Captive portal detection, popup implementation?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












4















Based on hostapd, I am building a captive portal.



  • My Linux Machine provides Wifi access.

  • iPad's and Android clients-tablets connect to this Wifi.

Generally, any client OS checks if a URL is reachable; if not: client OS states it is captive, and displays a popup browser window. The popup is used for login, presentation or else.



I'd like to display such a popup to present my machine's service, but I don't get it. I've avoided the net forward though. All connections are redirected in the machine localhost website.



Why don't I get such a popup? How to get it?
How/Where should I implement it on my localhost?



Similar ideas:



  • https://bugzilla.mozilla.org/show_bug.cgi?id=562917


  • Captive portal [HostApd] detection by the browser?


When the popup happens, how is its content is defined? For instance, a restaurant captive portal asks for your secret number on your note; where is this page is stored? How does the OS know the URL to display in the popup?










share|improve this question




























    4















    Based on hostapd, I am building a captive portal.



    • My Linux Machine provides Wifi access.

    • iPad's and Android clients-tablets connect to this Wifi.

    Generally, any client OS checks if a URL is reachable; if not: client OS states it is captive, and displays a popup browser window. The popup is used for login, presentation or else.



    I'd like to display such a popup to present my machine's service, but I don't get it. I've avoided the net forward though. All connections are redirected in the machine localhost website.



    Why don't I get such a popup? How to get it?
    How/Where should I implement it on my localhost?



    Similar ideas:



    • https://bugzilla.mozilla.org/show_bug.cgi?id=562917


    • Captive portal [HostApd] detection by the browser?


    When the popup happens, how is its content is defined? For instance, a restaurant captive portal asks for your secret number on your note; where is this page is stored? How does the OS know the URL to display in the popup?










    share|improve this question


























      4












      4








      4


      1






      Based on hostapd, I am building a captive portal.



      • My Linux Machine provides Wifi access.

      • iPad's and Android clients-tablets connect to this Wifi.

      Generally, any client OS checks if a URL is reachable; if not: client OS states it is captive, and displays a popup browser window. The popup is used for login, presentation or else.



      I'd like to display such a popup to present my machine's service, but I don't get it. I've avoided the net forward though. All connections are redirected in the machine localhost website.



      Why don't I get such a popup? How to get it?
      How/Where should I implement it on my localhost?



      Similar ideas:



      • https://bugzilla.mozilla.org/show_bug.cgi?id=562917


      • Captive portal [HostApd] detection by the browser?


      When the popup happens, how is its content is defined? For instance, a restaurant captive portal asks for your secret number on your note; where is this page is stored? How does the OS know the URL to display in the popup?










      share|improve this question
















      Based on hostapd, I am building a captive portal.



      • My Linux Machine provides Wifi access.

      • iPad's and Android clients-tablets connect to this Wifi.

      Generally, any client OS checks if a URL is reachable; if not: client OS states it is captive, and displays a popup browser window. The popup is used for login, presentation or else.



      I'd like to display such a popup to present my machine's service, but I don't get it. I've avoided the net forward though. All connections are redirected in the machine localhost website.



      Why don't I get such a popup? How to get it?
      How/Where should I implement it on my localhost?



      Similar ideas:



      • https://bugzilla.mozilla.org/show_bug.cgi?id=562917


      • Captive portal [HostApd] detection by the browser?


      When the popup happens, how is its content is defined? For instance, a restaurant captive portal asks for your secret number on your note; where is this page is stored? How does the OS know the URL to display in the popup?







      linux wifi authentication hostapd






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jul 23 '18 at 19:50









      Rui F Ribeiro

      41.6k1483141




      41.6k1483141










      asked Jun 29 '15 at 14:22









      ArchiT3KArchiT3K

      298429




      298429




















          2 Answers
          2






          active

          oldest

          votes


















          2














          To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.



          I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:



          iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1


          and then the webserver (nginx) redirecting to the login page:



          # For iOS
          if ($http_user_agent ~* (CaptiveNetworkSupport) )
          return 302 http://hotspot.localnet/hotspot.html;


          # For others
          location /
          return 302 http://hotspot.localnet/;



          iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:



          <!--
          <?xml version="1.0" encoding="UTF-8"?>
          <WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
          <Redirect>
          <MessageType>100</MessageType>
          <ResponseCode>0</ResponseCode>
          <VersionHigh>2.0</VersionHigh>
          <VersionLow>1.0</VersionLow>
          <AccessProcedure>1.0</AccessProcedure>
          <AccessLocation>Andrew Wippler is awesome</AccessLocation>
          <LocationName>MyOpenAP</LocationName>
          <LoginURL>http://hotspot.localnet/</LoginURL>
          </Redirect>
          </WISPAccessGatewayParam>
          -->





          share|improve this answer























          • +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

            – Rui F Ribeiro
            Feb 2 '18 at 10:32












          • We are in 2018 now. Have you worked more on this?

            – Rui F Ribeiro
            Mar 6 '18 at 20:28


















          2














          For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.



          Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.



          (OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)



          Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.



          For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS






          share|improve this answer
























            Your Answer








            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "106"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













            draft saved

            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f212871%2fcaptive-portal-detection-popup-implementation%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            2














            To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.



            I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:



            iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1


            and then the webserver (nginx) redirecting to the login page:



            # For iOS
            if ($http_user_agent ~* (CaptiveNetworkSupport) )
            return 302 http://hotspot.localnet/hotspot.html;


            # For others
            location /
            return 302 http://hotspot.localnet/;



            iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:



            <!--
            <?xml version="1.0" encoding="UTF-8"?>
            <WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
            <Redirect>
            <MessageType>100</MessageType>
            <ResponseCode>0</ResponseCode>
            <VersionHigh>2.0</VersionHigh>
            <VersionLow>1.0</VersionLow>
            <AccessProcedure>1.0</AccessProcedure>
            <AccessLocation>Andrew Wippler is awesome</AccessLocation>
            <LocationName>MyOpenAP</LocationName>
            <LoginURL>http://hotspot.localnet/</LoginURL>
            </Redirect>
            </WISPAccessGatewayParam>
            -->





            share|improve this answer























            • +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

              – Rui F Ribeiro
              Feb 2 '18 at 10:32












            • We are in 2018 now. Have you worked more on this?

              – Rui F Ribeiro
              Mar 6 '18 at 20:28















            2














            To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.



            I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:



            iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1


            and then the webserver (nginx) redirecting to the login page:



            # For iOS
            if ($http_user_agent ~* (CaptiveNetworkSupport) )
            return 302 http://hotspot.localnet/hotspot.html;


            # For others
            location /
            return 302 http://hotspot.localnet/;



            iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:



            <!--
            <?xml version="1.0" encoding="UTF-8"?>
            <WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
            <Redirect>
            <MessageType>100</MessageType>
            <ResponseCode>0</ResponseCode>
            <VersionHigh>2.0</VersionHigh>
            <VersionLow>1.0</VersionLow>
            <AccessProcedure>1.0</AccessProcedure>
            <AccessLocation>Andrew Wippler is awesome</AccessLocation>
            <LocationName>MyOpenAP</LocationName>
            <LoginURL>http://hotspot.localnet/</LoginURL>
            </Redirect>
            </WISPAccessGatewayParam>
            -->





            share|improve this answer























            • +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

              – Rui F Ribeiro
              Feb 2 '18 at 10:32












            • We are in 2018 now. Have you worked more on this?

              – Rui F Ribeiro
              Mar 6 '18 at 20:28













            2












            2








            2







            To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.



            I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:



            iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1


            and then the webserver (nginx) redirecting to the login page:



            # For iOS
            if ($http_user_agent ~* (CaptiveNetworkSupport) )
            return 302 http://hotspot.localnet/hotspot.html;


            # For others
            location /
            return 302 http://hotspot.localnet/;



            iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:



            <!--
            <?xml version="1.0" encoding="UTF-8"?>
            <WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
            <Redirect>
            <MessageType>100</MessageType>
            <ResponseCode>0</ResponseCode>
            <VersionHigh>2.0</VersionHigh>
            <VersionLow>1.0</VersionLow>
            <AccessProcedure>1.0</AccessProcedure>
            <AccessLocation>Andrew Wippler is awesome</AccessLocation>
            <LocationName>MyOpenAP</LocationName>
            <LoginURL>http://hotspot.localnet/</LoginURL>
            </Redirect>
            </WISPAccessGatewayParam>
            -->





            share|improve this answer













            To make a captive portal appear, you need to stop all internet traffic and provide a 302 redirect to the client's browser. To do this, you need to have a firewall (like iptables) redirect all traffic to a webserver (like nginx,apache,etc) where the webserver responds with a 302 redirect to the url of your login page.



            I have written a lengthy article on my blog on how to do this with a Raspberry Pi. It basically boils down to the iptables block/redirect to webserver:



            iptables -t nat -A wlan0_Unknown -p tcp --dport 80 -j DNAT --to-destination 192.168.24.1


            and then the webserver (nginx) redirecting to the login page:



            # For iOS
            if ($http_user_agent ~* (CaptiveNetworkSupport) )
            return 302 http://hotspot.localnet/hotspot.html;


            # For others
            location /
            return 302 http://hotspot.localnet/;



            iOS has to be difficult in that it needs the WISP settings. hotspot.html contents are as follows:



            <!--
            <?xml version="1.0" encoding="UTF-8"?>
            <WISPAccessGatewayParam xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.wballiance.net/wispr_2_0.xsd">
            <Redirect>
            <MessageType>100</MessageType>
            <ResponseCode>0</ResponseCode>
            <VersionHigh>2.0</VersionHigh>
            <VersionLow>1.0</VersionLow>
            <AccessProcedure>1.0</AccessProcedure>
            <AccessLocation>Andrew Wippler is awesome</AccessLocation>
            <LocationName>MyOpenAP</LocationName>
            <LoginURL>http://hotspot.localnet/</LoginURL>
            </Redirect>
            </WISPAccessGatewayParam>
            -->






            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Aug 16 '16 at 19:29









            AWipplerAWippler

            1285




            1285












            • +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

              – Rui F Ribeiro
              Feb 2 '18 at 10:32












            • We are in 2018 now. Have you worked more on this?

              – Rui F Ribeiro
              Mar 6 '18 at 20:28

















            • +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

              – Rui F Ribeiro
              Feb 2 '18 at 10:32












            • We are in 2018 now. Have you worked more on this?

              – Rui F Ribeiro
              Mar 6 '18 at 20:28
















            +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

            – Rui F Ribeiro
            Feb 2 '18 at 10:32






            +1 Also complemented your answer in a new answer with some new data. Putting everything to work is a (nice?) puzzle. I have seen some captive portals in international airports and big malls that were not able to pop up the CNA window. Interestingly enough, when I was putting all the puzzle pieces together last year, I did not find this post.

            – Rui F Ribeiro
            Feb 2 '18 at 10:32














            We are in 2018 now. Have you worked more on this?

            – Rui F Ribeiro
            Mar 6 '18 at 20:28





            We are in 2018 now. Have you worked more on this?

            – Rui F Ribeiro
            Mar 6 '18 at 20:28













            2














            For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.



            Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.



            (OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)



            Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.



            For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS






            share|improve this answer





























              2














              For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.



              Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.



              (OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)



              Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.



              For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS






              share|improve this answer



























                2












                2








                2







                For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.



                Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.



                (OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)



                Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.



                For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS






                share|improve this answer















                For complementing @AWippler message. I implemented a captive portal in FreeBSD, and have perfomed some tests with Windows, Mac, iOS and Android devices as clients.



                Be aware that according to my tests, newer Android versions when having Chrome installed, do the captive portal detection test(s) using port 443 instead of port 80. If you only intercept port 80 for the authentication, you will start scratching your head thinking why newer Android clients are not working.



                (OK, just noticed this was bumped to the front page and the answer is from 2016...Android might have started doing that shortly after)



                Besides intercepting port 80, you also need to setup a SSL host, intercepting port 443 and live with the SSL certificate error. Or use an actual DNS domain valid on the Internet at large with a valid certificate.



                For visitors trying also to piece together how to implement Captive Authentication see also my Q&A Captive portal using Apache and the related questions Getting WISPr tags from a FON authentication portal ; also useful for testing Disabling CNA in MacOS







                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited Jul 23 '18 at 15:47

























                answered Feb 2 '18 at 10:28









                Rui F RibeiroRui F Ribeiro

                41.6k1483141




                41.6k1483141



























                    draft saved

                    draft discarded
















































                    Thanks for contributing an answer to Unix & Linux Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid


                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.

                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f212871%2fcaptive-portal-detection-popup-implementation%23new-answer', 'question_page');

                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown






                    Popular posts from this blog

                    How to check contact read email or not when send email to Individual?

                    Displaying single band from multi-band raster using QGIS

                    How many registers does an x86_64 CPU actually have?