Captive portal with shared access between routers

[Holicz]

Hello,

I have Mikrotik hAP Lite with newest OpenWrt installed and I need to achieve this behavior:

1. User connects to open wifi
2. Login window opens and loads page https://login.example.com, pass MAC address to the page
3. The page somehow process the login (depends if it's known MAC address or not)
4. Page should somehow tell the router "Ok, this device can connect"

There will be more routers, but not on the same local network, they will be in different buildings. The login window should be opened everytime even if the user has already been connected because the page is handling this.

The Mikrotik hAP Lite is not that good, so I can't install Luci, I am configuring everything through SSH.

Is it somehow configurable just with OpenWrt or which packages are the best for this?

I read this, but the captive portal is located in the router, I need it online. I also read about CoovaChilli but they said the documentation is pretty bad.

Thanks for any suggestion and help!

[lleachii]

@Holicz

Login window opens and loads page https

Can't use HTTPS on a captive portal without advanced config in the router.

@Holicz

I read this, but the captive portal is located in the router, I need it online.

How?

Your client hasn't been given access to the Internet yet.

This thread may be helpful too:

Coova chilli captive portal redirect to login page, problems with https://

Iam working on lede/openwrt install with coova chilli . everything works except https:// redirect to my login page e.g. If i type in my web broswer http://www.website.com ---> I get redirected to my login page, this works If i type in my web broswer https://www.website.com ---> I get "failed to connect" If i login using the first example i can then surf the web using https:// web sites Has anybody got any thoughts on this? Thanks

@Holicz

Thanks for any suggestion and help!

@Holicz

I need it online

It sounds like you want a captive portal for your entire LAN, then. Like in hospitals, hotels, restaurants, etc. That has to be located somewhere on the LAN.

[Holicz]

Maybe Captive portal is not the right word then. Maybe more like some sort of banning all communications except to communication to the login server unless the user is verified.

Also, these routers will not be on the same LAN, because they will be placed in businesses with different owners.

[lleachii]

@Holicz

Maybe Captive portal is not the right word then. Maybe more like some sort of banning all communications except to communication to the login server unless the user is verified.

Nope, "Captive Portal" is the right phrase. If you want it to be Internet-based, it gets more complex. You can't initially block Internet access when you need access to the online portal. You may have to setup a VPN from these sites - to the captive portal server...but then, all the businesses' bandwidths are dependent on the VPN server holding the captive portal (and the latency generated).

@Holicz

Also, these routers will not be on the same LAN, because they will be placed in businesses with different owners.

Then how do you expect all the businesses to reach the same Internet-based captive portal???

• Perhaps, you prefer RADIUS-based WiFi authentication, instead?
• As I suggested above, you may have to configure all routers via VPN to a captive portal

And if they're not on the same network, this just got even more complex. I'd suggest setting each up for it's own Captive Portal.