binary wrote

Hi, have implemented a hotel wlan solution with a lot of EAP110 (outdoor) and EAP245 APs. Guests using the Internet access with bandwidth limitation over VLAN. But with this configuration i can´t use a portal.

The EAPs are just access points, not multi-functional servers running a Captive Portal and not even a router. A CP must be hosted on a separate system. It makes no sense to have a CP on every AP in a hotspot system. Every CP solution I know of needs such a central authentication server for good reasons, be it on a dedicated local server or on a system in a cloud. I'm in the hotspot business since more than 10 years now and yes, we use EAPs (among other routers acting as gateways) as APs with our Captive Portal controller, which is hosted on a central server in our hotspot solution.

You can host the EAP controller in an AWS cloud instance if you don't want to use a local server for this task. And yes, the APs indeed do handle the redirect to the controller themselves if set to managed mode. The claims from user Advantech regarding the portal redirection are just nonsense.

What's more, a server running a Captive Portal should never ever run other unrelated business software for a simple reason: basic security considerations. A CP is not just an app or a service which can run on a system used for other tasks such as a billing system or hotel reservation system, since the CP must be exposed to the guest's LAN to handle the requests.

That being said, you can indeed use a portal with separate VLANs for EAP's multi-SSID mode, although probably not with your configuration.

See http://www.tp-link.com/us/faq-928.html for the steps to set up an external portal/authentication service (note that the EAC and the external portal/auth services can run on the same or on different servers). With this solution you can use every authentication scheme one can think of.

See http://www.tp-link.com/us/faq-896.html for a simple authentication scheme using a RADIUS server together with EAC (method 4). With this scheme, the RADIUS server could also reside on the same server as the EAC.

binary wrote

On this VM (no Domainmember) i have configured some routing and firewall rules to prevent access to other things except EAP Controller from both VLANs.

This is a professional alternative to isolate the public WiFi from the rest of the network. Glad it works for you.

Have fun! :)