Docs › Walled garden
Walled Garden
Walled Garden — Bypass Domains
The walled garden is a list of websites and IP addresses that unauthenticated clients can reach before they have paid or logged in. This is essential for the payment flow — without it, clients cannot reach the billing portal or payment gateway to buy access.
·
What is always included
Every provisioned router automatically gets walled garden entries for: the billing portal (
billing.ioxsolution.com), Paystack payment pages (*.paystack.com, *.paystack.co, *.paystackintegrations.com), and Paystack's AWS CDN (*.amazonaws.com). These are required for online payment to work.·
HTTP vs HTTPS entries
RouterOS walled garden
dst-host entries only cover HTTP traffic. For HTTPS (port 443), the system also resolves the IP addresses of each domain at provisioning time and adds separate IP-based walled garden entries. This ensures the payment page loads correctly even when clients haven't authenticated yet.·
Automatic re-application after outage
If a router was offline when walled garden settings were updated, the correct entries are automatically pushed the next time the router comes back online — no manual intervention needed.
·
Provisioning updates the walled garden
Running Push Hotspot Setup on a router rebuilds the walled garden from scratch with the latest entries. IP addresses are re-resolved at that point, so this is also useful if a domain's IPs have changed.
Payment page not loading for unauthenticated clients? The most common cause is stale IP entries in the walled garden. Run Push Hotspot Setup on the affected router to re-resolve IPs and rebuild the walled garden with current addresses.