Re:There are six internet links on my office on wheels—seven...
by tristor on Tuesday September 21, 2021 @10:01AM
(#28605085)
> The wifi bridge mode of the Cradlepoint is super interesting. One major drawback I've found in practice is that if the campground/public wifi network has a splash page, I basically can't get it to work. It takes some serious troubleshooting to get setup even when everything should be straightforward and obvious sometimes too.
Yes, we've encountered issues with this too. It's really variable. Some public WiFi with a captive portal everything works fine because it does the redirects in a way more similar to a NAC, so any device connected to WiFi on the Cradlepoint once it's bridged can just go to something like http://neverssl.com/ and it gets redirected successfully. But a lot of the devices have improperly configured captive portals that rely on local IPs, which of course are in a different network segment than the client device due to the Cradlepoint having a router between the two network segments. In this case, I've been able to sometimes make it work because usually the badly configured portals are using low-grade consumer devices which don't have advanced NAC capabilities, it's usually just a captive portal via HTTP redirection to the router's IP and whitelists the device MAC address.
In these cases two things are sometimes true (usually one or the other, not both):
1. MAC address to be whitelisted is a URL parameter
2. MAC address to be whitelisted is part of the the form content of the page that gets POSTed
In either case, I replace the MAC address with the MAC address of the WiFi radio on the Cradlepoint we use for bridging, and it whitelists and works.
There have been some cases where it's so broken it's been impossible to troubleshoot. Many times it's been my dad on Facetime over LTE trying to get it to work with my instructions remotely, or me relying on LTE on the Cradlepoint to configure via the Net Cloud. Either way, I wish everybody used proper NAC for their captive portals or just did away with captive portals. They're really annoying, and are fundamentally based on violating protocol expectations of standardized protocols, they break down in non-obvious ways, and are generally problematic for legitimate users and do little to stop a motivated illegitimate user.
Yes, we've encountered issues with this too. It's really variable. Some public WiFi with a captive portal everything works fine because it does the redirects in a way more similar to a NAC, so any device connected to WiFi on the Cradlepoint once it's bridged can just go to something like http://neverssl.com/ and it gets redirected successfully. But a lot of the devices have improperly configured captive portals that rely on local IPs, which of course are in a different network segment than the client device due to the Cradlepoint having a router between the two network segments. In this case, I've been able to sometimes make it work because usually the badly configured portals are using low-grade consumer devices which don't have advanced NAC capabilities, it's usually just a captive portal via HTTP redirection to the router's IP and whitelists the device MAC address.
In these cases two things are sometimes true (usually one or the other, not both):
1. MAC address to be whitelisted is a URL parameter
2. MAC address to be whitelisted is part of the the form content of the page that gets POSTed
In either case, I replace the MAC address with the MAC address of the WiFi radio on the Cradlepoint we use for bridging, and it whitelists and works.
There have been some cases where it's so broken it's been impossible to troubleshoot. Many times it's been my dad on Facetime over LTE trying to get it to work with my instructions remotely, or me relying on LTE on the Cradlepoint to configure via the Net Cloud. Either way, I wish everybody used proper NAC for their captive portals or just did away with captive portals. They're really annoying, and are fundamentally based on violating protocol expectations of standardized protocols, they break down in non-obvious ways, and are generally problematic for legitimate users and do little to stop a motivated illegitimate user.