Captive portal detection, popup implementation?

Question

Based on hostapd, I am building a captive portal.

• My Linux Machine provides Wifi access.
• iPad's and Android clients-tablets connect to this Wifi.

Generally, any client OS checks if a URL is reachable; if not: client OS states it is captive, and displays a popup browser window. The popup is used for login, presentation or else.

I'd like to display such a popup to present my machine's service, but I don't get it. I've avoided the net forward though. All connections are redirected in the machine localhost website.

Why don't I get such a popup? How to get it? How/Where should I implement it on my localhost?

Similar ideas:

• https://bugzilla.mozilla.org/show_bug.cgi?id=562917

• Captive portal [HostApd] detection by the browser?

When the popup happens, how is its content is defined? For instance, a restaurant captive portal asks for your secret number on your note; where is this page is stored? How does the OS know the URL to display in the popup?

Answer 1

To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.

I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:

iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1

and then the webserver (nginx) redirecting to the login page:

# For iOS
if ($http_user_agent ~* (CaptiveNetworkSupport) ) {
    return 302 http://hotspot.localnet/hotspot.html;
}

# For others
location / {
    return 302 http://hotspot.localnet/;
}

iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:

<!--
<?xml version="1.0" encoding="UTF-8"?>
<WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
<Redirect>
<MessageType>100</MessageType>
<ResponseCode>0</ResponseCode>
<VersionHigh>2.0</VersionHigh>
<VersionLow>1.0</VersionLow>
<AccessProcedure>1.0</AccessProcedure>
<AccessLocation>Andrew Wippler is awesome</AccessLocation>
<LocationName>MyOpenAP</LocationName>
<LoginURL>http://hotspot.localnet/</LoginURL>
</Redirect>
</WISPAccessGatewayParam>
-->

Answer 2

For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.

Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.

(OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)

Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.

For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS