1

I am very excited to use the interworking functionality of hostapd! I aim to do a network redirection once a client connects to my RPI access point. I am following this tutorial for RPI AP. In the hostapd reference The Interworking section contains a possible answer to making a captive portal (without authentication) to open a clients browser and direct it to my node.js server running on port 8001.

    # Network Authentication Type
    # This parameter indicates what type of network authentication is used in the
    # network.
    # format: <network auth type indicator (1-octet hex str)> [redirect URL]
    # Network Authentication Type Indicator values:
    # 00 = Acceptance of terms and conditions
    # 01 = On-line enrollment supported
    # 02 = http/https redirection
    # 03 = DNS redirection
    #network_auth_type=00
    #network_auth_type=02http://www.example.com/redirect/me/here/

I have a few questions.

  1. Is there any documentation of RPI AP tests with any interworking functioning? I can't seem to find much. If anyone has tested this let me know!

  2. Do I need other parameters to configure this interworking in my hostapd.conf? Right now I have the following and tested with countless variations adding and removing lines from the ieee802.11u interworking section.

    interface=wlan0 
    driver=nl80211
    ssid=RpiScopeSpot
    hw_mode=g
    channel=7
    wmm_enabled=0
    macaddr_acl=0
    auth_algs=1
    ignore_broadcast_ssid=0
    wpa=2
    wpa_passphrase=rpiscope
    wpa_key_mgmt=WPA-PSK
    wpa_pairwise=TKIP
    rsn_pairwise=CCMP
    
    #IEEE 802.11u-2011 
    #Enable Interworking service
    interworking=1
    access_network_type=4
    internet=1
    asra=1
    esr=1
    uesa=1
    venue_group=2
    venue_type=1
    hessid=00:00:00:00:00:01
    roaming_consortium=01010101
    venue_name=eng:rpi Test Venue
    network_auth_type=02http://192.168.50.10:8001
    ipaddr_type_availability=04
    domain_name=192.168.50.10
    anqp_3gpp_cell_net=055,54
    nai_realm=0,192.168.50.10,13[5:6],21[2:4][5:7]
    

I have tested the following network_auth_type=02https://www.google.com & network_auth_type=02http://192.168.50.1 with no success.

  1. What exactly happens when a client connects to the my AP on both the RPI and client? I am asking because I would like to somehow catch this behaviour and manually open some browser on the client side.

I am logging all the hostapd and unable to see anything about this interworking running. I am logging by adding DAEMON_OPTS="-dd -t -f /home/pi/hostapd.log" to my /etc/default/hostapd. I am testing the results each time with sudo systemctl status hostapd and don't see any interworking behaviours.

  1. I have seen many RPI captive portal using Nodogsplash project that uses a possible NDS. What is happening here? I am working through this project to work through what I am able to use. This project is simply overkill for what I need.

By default, NDS blocks everything, but intercepts port 80 requests. An initial port 80 request will be generated on a client device, either by the >user manually browsing to an http web page, or automatically by the client >device’s built in Captive Portal Detection (CPD).

Additionally this is the closest thing I can see of someone at least referencing this hostapd in a different environment.

If anyone has any leads or can help answer any of my questions i'd appreciate it! :)

  • "I am asking because I would like to somehow catch this behaviour and manually open some browser on the client side" -> As in, have the AP control the client system??!? Sounds like very undesirable behavior security wise, and you would need the client to install custom software first. What captive portals often do is redirect all http requests to a sign in page, however, this requires the user open a browser his/her self. – goldilocks Feb 13 at 20:48
  • not all browsers will redirect to the captive portal web page .... i have two browsers on my phone, and both of them flag a captive portal web page as a possible security risk and refuse to open it and do not provide any option to override the refusal – jsotola Feb 17 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.