This article needs additional citations for verification .(March 2021) |
A captive portal is a web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi or wired network before they are granted broader access to network resources. Captive portals are commonly used to present a landing or log-in page which may require authentication, payment, acceptance of an end-user license agreement/acceptable use policy, survey completion, or other valid credentials that both the host and user agree to adhere by. [1] Captive portals are used for a broad range of mobile and pedestrian broadband services – including cable and commercially provided Wi-Fi and home hotspots. A captive portal can also be used to provide access to enterprise or residential wired networks, such as apartment houses, hotel rooms, and business centers.
The captive portal is presented to the client and is stored either at the gateway or on a web server hosting the web page. Depending on the feature set of the gateway, websites or TCP ports can be allow-listed so that the user would not have to interact with the captive portal in order to use them. The MAC address of attached clients can also be used to bypass the login process for specified devices.
WISPr refers to this web browser-based authentication method as the Universal Access Method (UAM). [2]
Captive portals are primarily used in open wireless networks where the users are shown a welcome message informing them of the conditions of access (allowed ports, liability, etc.). Administrators tend to do this so that their own users take responsibility for their actions and to avoid any legal responsibility. [3] Whether this delegation of responsibility is legally valid is a matter of debate. [4] [5] Some networks may also require entering the user's cell phone number or identity information so that administrators can provide information to authorities in case there was illegal activity on the network.
Often captive portals are used for marketing and commercial communication purposes. Access to the Internet over open Wi-Fi is prohibited until the user exchanges personal data by filling out a web-based registration form in a web browser. The web-based form either automatically opens in a web browser, or appears when the user opens a web browser and tries to visit any web page. In other words, the user is "captive" - unable to access the Internet freely until the user is granted access to the Internet and has "completed" the captive portal. This allows the provider of this service to display or send advertisements to users who connect to the Wi-Fi access point. This type of service is also sometimes known as "social Wi-Fi", as they may ask for a social network account to login (such as Facebook). Over the past few years, such social Wi-Fi captive portals have become commonplace with various companies offering marketing centered around Wi-Fi data collection. [6]
The user can find many types of content in the captive portal, and it's frequent to allow access to the Internet in exchange for viewing content or performing a certain action (often, providing personal data to enable commercial contact); thus, the marketing use of the captive portal is a tool for lead generation (business contacts or potential clients). [7]
There are various ways to implement a captive portal.
A common method is to direct all World Wide Web traffic to a web server, which returns an HTTP redirect to a captive portal. [8] When a modern, Internet-enabled device first connects to a network, it sends out an HTTP request to a detection URL predefined by its vendor and expects an HTTP status code 200 OK or 204 No Content. If the device receives a HTTP 2xx status code, it assumes it has unlimited internet access. Captive portal prompts are displayed when you are able to manipulate this first HTTP message to return a HTTP status code of 302 (redirect) to the captive portal of your choice. [9] [10] RFC 6585 specifies the 511 Network Authentication Required status code.
Client traffic can also be redirected using ICMP redirect on the layer 3 level.
When a client requests a resource on a remote host by name, DNS is queried to resolve that hostname. In a captive portal, the firewall will make sure that only the DNS server(s) provided by the network's DHCP can be used by unauthenticated clients (or, alternatively, it will forward all DNS requests by unauthenticated clients to that DNS server). This DNS server will return the IP address of the captive portal page as a result of all DNS lookups.
In order to perform redirection by DNS the captive portal uses DNS hijacking to perform an action similar to a man-in-the-middle attack. To limit the impact of DNS poisoning, a TTL of 0 is typically used.
RFC 8910 introduces a standardized method for networks to inform clients about the presence of RFC 8908 Captive Portal API endpoints using DHCP (both IPv4 and DHCPv6) options and IPv6 NDP router advertisements. RFC 8910 was implemented in systemd-networkd v254 in July 2023. [11] [12] NetworkManager discussions have also explored using them for captive portal interactions. [13]
Captive portal detection URLs typically return a minimal, standardized response when not behind a captive portal. When the device receives the expected response, it concludes that it has direct internet access. If the response is different, the device assumes it is behind a captive portal and triggers the captive portal login process.
Platform | Test URL | Expected response |
---|---|---|
Apple (MacOS/IOS Family) | Current: | HTML with "Success" in both the title and body text. |
Legacy: | ||
Google [14] (Android/ChromeOS) | http://connectivitycheck.gstatic.com/generate_204 | HTTP status code 204 with an empty body |
http://clients3.google.com/generate_204 | ||
Windows [15] | Current (Windows 10 1607 and later): | "Microsoft Connect Test" (plain text) |
Legacy (Prior to Windows 10 1607): | "Microsoft NCSI" (plain text) | |
NetworkManager (GNOME) | http://nmcheck.gnome.org/check_network_status.txt | "NetworkManager is online" (plain text) |
NetworkManager (KDE Plasma) | http://networkcheck.kde.org/ | "OK" (plain text) |
Captive portals have been known to have incomplete firewall rule sets—such as outbound ports being left open—that allow clients to circumvent the portal. [16]
In some deployments, the rule set will route DNS requests from clients to the Internet, or the provided DNS server will fulfill arbitrary DNS requests from the client. This allows a client to bypass the captive portal and access the open Internet by tunneling arbitrary traffic within DNS packets.
Some captive portals may be configured to allow appropriately equipped user agents to detect the captive portal and automatically authenticate. User agents and supplemental applications such as Apple's Captive Portal Assistant can sometimes transparently bypass the display of captive portal content against the wishes of the service operator as long as they have access to correct credentials, or they may attempt to authenticate with incorrect or obsolete credentials, resulting in unintentional consequences such as accidental account locking.
A captive portal that uses MAC addresses to track connected devices can sometimes be circumvented by re-using the MAC address of a previously authenticated device. Once a device has been authenticated to the captive portal using valid credentials, the gateway adds that device's MAC address to its allowlist; since MAC addresses can easily be spoofed, any other device can pretend to be the authenticated device and bypass the captive portal. Once the IP and MAC addresses of other connecting computers are found to be authenticated, any machine can spoof the MAC address and Internet Protocol (IP) address of the authenticated target, and be allowed a route through the gateway. For this reason some captive portal solutions created extended authentication mechanisms to limit the risk for usurpation.[ further explanation needed ]
Captive portals often require the use of a web browser; users who first use an email client or other application that relies on the Internet may find the connection not working without explanation, and will then need to open a web browser to validate. This may be problematic for users who do not have any web browser installed on their operating system. It is however sometimes possible to use email and other facilities that do not rely on DNS (e.g. if the application specifies the connection IP address rather than the hostname). A similar problem can occur if the client uses AJAX or joins the network with pages already loaded into its web browser, causing undefined behavior (for example, corrupt messages appear) when such a page tries HTTP requests to its origin server.
Similarly, as HTTPS connections cannot be redirected (at least not without triggering security warnings), a web browser that only attempts to access secure websites before being authorized by the captive portal will see those attempts fail without explanation (the usual symptom is that the intended website appears to be down or inaccessible).
Platforms that have Wi-Fi and a TCP/IP stack but do not have a web browser that supports HTTPS cannot use many captive portals. Such platforms include the Nintendo DS running a game that uses Nintendo Wi-Fi Connection. Non-browser authentication is possible using WISPr, an XML-based authentication protocol for this purpose, or MAC-based authentication or authentications based on other protocols.
It is also possible for a platform vendor to enter into a service contract with the operator of a large number of captive portal hotspots to allow free or discounted access to the platform vendor's servers via the hotspot's walled garden. For example, in 2005 Nintendo and Wayport partnered to provide free Wi-Fi access to Nintendo DS users at certain McDonald's restaurants. [17] Also, VoIP and SIP ports could be allowed to bypass the gateway to allow phones to make and receive calls.
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.
In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. It improves privacy, security, and possibly performance in the process.
Dynamic DNS (DDNS) is a method of automatically updating a name server in the Domain Name System (DNS), often in real time, with the active DDNS configuration of its configured hostnames, addresses or other information.
Universal Plug and Play (UPnP) is a set of networking protocols on the Internet Protocol (IP) that permits networked devices, such as personal computers, printers, Internet gateways, Wi-Fi access points and mobile devices, to seamlessly discover each other's presence on the network and establish functional network services. UPnP is intended primarily for residential networks without enterprise-class devices.
Zero-configuration networking (zeroconf) is a set of technologies that automatically creates a usable computer network based on the Internet Protocol Suite (TCP/IP) when computers or network peripherals are interconnected. It does not require manual operator intervention or special configuration servers. Without zeroconf, a network administrator must set up network services, such as Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), or configure each computer's network settings manually.
In computer networking, a network service is an application running at the network application layer and above, that provides data storage, manipulation, presentation, communication or other capability which is often implemented using a client–server or peer-to-peer architecture based on application layer network protocols.
The Web Proxy Auto-Discovery (WPAD) Protocol is a method used by clients to locate the URL of a configuration file using DHCP and/or DNS discovery methods. Once detection and download of the configuration file is complete, it can be executed to determine the proxy for a specified URL.
A network access server (NAS) is a group of components that provides remote users with a point of access to a network.
A hotspot gateway is a device that provides authentication, authorization and accounting for a wireless network. This can keep malicious users off of a private network even in the event that they are able to break the encryption. A wireless hotspot gateway helps solve guest user connectivity problems by offering instant Internet access without the need for configuration changes to the client computer or any resident client-side software. This means that even if client configuration such as network IP address or HTTP Proxy settings are different from that of the provided network, the client can still get access to the network instantly with their existing network configuration.
Wireless security is the prevention of unauthorized access or damage to computers or data using wireless networks, which include Wi-Fi networks. The term may also refer to the protection of the wireless network itself from adversaries seeking to damage the confidentiality, integrity, or availability of the network. The most common type is Wi-Fi security, which includes Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA). WEP is an old IEEE 802.11 standard from 1997. It is a notoriously weak security standard: the password it uses can often be cracked in a few minutes with a basic laptop computer and widely available software tools. WEP was superseded in 2003 by WPA, a quick alternative at the time to improve security over WEP. The current standard is WPA2; some hardware cannot support WPA2 without firmware upgrade or replacement. WPA2 uses an encryption device that encrypts the network with a 256-bit key; the longer key length improves security over WEP. Enterprises often enforce security using a certificate-based system to authenticate the connecting device, following the standard 802.11X.
IEEE 802.11u-2011 is an amendment to the IEEE 802.11-2007 standard to add features that improve interworking with external networks.
WISPr or Wireless Internet Service Provider roaming is a draft protocol submitted to the Wi-Fi Alliance that allows users to roam between wireless internet service providers in a fashion similar to that which allows cellphone users to roam between carriers. A RADIUS server is used to authenticate the subscriber's credentials.
WiFiDog was an open source embeddable captive portal solution used to build wireless hotspots. It is no longer an active project after not being updated for several years.
Network access control (NAC) is an approach to computer security that attempts to unify endpoint security technology, user or system authentication and network security enforcement.
WilmaGate is a collection of open-source tools for Authentication, Authorization and Accounting on an Open Access Network. It has been initially developed by the Computer Networks and Mobility Group at the University of Trento (Italy).
Zeroshell is a small open-source Linux distribution for servers and embedded systems which aims to provide network services. Its administration relies on a web-based graphical interface; no shell is needed to administer and configure it. Zeroshell is available as Live CD and CompactFlash images, and VMware virtual machines.
DNS hijacking, DNS poisoning, or DNS redirection is the practice of subverting the resolution of Domain Name System (DNS) queries. This can be achieved by malware that overrides a computer's TCP/IP configuration to point at a rogue DNS server under the control of an attacker, or through modifying the behaviour of a trusted DNS server so that it does not comply with internet standards.
A Visitor-based network (VBN) is a computer network intended for mobile users in need of temporary Internet access. A visitor-based network is most commonly established in hotels, airports, convention centers, universities, and business offices. It gives the on-the-go user a quick and painless way to temporarily connect a device to networks and broadband Internet connections. A visitor-based network usually includes hardware, telecommunications, and service.
A virtual private network (VPN) service provides a proxy server to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against data profiling or MitM attacks on hostile networks.