How do captive portal network connections work?

Solution 1:

It certainly varies by vendor of the wireless product but in my experience it usually works something like this:

1. Your laptop makes a wireless connection to an intelligent access point, which may be connected to a centralized management station.
2. Your first web request is intercepted and replied to with a Location: header that redirects you to a login/policy page (e.g. http://hotelwireless.net/login). This might live directly on the intelligent access point, or on a central management station.
3. Once you've completed authentication, your MAC address is added to a list of allowed clients causing future requests to be correctly routed to the Internet, or accessible Intranet resources.

With regards to what to call it, I've heard it referred to as a "captive portal" or "wireless access portal" most frequently.

Solution 2:

First for achieving the redirection, you need an inline authenticator (access controller). In context of your topic, you will need a Wireless lan controller if you opt for central management of AP. OR you can also place a captive portal type of network access controller with Wall garden features.

NAS monitors the traffic entering the downlink (client side) through promiscuous mode raw socket and when the browser initiated traffic for a unauthenticated client is detected a HTTP redirection is given to it as response. So browser on receiving gets redirected to our CAPTIVE portal homepage, which can be hosted inline on authenticator or out of box at some external web server.

The sole work of this page is to provide user a UI to enter credentials. the credentials entered are forwarded back to the authenticator Daemon like chilli in case of coova chilli, futher these credentials are passed as radius request to the RADIUS server or may be checked locally. Upon successful authentication the state of the client at authenticator is marked authorized and client is granted access.

How Redirection is achieved

The most widely used approach is to intercept the HTTP request initiated by user and 302 code as response to client. In chilli it is done via below function

http_redirect2() {

cat < <  EOF
HTTP/1.1 302 Redirect 

Location: $1

Set-Cookie: PORTAL_SESSIONID=$PORTAL_SESSIONID

Set-Cookie: COOVA_USERURL=$COOVA_USERURL

Connection: close

EOF
    exit

}

This redirection can be easily achieved pragmatically controlled tun tap interface to client side interface which intercepts client traffic. Further redirection can be achieved via DNS poisoning too but may sometimes cause problem if responses got cached at client browser. Further things can be done more specifically according to the problem domain. I can help you with that if you want.