12
How to log into a captive portal (public WiFi) when you have a system wide private DNS? (self.privacy)
submitted 3 months ago by to c/privacy@lemmy.ml
15 comments fedilink hide all child comments
 

Hi all

I'm using DNS over TLS with Quad9 as my DNS provider.
This works great in most circumstances, but when I want to connect to a public wifi, like at school or in the library, it's not possible to open the Captive portal page, and I can't use the network.

Is there some way to easily make this work? Maybe exclude these networks from private DNS?
Or a way to easily switch between network configurations?

I'm using systemd resolved, but configured with a private dns via my NixOs configuration.

all 15 comments

sorted by: hot top controversial new old
[–] 6 points 3 months ago (3 children)
  1. Disable DNS once. Find out URL/IP of captive portal that way.
  2. Add to hosts file (Win/Lin/Mac). Maybe even give an alias: "captive-school", "captive-library", etc.
  3. Turn DNS back on. The hosts file will take prerogative over DNS settings, i.e. it is resolved first.
  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] [S] 4 points 3 months ago* (2 children)

    This could be a good option for the library actually.
    Maybe I can just check the IP via my phone, then add it to the hosts of my laptop.

    I'll give that a try

    A bit cumbersome if you are traveling and using a different public wifi every time though

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 3 months ago (1 child)

    A bit cumbersome if you are traveling and using a different public wifi every time though

    You're not wrong. But you're probably also familiar with the "secure vs. convenient" dichotomy: the closer to the "secure" end of the spectrum you get, the more cumbersome things will inevitably get. If you feel like you're jumping through too many hoops and you don't know what for, chances are you're overshooting the target in terms of your threat model and might get away with doing less.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 2 points 3 months ago

    True, I just found it convenient to block ads and trackers on a system level.

    If you are using something like nextDNS it's very easy to block ads and trackers everywhere, and even block social media or adult websites and such.

    So using DNS over TLS is not necessarily about hiding my internet traffic, but more also to limit unnecessary content. I suppose the same can be done with a combination of browser extensions. But using the private DNS made sense to me.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 6 points 3 months ago

    Try to go to the access point's IP address, that always works for me.

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 3 months ago (2 children)

    Just have a dedicated browser used for the login that is excluded from your DNS.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 3 months ago

    I was looking at this one: Captive Browser

    But would it work if I have my private DNS configured on system level?

    I was also thinking to just disable the private DNS and configure it in firefox, but then it would only block trackers/ads in the browser, not in any other application.

    Would make it easy to toggle off for a second to login to a captive portal though, or have a separate firefox profile for that (like davel mentioned)

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 3 months ago (3 children)

    Disable your dns over tls so you can register your MAC address and complete the portal requirements. Once registered, turn your dns back on.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] [S] 3 points 3 months ago (2 children)

    This is the most straightforward way if I was not on NixOs.

    If I want to change the DNS settings in my nix config, I need internet connection (unless it's possible to rebuild while offline?)

    I was trying to bypass this by just changing the DNS server for that specific network connection, but I didn't get it to work. Because it has to use the DNS of the captive portal to be able to load the page

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 3 points 3 months ago (2 children)

    I have Fedora on my laptop. I'll often connect to my VPN and then manually change the DNS. Annoying, but usually works.

    Another method if I'm using said WiFi for long periods of time is to use my travel router. Log into the portal on my laptop and then change the MAC of the router to that of my laptop and put it in repeater mode. Then connect the laptop to the router. Equally as annoying, but worth it.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 3 months ago (1 child)

    You can connect to your VPN already before changing DNS?

    I was interested in having a VPN to my home network which just works over 443, so I can access everything in my home network even on public wifis in a safe way. Haven't managed to set it up yet though.

    What do you use for travel router? Might be interesting as well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 months ago

    I guess you use the DHCP-assigned DNS first, then change it to what you want after connecting. Tailscale is a great way to access your home network. Headscale is another one but I haven't used it.

    I use a gl.inet router. They're like $30. They use OpenWRT.

  • permalink
  • fedilink
  • source
  • parent