Wifi – Captive portal detection by Apple Oses, iOS ‘splash CNA popup’ does not show

It looks like the gateway you're using may be using VRRP or HSRP. 10.77.121.1 is a virtual/logical address, which you use as your gateway, but when you trace route one of the physical routers responds. (10.77.121.3)

First thing you need to achieve redirection is some in-line authenticator ( access controller ), as in context of topic you will be needing a Wireless lan controller if you opt for central management of AP. you can also place in captive portal type of network access controller with Wall gardened features

NAS monitors the traffic entering the down-link ( client side ) through promiscuous mode raw socket and when the browser initiated traffic for a unauthenticated client is detected a HTTP redirection is given to it as response. so browser on receiving gets redirected to our CAPTIVE portal homepage, which can be hosted in-line on authenticator or out of box at some external web server.

The sole work of this page is to provice user a UI to enter credentials. the credentials entered are forwarded back to the authenticator Daemon like chilli in case of coova chilli, further these credentials are passed as radius request to the RADIUS server or may be checked locally. Upon successful authentication the state of the client at authenticator is marked authorized and client is granted access.

How Redirection is achieved

The most widely used approch is to intercept the HTTP request initaited by user and 302 code as reponse to client. in chilli it is dove via below funtion

http_redirect2() { cat < < EOF

HTTP/1.1 302 Redirect

Location: $1

Set-Cookie: PORTAL_SESSIONID=$PORTAL_SESSIONID

Set-Cookie: COOVA_USERURL=$COOVA_USERURL

Connection: close

EOF

exit

}

This redirection can be easily achieved programatically controlled tuntap interface to client side interface which intercepts client traffic. Further redirection can be achieved via DNS poisoning too. but may sometimes cause problem if responses got cached at client browser Further things can be done more specifically according to the problem domain.

I can help you with that if you want