Chat Excerpt:

Anish: https://github.com/nikosft/captive-portal/blob/master/captive_portal.py
Tim: have you tried it?
Anish: so it is fairly simple script. it works when there is internet on WAN IF
Tim: so does nodogsplash, but that is not our case
Anish: (or basically when DNS resolves). yeah... but i think we can use the iiab flag to do proper iptables redirecting. we can even make is dynamic. as it is fairly simple python code. iiab internet_accessible flag
Tim: I think we need to emulate the traffic to test for internet by different devices
Anish: yea, agree. this is not wispr or anything like that compliant (if there is such a thing)
Tim: I did a wireshark capture of nodogsplash with WAN internet (works) and without (doesn't work)
Anish: but offers an easy solution to a complex-ish problem... tim, i think the difference here might be that it is just a few lines of python code, that we can expand and build on without consulting the remote corners of the internet for scarce documentation :)
Tim: I have been through nearly 10 approaches that are 'supposed to work', none works without an internet connection. I agree that the simplicity is a plus. BTW, there's another one in python used by kiwix's pi-box. it doesn't work for android either.
Anish: this is essentially the redirect it does...

-A PREROUTING -i br0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.18.96.1:9090

Tim: Anish: do you have the wherewithal to analyze my wireshark captures... The problem happens before the redirect. You only get to that stage if the device decides it is a captive port situation and so far for me it never does unless dns works
Anish: yeah. so.. maybe we can have a dynamic bind rule based on whether internet works. we could do (1) dns blackhole if no internet or (2) this if there is internet. because dns blackhole works everytime ... just that it will never redirect to anything on the internet
Tim: There are different test urls for each device and often different for different releases, say of android. It feels to me like android expects some wan traffic to return expected results. remember that captive portal is not really our use case. it is for regulating traffic to an existing gateway, not for capturing traffic on a lan. we need to be able to fake the expected returns and then grab it. I tried look at the android source code to see what it expects, but got stuck.
Anish: hm. tim, if you have an android device and an iiab nearby, can you test this quickly?
Tim: I can send you the wireshark dumps
Anish: it is just a simple py script. i use an oldschool nokia phone
Tim: I have three generations of android devices for this very purpose
Anish: heh. tim, does dns-blackhole work with android?
Tim: so what is the test? start iiab on rpi and run the script?
Anish: yes. make sure the rpi has internet on WAN. and connect on LAN. and try and access something over http. basically port 80
Tim: OK need to boot
Anish: meanwhile I'll look at how to manage bind from python
Tim: we are switching to dnsmasq to make that part easier
Anish: nice! so far we are on bind still, right?
Tim: it's already in master
Anish: (oh, enabled?) i did see a dnsmasq role
Tim: Jerry can tell you how to enable. I think I disabled bind and enabled dnsmasq in local vars, but there's another parameter I need to hunt for.
Holt: Jerry can clarify if this is still a relevant approach to dealing with dnsmasq etc vars: #699
...
Tim: Anish: captive_portal.py did not work for me
Anish: tim you edited the contents inside.. like network interface?

Nodogsplash Captive Portal requires internet connection [try dnsmasq approach?] #826

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions