For operators: Use one clearly defined routing/controller layer and add access points for coverage. Avoid accidental double NAT or multiple DHCP servers unless the design intentionally requires them.
Start with the correct platform and role
Piso WiFi is a category of prepaid/captive-portal deployments, not one standardized router firmware. A vending/controller platform, the upstream ISP router, and separate Wi-Fi access points can all have different addresses and credentials. The customer portal and the operator admin page are also different security roles. General topology guidance aligned with documented WAN/LAN separation.
Step-by-step checklist
- ISP modem/ONT → controller/router WAN.
- Controller/router LAN → managed switch if needed.
- Access points → LAN/switch, usually in AP/bridge mode unless platform design says otherwise.
- Customer SSID/captive portal → isolated client network.
- Admin management → separate trusted path where possible.
What not to assume
Two active DHCP servers on one client LAN can create intermittent, confusing failures. An AP should not normally become a second NAT router unless that is an intentional subnet boundary. Likewise, 10.0.0.1 is only a private IPv4 address. Its presence does not identify the software by itself, and changing the address does not change how the vending/session system works.
Customer-side checks
- Stay connected to the Piso WiFi SSID and turn off a VPN temporarily if the portal will not open.
- Do not type operator credentials into a public search result.
- If a portal fails only on one phone, test browser captive-portal state, Private DNS, MAC randomization and date/time before blaming the machine.
- Keep payment/voucher proof until the session is confirmed.
- For pause/resume or voucher issues, use the same device when the platform ties sessions to a device identity.
Operator-side checks
Troubleshoot in layers. Confirm stable power, then WAN internet, controller WAN/LAN interfaces, DHCP/DNS, access-point reachability, captive-portal service, payment input, and finally the user/session database. If every client fails, focus on shared infrastructure. If one client fails, compare that client with a working one before rebooting or resetting the system.
Security and reliability
- Change initial/factory administrator credentials after setup.
- Keep customer traffic separated from the management LAN where the platform supports it.
- Use official software updates and make backups before upgrading.
- Protect the controller, coin acceptor and power hardware from moisture, heat and unstable power.
- Use a proper access point for coverage and capacity rather than assuming the controller board’s radio can serve a busy area.
- Never expose the admin dashboard directly to the public internet through an unrestricted port forward.
Network architecture matters more than the portal IP
A healthy installation normally has a clear upstream/downstream design: ISP modem or ONT, then the device responsible for routing/session control, then switches/access points serving customers. Avoid accidental double DHCP, overlapping subnets and a consumer Wi-Fi router running NAT behind the vending controller unless the design intentionally calls for another routed boundary. Label WAN and LAN cables so a maintenance visit does not silently reverse them.
Payment and session integrity
When money or vouchers are involved, troubleshoot payment confirmation separately from internet access. Keep transaction/session logs long enough for legitimate support and reconciliation, but do not collect secrets that the payment provider does not require. For digital wallets, the operator should never request a customer PIN or one-time password. Test duplicate payments, failed callbacks, controller restarts and recovery after power loss before advertising a new payment option.
Maintenance checklist
- Keep the controller/router and access-point software on supported releases from the official vendor.
- Back up configuration before updates and store a copy away from the machine.
- Check power supply, ventilation, storage health and cable condition.
- Review peak-hour WAN utilization, loaded latency and access-point client counts.
- Audit admin accounts after staff/vendor changes and remove access that is no longer needed.
- Test the customer journey—from joining Wi-Fi through payment, portal access, session expiry and reconnect—after every major change.
Check the exact platform before using credentials or reset steps
Piso WiFi systems are not one standardized firmware. Match the machine name, installed version, controller type and local network before applying a login, password-recovery or reset instruction. If the device label or installed platform shows a different address or workflow, use the information for that exact machine rather than forcing a value from another platform.
The controller and access point should have clear jobs
The Piso controller should enforce the captive portal/session policy on the customer LAN; access points should provide radio coverage without secretly creating another NAT/DHCP boundary unless the design explicitly requires routing. A consumer router added in normal router mode can create a second subnet, bypass or break portal logic, and make troubleshooting much harder.
Use wired backhaul where practical
For a commercial hotspot, wired Ethernet from the controller/switch to access points is usually more predictable than repeating a crowded Wi-Fi channel. If VLANs are used, document which VLAN carries customer traffic and which network manages the APs. AdoPiSoft currently documents access-point/VLAN examples, including VLAN 22 in specific setup guidance; that does not make VLAN 22 a universal requirement for every platform.
Plan capacity per coverage zone
Place access points where customers actually use the service, then measure signal and loaded performance. Avoid putting every AP on the same 2.4 GHz channel or using excessive transmit power. A good design gives clients a strong enough signal and enough airtime capacity while preserving a predictable path back to the captive-portal controller.
Recommended role separation
The upstream modem/ONT terminates the ISP service; the Piso controller/router enforces customer addressing, captive-portal, session, and payment policy; switches extend Ethernet; access points provide Wi-Fi without creating an unintended new NAT/DHCP boundary. In a larger site, management VLANs or separate trusted networks can isolate AP/controller administration from customers while still allowing the controller to enforce policy.
How to recognize a misconfigured AP
If clients connected to one AP receive a different subnet or gateway, cannot reach the normal portal, or bypass normal session control, that AP may be operating as a router instead of a bridge/AP. If all APs share the correct subnet but only one area has poor service, investigate its uplink negotiation, PoE/power, channel, interference, backhaul, and client count. Do not change the controller LAN just to fix one radio cell.
Frequently asked questions
Should an added AP run DHCP?
Normally not when it is extending the existing customer LAN. The controller/router should remain the intended DHCP/routing authority. An AP accidentally running DHCP can hand clients the wrong gateway and break portal enforcement.
What is the benefit of wired AP backhaul?
It avoids consuming wireless airtime for backhaul and usually gives more predictable capacity/latency. Wireless/mesh backhaul can work, but its link quality and channel use become another bottleneck to measure.
How should AP management IPs be assigned?
Use predictable static addresses or reservations outside the normal customer lease pool, and document each AP location/model/uplink. Avoid address collisions and make sure management access is restricted appropriately.
Why can one AP bypass the captive portal?
It may be connected to the upstream network instead of the controlled LAN, placed on the wrong VLAN, or operating in router/NAT mode. Compare its client gateway/subnet with a working AP.
Where this advice stops being universal
The principles in Piso WiFi Router vs Access Point: Recommended Network Layout apply broadly, but interface names and supported features do not. A mesh system managed by an app, an ISP gateway with provider firmware, a prosumer firewall, and an ordinary retail router can expose the same underlying function in very different ways. Use the concept to understand the job, then use the exact device documentation to perform it.
Do not import settings from a different topology
Values copied from another household can create overlaps, break WAN authentication, expose services, or disable access to the management interface. Copy the reasoning, not the configuration.