Captive portal

In short: A captive portal is the sign-in page that appears on hotel, café or airport Wi-Fi before you may use the internet.

In more detail: The network first redirects every web access to a page of the operator. Only after consent, login or payment does it release access.

In Depth

• Detection: On connecting, operating systems fetch a known test address (for example a page that should return “Success”). If a redirect comes back, the device shows the portal.
• Technology: Firewall and DNS redirect unauthorised devices. After login the device’s MAC or IP address is released.
• Problems with HTTPS: Modern sites cannot be redirected without a certificate warning, so operating systems use the test addresses and open a window of their own. The portal does not appear if a VPN connection starts automatically.
• Security: Open networks are unencrypted. After the login use a VPN and preferably only HTTPS sites.
• Pitfalls: MAC randomisation of devices can reset the release.
• For operators: Keep the guest network apart from the home network (VLAN), mind time limits, terms of use and liability questions.

See also: RADIUS