captive portal wikipedia article

Question

Something on the wikipedia page regarding captive portals have confused me:

http://en.wikipedia.org/wiki/Captive_portal

When a client requests a website, DNS is queried by the browser. The firewall will make sure that only the DNS server(s) provided by DHCP can be used by unauthenticated clients (or, alternatively, it will forward all DNS requests by unauthenticated clients to that DNS server). This DNS server will return the IP address of the Captive Portal page as a result of all DNS lookups. The DNS poisoning technique used here, when not considering answers with a TTL of 0, may negatively affect post-authenticated internet use when the client machine references non-authentic data in its local resolver cache. Some naive implementations don't block outgoing DNS requests from clients, and therefore are very easy to bypass; a user simply needs to configure their computer to use another, public, DNS server. Implementing a firewall or ACL that ensures no inside clients can use an outside DNS server is critical.

It says the DNS server is queried to return the IP address of the captive portal. This DNS server was chosen by DHCP. Where is the DHCP running exactly and why wouldnt the captive portal be on the same server which had the DHCP??

Answer 1

Many captive portals are a self contained httpd/dhcpd/router/whatever else (some routers have bittorrent clients but that is beside the point). I don't think that this Wikipedia page disagrees with that. The attack being discussed in the last part of this excerpt is referring to DNS tunneling. If its a very large network, such as a WISP, then they are going to need a dedicated HTTPD in order to handle the load and this might be on another network segment. If their firewall rulesets are poor, then it maybe possible to use DNS as way to access the open internet.