Using dnscrypt on a public hotspot with a captive portal

Question

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal?

Such hotspots require DNS settings to point to their servers (via DHCP) so that they redirect the first browser request, before allowing normal network use.

Just after connecting to the network and obtaining DHCP settings (and even before successful authorisation to the portal) all services running on my PC (maybe even regular programs checking for updates) will try to "call home" via the hotspot's DNS servers. Which I want to avoid.

On the other hand having DNS set to local dnscrypt proxy will not allow me to get an authorisation from the portal.

Is there a solution?

I thought of chaining dnsmasq with dnscrypt (which is what I do anyway) and configuring an exception for a specified domain in dnsmasq configuration (which I would later access from a browser). But then I have to insert a specific IP into a config file, which would require me to check which DNS servers are set through DHCP.

Answer 1

It's depends and might be messy. Under OS X, I follow Cupertino's method and add networking connection link state monitoring in a script which fetches and compares the contents http://www.thinkdifferent.us. Plus, I have a manual toggle script for slow links, incompletely-blocking captive portals and downloading Apple updates from this hemisphere, which are the main edge-cases but otherwise works reliably for probably about 2 years. If some got adventurous, they'd make a system bar monitor OS X native app which shows their status... or roll all this muck into an app which has vendored dnsmasq and dnscrypt.

Three scripts are the heart of it. One for checks actual internet access. The other is toggle-internet (automatic via internet-access network tests, forced available (dnscrypt on), forced unavailable (dnscrypt off)). And, finally a daemon script runs continuously and adjusts accordingly by modifying dns servers using networksetup. For other platforms, like Linux, it needs some work... for Windows it would need lots of work.

(For HA, I use osx -> dnsmasq brew install dnsmasq --with-dnssec -> 5 instances of dnscrypt brew install dnscrypt-proxy pointing to various non-logging servers.)

Source here

Answer 2

If you use network manager (since it seems to depend on that), you can use Filippo Valsorda's captive browser for captive portal logins and dnscrypt for the systemwide DNS.