What is Captive Portal?

Definition

A captive portal is the web page a network forces a device to load before it grants internet access. The network intercepts the first request from a newly joined device and redirects it to that page, where the guest logs in, accepts terms, or enters details. Access is unlocked only once the portal approves the session.

How a captive portal actually intercepts traffic

When a device joins the network it is placed in an unauthenticated state. The gateway holds the device in a restricted policy where DNS resolves but almost all outbound traffic is blocked or rewritten. The moment the device makes its first HTTP request, the gateway answers with a redirect to the portal URL instead of the requested page. Modern operating systems no longer wait for the user to open a browser: iOS, Android, macOS and Windows all fire a connectivity check to a known endpoint immediately after association, notice that the response is not what they expected, and pop the portal in a dedicated mini-browser. That is why a login screen appears "by itself" on a phone. Once the portal authorises the session, the gateway moves the device MAC address into an authorised policy and traffic flows normally until the session expires.

Where the portal runs matters

There are two broad architectures. In an internal portal, the login page is served by the access point or the controller itself, which keeps everything on the local network but makes design, integrations and reporting difficult. In an external captive portal, the gateway redirects to a page hosted on the public internet, which then calls back to the controller to authorise the session. External portals are what make marketing features possible, because the page can be a full web application with a CRM behind it rather than a static form baked into networking firmware.

Common failure modes

Portals break in predictable ways. If HTTPS interception is attempted, browsers show certificate warnings, so well-built portals redirect only plain HTTP and rely on the OS connectivity check for everything else. If the portal domain is not in the walled garden, the redirect itself gets blocked and the guest sees a spinner forever. If session timeouts are too aggressive, guests are asked to log in repeatedly and abandon. And if the portal is not responsive, the OS mini-browser, which is often a small window with no address bar, renders it unusably.

More in Networking