https://photonicat.com/index.php?action=history&feed=atom&title=Photonicat_2_%E8%AE%BF%E5%AE%A2%E9%97%A8%E6%88%B7_Captive_PortalPhotonicat 2 访客门户 Captive Portal - 版本历史2026-07-26T15:59:02Z本wiki上该页面的版本历史MediaWiki 1.44.2https://photonicat.com/index.php?title=Photonicat_2_%E8%AE%BF%E5%AE%A2%E9%97%A8%E6%88%B7_Captive_Portal&diff=914&oldid=prevC2h2：New topic: OpenNDS-based guest captive portal — branded one-tap splash, settings toggle, caveats and CLI verification2026-07-12T16:23:23Z<p>New topic: OpenNDS-based guest captive portal — branded one-tap splash, settings toggle, caveats and CLI verification</p>
<p><b>新页面</b></p><div>{| class="wikitable"<br />
|-<br />
! 适用 / Applies to<br />
| Photonicat 2, photonicatWrt '''26.04+'''（含 OpenNDS、fw4/nftables 的固件）与 pcat-manager-web 2026-06 及以后版本 / Photonicat 2, photonicatWrt 26.04+ images (with OpenNDS on fw4/nftables) and pcat-manager-web builds from 2026-06 onward<br />
|}<br />
<br />
'''访客门户（Captive Portal）'''功能让 photonicat 2 成为一台'''强制门户网关'''：连接它 WiFi/LAN 的访客必须先看到 Photonicat 品牌的欢迎页并点击"同意并连接"，才能访问互联网——就像酒店、机场的 WiFi 登录页。这与 [[Photonicat 2 Smart WAN 智能上网|Smart WAN]] 正好相反：Smart WAN 是让设备'''通过'''别人的门户上网，本功能是让设备'''发布'''自己的门户。<br />
<br />
The '''Captive Portal''' feature turns the photonicat 2 into a '''captive gateway''': guests joining its WiFi/LAN must pass a Photonicat-branded splash page ("Agree & Connect") before reaching the internet — like hotel or airport WiFi. It is the inverse of [[Photonicat 2 Smart WAN 智能上网|Smart WAN]]: Smart WAN gets the device '''through''' someone else's portal; this feature '''serves''' your own.<br />
<br />
== 中文说明 ==<br />
<br />
=== 工作原理 ===<br />
* 基于 '''OpenNDS'''（nodogsplash 的持续维护继任者），原生运行在 fw4/nftables 防火墙上。<br />
* 访客设备（iPhone/Android/Windows）连上 WiFi 后，操作系统的联网探测会'''自动弹出'''登录页；点击'''同意并连接'''即放行该设备的 MAC。<br />
* 当前为'''一键点击直连'''模式（无需账号密码）；门户页为 Photonicat 品牌定制版，'''首次点击即完成授权'''，不会卡在中间页。<br />
* 会话按 MAC 记录，超过 <code>sessiontimeout</code> 后需重新点击。<br />
<br />
=== 开启方法 ===<br />
# 打开管理界面 → '''设置（/settings）'''页面。<br />
# 找到'''访客门户 Captive Portal''' 开关，打开即可；关闭同理。启停结果和失败原因都会在页面上提示。<br />
# 开启后约 10–15 秒内防火墙规则重建，新客户端可能短暂无法弹页，属正常现象，稍候重试即可。<br />
<br />
=== 注意事项 ===<br />
* '''访客必须通过 DHCP 获取地址'''：手动配置静态 IP 的客户端会被 OpenNDS 拒绝（403 "IP not allocated by dhcp"）。<br />
* '''HTTPS 无法被拦截重定向'''：弹页依赖操作系统的 HTTP 探测。若没自动弹出，请手动访问任意 http:// 网站。<br />
* 门户默认作用于 '''br-lan'''（含有线口）；生产环境建议为访客单独建一个 SSID/网络再启用。<br />
* 与 Smart WAN 可'''同时使用'''：上行做别人门户的客户端、下行发布自己的门户，互不冲突。<br />
* 管理页面、DNS 与系统更新域名（如 dl.photonicat.com）已加入'''白名单（walled garden）'''，认证前也可访问，避免把自己锁在门外。<br />
<br />
=== 命令行验证（SSH） ===<br />
<pre><br />
ndsctl status # 守护进程状态<br />
ndsctl json # 客户端及认证状态（authenticated / preauthenticated）<br />
nft list ruleset | grep -i nds # 查看门户防火墙规则<br />
</pre><br />
反向验证：第二台'''未点击同意'''的设备应无法访问互联网（https 站点超时），直到它也完成点击。<br />
<br />
== English ==<br />
<br />
=== How it works ===<br />
* Built on '''OpenNDS''' (the maintained successor of nodogsplash), running natively on the fw4/nftables firewall.<br />
* When a guest device (iPhone/Android/Windows) joins, the OS's connectivity probe '''auto-pops''' the login sheet; tapping '''Agree & Connect''' authorizes that device's MAC.<br />
* Current mode is '''click-through''' (no credentials); the splash is Photonicat-branded and '''authorizes on the first tap''' — no stranded intermediate pages.<br />
* Sessions are per-MAC and expire after <code>sessiontimeout</code>, requiring a fresh tap.<br />
<br />
=== Enabling ===<br />
# Open the manager UI → '''Settings (/settings)'''.<br />
# Toggle '''Captive Portal''' on or off; the page reports success and surfaces start/stop failures with reasons.<br />
# For ~10–15 s after enabling, nftables rules are rebuilding and new clients may briefly fail to get the splash — normal, just retry.<br />
<br />
=== Caveats ===<br />
* '''Guests must use DHCP''': static-IP clients are rejected by OpenNDS (403 "IP not allocated by dhcp").<br />
* '''HTTPS cannot be intercepted''': the popup relies on the OS HTTP probe. If no sheet appears, browse any http:// site manually.<br />
* The portal gates '''br-lan''' by default (including wired ports); for production, prefer a dedicated guest SSID/network.<br />
* '''Coexists with Smart WAN''': captive client upstream, captive gateway downstream at the same time.<br />
* The admin UI, DNS and update domains (e.g. dl.photonicat.com) are '''walled-garden allowed''' pre-auth, so you can't lock yourself out.<br />
<br />
=== CLI verification (SSH) ===<br />
<pre><br />
ndsctl status # daemon state<br />
ndsctl json # clients and auth state (authenticated / preauthenticated)<br />
nft list ruleset | grep -i nds # portal firewall rules<br />
</pre><br />
Negative test: a second device that has '''not''' tapped Agree must fail to reach the internet (https times out) until it does.<br />
<br />
[[Photonicat 2 Smart WAN 智能上网]] ｜ [[Photonicat 2 管理界面新功能 (2026)]]</div>C2h2