I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can secure it.

The bottom line is MAC and IP addresses are completely insecure. Without using them, how can I track my clients?

closed as not constructive by Adi, TildalWave, NULLZ, Ayrx, Scott Pack Jun 6 '13 at 19:32

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Is tracking your clients your primary concern, or is there something else you're looking to accomplish? – JZeolla Jun 5 '13 at 18:49
  • I want to allow authorized users to do anything transparently and prevent non-authorized users from doing anything (accept accessing my captive portal page). – just.another.programmer Jun 5 '13 at 19:14
  • You're probably looking for something like PacketFence. – Michael Hampton Jun 6 '13 at 1:31

You can generate a session key and store it in a cookie client side which is contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless)

The proxy does bring a limitation when it comes to other types of traffic such as SSH (taking out of scope that your users know how to tunnel traffic over HTTP). To solve this problem you can step away from the whole 'captive portal' story and try another authentication method like PEAP.

Note that setting up a good way of authentication is not easy as there are many ways of bypassing captive portals. Some are for instance:

  • DNS Tunneling
  • ICMP Tunneling
  • HTTP Tunneling (if you want to disallow
  • ...

Securing these is not easy and not all captive portals can be secured equally well. My preference is EAP-PEAP or EAP-TTLS.

  • How would storing a cookie help me? The cookie would be for my.captiveportalsite.com so it would not be sent by the browser on a request for a different website. And how do I force HTTPS for non HTTP requests? – just.another.programmer Jun 5 '13 at 19:13
  • Not true actually, you would need to authenticate to the proxy everytime before you are allowed to send traffic over it. So the cookie authenticates you. THIS traffic, containing the cookie authenticating you to the Proxy should be HTTPS. – Lucas Kauffman Jun 5 '13 at 20:40
  • I understand the purpose of the cookie, I just don't understand why the browser would send it. This is a transparent proxy. Beyond the capture portal, the browser has no idea it exists. – just.another.programmer Jun 5 '13 at 20:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.