Hi onehackers,
Looking for free solutions here regarding wifi voucher management system.
I have a starlink mini kit and a UniFi AC Pro Access Point. The intention is to provide internet access via a voucher-based wifi access. My problem is I do not know which tool is best suited for my use-case. I’m actually looking for free open-source voucher-based wifi access management system that I can use at my cafe’.
If we have some expert who’s willing to suggest solutions, kindly provide your input.
Thanks in advance.
Your cafe already owns the voucher system — it is inside the UniFi app you have not switched on yet 
The free UniFi app does vouchers, and no gateway has to be bought — the access point does the work on its own.
Starlink Mini ──► UniFi AC Pro ──► guest types a code
routes the cafe runs the hotspot the free app prints the codes
Four moves and your cafe has vouchers
- Run the free UniFi Network Application on anything that stays switched on
- Settings → WiFi → your SSID → Hotspot Portal on
- Hotspot → Vouchers — mint a batch, and set the time, data and speed each code gets
- Print them for the counter, or let the API sell them while you make coffee
Four moves, nothing to buy. Below: the same job on other hardware, and how the vouchers earn money.
- Counter cards I print myself
- A separate OpenWrt box
- The full RADIUS stack
- Sell them automatically
0
voters
📶 The free route — switch on what you already own
| Step | What to do |
|---|---|
| 1 | Run the free UniFi Network Application somewhere that stays on. Self-hosting today means UniFi OS Server — Ubuntu 24.04+ or Debian 13+, podman 4.9.3+, 2 GB RAM, and captive portals now serve on port 8444 — help.ui.com/34210126298775-Self-Hosting-UniFi |
| 2 | Older route that still works: the Windows/macOS/Linux installer with Java 8 and the bundled database, on https://localhost:8443 — help.ui.com/360012282453-Self-Hosting-a-UniFi-Network-Se |
| 3 | In the app: Settings → WiFi → your SSID → enable Hotspot Portal → Captive Portal — help.ui.com/115000166827-UniFi-Hotspots-and-Captive-Port |
| 4 | Brand it at Insights → Hotspot → Landing Page, then mint vouchers under Hotspot → Vouchers |
| 5 | No gateway needed — Ubiquiti’s community answer: the hotspot and captive portal run in the individual APs — community.ui.com/9dce6ff7-cc45-44fd-9d16-0a11d7800eef |
Every voucher carries four limits, all free, all set when you mint it — developer.ui.com/getvouchers:
| Field | What it controls |
|---|---|
timeLimitMinutes |
How long the code lives, in minutes |
dataUsageLimitMBytes |
The data cap |
rxRateLimitKbps / txRateLimitKbps |
Upload and download speed per voucher |
authorizedGuestLimit |
One device or several on the same code |
Three known faults and their fixes
| Gotcha | What to do |
|---|---|
| Network 9.4.11+ broke the voucher redirect when the SSID is also flagged as an isolated “Guest Network” | Leave the isolated-guest flag off on the voucher SSID |
| Network 10.0.160 removed the Add Voucher button for the non-admin Hotspot Manager role | Mint vouchers as an admin |
| Very large rolls hit a print ceiling near 3000 vouchers | Print in batches rather than one giant roll |
The controller runs 24/7. The APs keep running on their last config without it, and no new codes get issued — help.ui.com/360012282453-Self-Hosting-a-UniFi-Network-Se.
🖥️ The other free stacks — your own box doing the portal
Boxes that issue real voucher codes, not only a splash page:
| Project | What it does |
|---|---|
| github.com/nhAsif/luci-app-ndsvoucher | RoseNet Access Portal — a self-contained Go voucher system for OpenWrt with its own LuCI interface and prebuilt packages, updated September 2025. No coding, no separate database |
| github.com/openNDS | The openNDS project’s community theme_voucher gives OpenWrt real vouchers — a vouchers.txt file, strict validation and a QR code on the ticket |
| opennds.readthedocs.io | openNDS itself, the active OpenWrt captive portal (v11, GPL). It has no voucher engine of its own — the voucher comes from the theme or a script, so the two lines above matter |
| github.com/nodogsplash | NoDogSplash v5.0.2 — the simplest splash portal there is, with a BinAuth hook where you bolt your own voucher check on |
| docs.opnsense.org | OPNsense Captive Portal — voucher manager with validity windows, an API to mint and expire codes, and CSV export you merge into a Word or LibreOffice sheet for branded printouts |
| docs.netgate.com/pfsense | pfSense CE vouchers — cryptographically generated rolls, 0–1023 per roll, minutes per roll, CSV export, and no RADIUS server needed |
OPNsense and pfSense need a small x86 box with two or three network ports. This route costs hardware; the UniFi route costs nothing.
The full stack — one ledger behind every code
| Project | What it gives you |
|---|---|
| github.com/lirantal/daloradius | daloRADIUS 2.3, released May 2026 — the classic web face on FreeRADIUS: users, batch creation, accounting and billing |
| github.com/RADIUSdesk/rdcore | RADIUSdesk — generates memorable two-word vouchers instead of random strings, sets per-device bandwidth, and serves its own captive login pages |
| github.com/openwisp/openwisp-radius | OpenWISP RADIUS — Django admin plus a REST API, code generation, CSV import, and captive login pages you configure rather than write |
| github.com/giorgioladu/Rabind | Rabind v0.6.0, May 2026, AGPL — a small PHP panel for FreeRADIUS with voucher creation and live sessions, sized for one cafe rather than one campus |
| github.com/Kupiki/Kupiki-Hotspot-Admin-Install | The documented single-Raspberry-Pi build: CoovaChilli, FreeRADIUS and daloRADIUS installed by one script — this is the whole stack on hardware you may already own |
💰 Turn it into a till — sell vouchers with nobody at the counter
The customer pays, the code arrives, nobody stands at the counter.
guest pays ──► payment webhook ──► UniFi API mints the code ──► code arrives
cash Stripe Telegram
card Paystack · M-Pesa email · QR
| Piece | The free tool |
|---|---|
 Mint the code automatically |
developer.ui.com/getvouchers — the official UniFi Network API creates and lists vouchers, so your own script can return a code the moment money lands |
 Payment to code |
github.com/hotspotbilling/phpnuxbill — GPLv2, the most complete free billing-and-print stack, with gateway plugins and a FreeRADIUS path |
 Payment to session, containerised |
github.com/mhdhaidarah/samm-docker — one compose file running FreeRADIUS, PostgreSQL and a FastAPI service where Stripe or PayPal webhooks become live sessions |
 Mobile money, end to end |
github.com/mwakidenis/miktrotik-hotspot-billing — the M-Pesa STK push pattern wired to a hotspot, which is the shape any regional mobile-money wallet follows |
 Take cash with zero fees |
github.com/kleo/unipi — a Raspberry Pi with a coin slot and buttons that vends UniFi vouchers. No processor, no percentage, no internet payment rail at all |
 Sell inside Telegram |
github.com/animegasan/mikbotam — a Telegram bot that sells vouchers and delivers the code in chat |
 Sell over WhatsApp |
github.com/rmyndharis/OPENWA — a self-hosted WhatsApp HTTP gateway, so your own number is the storefront — africastalking.com/sms adds SMS and USSD for customers without data |
 Vouchers by email |
brevo.com/free-smtp-server — a free SMTP relay at 300 emails a day, which is more than a cafe sends |
 A QR on every ticket |
github.com/heuer/segno — a pure-Python QR encoder with no dependencies, so every code can carry its own scannable square |
 Print 42 to a sheet |
github.com/kleo/koffe — UniFi vouchers laid out 42 to a page for a paper cutter, printed straight from Chromium to PDF |
 Print to a receipt roll |
github.com/glenndehaan/unifi-voucher-site — 306 stars, with 80 mm thermal and ESC/POS bulk printing plus automatic email |
 A kiosk that dispenses codes |
github.com/etiennecollin/unifi-voucher-manager — MIT, updated July 2026 — batch up to 1000 vouchers, QR printing, purge expired, and a touch-friendly reception view |
 Print with no drivers at all |
github.com/Fransuelton/escpos-direct — the browser talks ESC/POS straight to the USB printer, so there is no CUPS and no driver to install |
Cash vending, zero fees: a Raspberry Pi, a coin acceptor and a script. No processor, no chargebacks, and no internet needed for the sale.
Two facts about the money
| Note | Why |
|---|---|
| Stripe, Paystack, Flutterwave and M-Pesa charge per transaction, never monthly — docs.stripe.com/webhooks and paystack.com/docs/payments/webhooks | The software is free; the rail takes a cut only when money moves |
| Your Starlink is behind CGNAT, so nothing outside can reach a webhook on your Pi — starlink.com/ac09301b-cef6-a125-c251-856196a77f92 | Point the webhook at a free tunnel on the Pi, and the money still lands |
🔌 Make it real — wiring, speed tiers, one-device lock, watching it
| Fact | What it means for you |
|---|---|
| The Mini has a built-in Wi-Fi 5 router and one latching Ethernet LAN port — starlink.com/specification_sheet_mini | It can route the cafe alone, up to 128 devices. It has no portal and no vouchers, which is why the AP does that job |
| To wire it out, remove the Starlink Plug and use the official Mini Ethernet cable or your own RJ45 — starlink.com/installation_guide_mini_kit | This is the physical link to the AC Pro. A plain RJ45 gives up the IP67 rating outdoors, so keep the run inside |
| Bypass mode disables the Mini’s Wi-Fi completely and needs a factory reset to undo — starlink.com/a0fe8d51-32f7-d2b9-d74a-801e31ad9f6a | Use it only when a separate router takes over. Otherwise stay in router mode and let the Mini keep DHCP and NAT |
| Double NAT is the trap when you add the AP — starlink.com/afa36fff-1070-80b2-be96-eb6f78ef13be | One router only. Let the Mini route and the AP simply serve |
| CGNAT blocks all inbound ports, there are no static IPs, and Residential plans cap at 1,200 concurrent sessions — starlink.com/bb372afe-7dd4-ae54-a2af-29cf63d24ddf | Your portal works fine on the LAN. Remote access to it, or a webhook, needs an outbound tunnel instead of port forwarding |
| The AC Pro takes 802.3af/at, 9 W max, and the single pack already includes the 48 V PoE adapter — techspecs.ui.com/uap-ac-pro | Nothing to buy for power. A 24 V passive injector will not work, and the second port is bridging only |
| Around 70 clients is the practical comfort zone per AC Pro against a 250+ headline figure — community.ui.com/31288a8e-4c6a-46df-9e4c-b572700a2c2a | A cafe of 20–50 browsing guests is well inside capacity. The uplink is the real ceiling, not the AP |
| Total load is roughly 35–50 W, and the Mini runs −30 °C to +50 °C | A 600 W UPS gives about an hour of uptime, and a plain ceiling gap matters in a hot kitchen — pimylifeup.com/raspberry-pi-nut-server |
| Want | The free answer |
|---|---|
| “1 hour at 5 Mbps” versus “1 day at 20 Mbps” | Set rxRateLimitKbps and txRateLimitKbps on the voucher itself. On plain Linux the same job is openwrt.org/sqm, which shapes fairly even on a busy Starlink link |
| Ready-made Bronze, Silver and Gold tiers | mikrotikdocs.fyi/htb-isp-tiered-bandwidth publishes a tiered queue tree you can copy into MikroTik or translate to CAKE |
| One voucher, one device | FreeRADIUS Simultaneous-Use — the official tutorial sets exactly one session per user — freeradius.org/documentation |
| Lock a UniFi voucher to a MAC | github.com/maravento/uhm — UniFi Hotspot Manager, GPLv3: a Linux manager that wraps a self-hosted UniFi hotspot with DHCP, ACLs and firewall rules, so access is pinned at the network layer with no RADIUS deployment |
| See who is online and what they used | github.com/Maizil41/RadiusMonitor — MIT, active into 2026: active users, per-user usage and income worked out from the accounting data |
| Uptime and per-port usage on the uplink | librenms.org auto-discovers the AP and graphs it, and help.ui.com/33502980942615-SNMP-Monitoring-in-UniFi-Netw shows how to turn SNMP on for it |
| Sold-versus-used at the end of the day | github.com/amolood/phpnuxbill-users-data-usage-plugin turns FreeRADIUS accounting into a per-user usage CSV — the reconciliation is a spreadsheet, not a guess |
Ticket states
created ──► printed ──► sold ──► in use ──► used up
— truecafe.net/doc/tickets.html
| Diagnosis | The free check |
|---|---|
| Is it actually CGNAT? | Compare the WAN address with the public address — a 100.64.0.0/10 address means CGNAT |
| AP not adopting | It must share a layer-2 network with the controller with TCP 8080 reachable; the fallback address is 192.168.1.20 and WiFiman finds it — help.ui.com/360012622613-UniFi-Device-Adoption |
| PoE trouble | Solid amber means healthy and waiting to be adopted, not a fault — help.ui.com/204910134-Understanding-Device-LED-Status-In |
Free monitoring for the link
| Tool | What it shows |
|---|---|
| github.com/danopstech/starlink | A docker-compose stack that scrapes the dish itself into Prometheus and Grafana — uptime, latency, throughput and data used, in one command |
| grafana.com/24517-starlink | The ready-made Starlink dashboard for that exporter, so the graphs are done before you install anything |
| github.com/faeton/dishwatch | One Go binary, no server: ping, drop, throughput and dish power draw in the terminal |
| github.com/louislam/uptime-kuma | Uptime and latency alerts for the link and the AP, with a status page you can show customers |
| pimylifeup.com/raspberry-pi-nut-server | NUT, the free Network UPS Tools, so a power cut tells you instead of simply closing the cafe |
Switch on the hotspot in the UniFi app, mint a voucher, print a sheet — then let the API sell the next one while the coffee gets made.
That is a shitload of VERY GOOD information. AWESOME!!! Thank you Lucifer!!!
Thanks for much for this tone of info. Really helpful 
!