How do I disconnect a device that is already connected?

Two things are needed. RADIUS accounting has to be on, because the button hangs off a live session — see "Do you support RADIUS accounting?". And you need a connector at that site: a small Docker container running on the customer's own network. The client's Connectors tab issues a single-use token and prints the command to run.

It exists because of reach. A disconnect has to arrive at the access point or switch actually holding the session, at its address on the local network — and those addresses cannot be reached from outside. A site with several access points cannot forward one port to all of them either. The connector dials out to Passbeam and holds the connection open, so nothing has to be opened inbound and it works behind NAT and CGNAT.

Two things to get right. Run it with --network host, or it reports a container address and every disconnect is dropped in silence. Then add the address shown on its row as an additional accounting server in the RADIUS profile — the accounting list, not the authentication list. Equipment only accepts a disconnect from an address its own profile lists, so this is what makes the connector heard at all. Any position in the list will do: it does not have to be the first, and authentication carries on going to Passbeam.

Give that row the site's RADIUS secret, from the client's Transport tab. Not the secret the other rows happen to use: on a RADSec profile those say the literal word radsec, because RFC 6614 fixes it and the TLS client certificate is what identifies the site. Passbeam signs every disconnect with the site's own secret, so a row that says radsec fails the check and the packet is dropped without an answer — the same silence as a missing row.

If the site has more than one profile, the connector has to be in each one you want disconnects on. A network running RADSec on one SSID and plain RADIUS on another has two profiles, and adding the connector to one does nothing for the other.

And the equipment has to be told to accept disconnects at all. On UniFi the setting is DAS/DAC (CoA), under Settings → WiFi → the network → Behavior Controls. A dynamic authorisation server is a small listener the access point runs on UDP 3799, separate from the part that authenticates people, whose only job is to take instructions about sessions that are already up — RFC 5176 calls them Disconnect and Change-of-Authorisation. Without it the access point can let a device on and can be told nothing about it afterwards, so a session only ends when the device leaves or its re-authentication comes round.

It is off by default and set per network, not per site or per profile — ticking it on one SSID leaves every other SSID quietly dropping disconnects, even ones sharing the same profile and the same connector. On UniFi it does not appear in the RADIUS profile at all, which is why it is easy to look straight past.

Passbeam builds and signs the packet itself, so the connector never holds your shared secret, and the reply is checked against that secret before the portal says a device came off.

A disconnect ends one session. A device that is still allowed on the network will simply join again — to keep it off, suspend or revoke it.

For the firewall rules, see "What firewall rules does the connector need?".