/url-filtering).

## Customize and Control Guest Access

### Allow websites before login (Walled Garden)

Use the Walled Garden to let guests reach specific websites, such as help pages or login portals, before they log in.

1. In **Network Setup > Wireless**, open the guest SSID and select the **Guest service** tab.
2. Under **Walled Garden**, click **Add**. The list is labeled **Allowed URLs before authentication**.
3. Enter the website you want to allow.
4. Click **Save**.

### Brand the guest page

1. In the left navigation, select **Global Settings > Guest Portal**.
2. Under **Theme**, set the **Primary Color** and **Secondary Color**.
3. Under **Logo**, drag and drop your logo or click **choose file to upload**. Supported formats are .png, .jpg, and .jpeg, and the maximum file size is 5 MB.
4. Under **Background**, select **Image** or **Color**. If you select **Color**, set the **Background Color**.
5. To go back to the default look, click **Restore to default**.
6. Click **PREVIEW** to see the page. Use the buttons at the top to switch between desktop and mobile, and between the **Click Through**, **Email Approval**, and **Access Code** pages.

### Monitor guests

In the Nile Portal, you can see connected guest devices, user and device details, and traffic flow, in the same way as for employee traffic.

## Notes

- Guest traffic goes out to the internet through a Nile PoP. External websites and apps may see an IP location that differs from the guest's physical location. This is expected, and it can affect apps that use MFA or location checks.
- If your firewall policy requires allow lists, allow the regional Guest PoP IP addresses and FQDNs that Nile publishes. See [Guest Access](https://docs.nilesecure.com/guest-access).