Photonicat 2 访客门户 Captive Portal

来自Photonicat Wiki
C2h2​（留言 | 贡献）2026年7月13日 (一) 00:23的版本 （New topic: OpenNDS-based guest captive portal — branded one-tap splash, settings toggle, caveats and CLI verification）
(差异) ←上一版本 | 最后版本 (差异) | 下一版本→ (差异)
跳转到导航 跳转到搜索
适用 / Applies to Photonicat 2, photonicatWrt 26.04+（含 OpenNDS、fw4/nftables 的固件）与 pcat-manager-web 2026-06 及以后版本 / Photonicat 2, photonicatWrt 26.04+ images (with OpenNDS on fw4/nftables) and pcat-manager-web builds from 2026-06 onward

访客门户（Captive Portal）功能让 photonicat 2 成为一台强制门户网关：连接它 WiFi/LAN 的访客必须先看到 Photonicat 品牌的欢迎页并点击"同意并连接"，才能访问互联网——就像酒店、机场的 WiFi 登录页。这与 Smart WAN 正好相反：Smart WAN 是让设备通过别人的门户上网，本功能是让设备发布自己的门户。

The Captive Portal feature turns the photonicat 2 into a captive gateway: guests joining its WiFi/LAN must pass a Photonicat-branded splash page ("Agree & Connect") before reaching the internet — like hotel or airport WiFi. It is the inverse of Smart WAN: Smart WAN gets the device through someone else's portal; this feature serves your own.

中文说明

工作原理

  • 基于 OpenNDS（nodogsplash 的持续维护继任者），原生运行在 fw4/nftables 防火墙上。
  • 访客设备（iPhone/Android/Windows）连上 WiFi 后，操作系统的联网探测会自动弹出登录页；点击同意并连接即放行该设备的 MAC。
  • 当前为一键点击直连模式（无需账号密码）；门户页为 Photonicat 品牌定制版，首次点击即完成授权，不会卡在中间页。
  • 会话按 MAC 记录，超过 sessiontimeout 后需重新点击。

开启方法

  1. 打开管理界面 → 设置（/settings）页面。
  2. 找到访客门户 Captive Portal 开关，打开即可；关闭同理。启停结果和失败原因都会在页面上提示。
  3. 开启后约 10–15 秒内防火墙规则重建，新客户端可能短暂无法弹页，属正常现象，稍候重试即可。

注意事项

  • 访客必须通过 DHCP 获取地址：手动配置静态 IP 的客户端会被 OpenNDS 拒绝（403 "IP not allocated by dhcp"）。
  • HTTPS 无法被拦截重定向：弹页依赖操作系统的 HTTP 探测。若没自动弹出，请手动访问任意 http:// 网站。
  • 门户默认作用于 br-lan（含有线口）；生产环境建议为访客单独建一个 SSID/网络再启用。
  • 与 Smart WAN 可同时使用：上行做别人门户的客户端、下行发布自己的门户，互不冲突。
  • 管理页面、DNS 与系统更新域名（如 dl.photonicat.com）已加入白名单（walled garden），认证前也可访问，避免把自己锁在门外。

命令行验证（SSH）

ndsctl status          # 守护进程状态
ndsctl json            # 客户端及认证状态（authenticated / preauthenticated）
nft list ruleset | grep -i nds    # 查看门户防火墙规则

反向验证：第二台未点击同意的设备应无法访问互联网（https 站点超时），直到它也完成点击。

English

How it works

  • Built on OpenNDS (the maintained successor of nodogsplash), running natively on the fw4/nftables firewall.
  • When a guest device (iPhone/Android/Windows) joins, the OS's connectivity probe auto-pops the login sheet; tapping Agree & Connect authorizes that device's MAC.
  • Current mode is click-through (no credentials); the splash is Photonicat-branded and authorizes on the first tap — no stranded intermediate pages.
  • Sessions are per-MAC and expire after sessiontimeout, requiring a fresh tap.

Enabling

  1. Open the manager UI → Settings (/settings).
  2. Toggle Captive Portal on or off; the page reports success and surfaces start/stop failures with reasons.
  3. For ~10–15 s after enabling, nftables rules are rebuilding and new clients may briefly fail to get the splash — normal, just retry.

Caveats

  • Guests must use DHCP: static-IP clients are rejected by OpenNDS (403 "IP not allocated by dhcp").
  • HTTPS cannot be intercepted: the popup relies on the OS HTTP probe. If no sheet appears, browse any http:// site manually.
  • The portal gates br-lan by default (including wired ports); for production, prefer a dedicated guest SSID/network.
  • Coexists with Smart WAN: captive client upstream, captive gateway downstream at the same time.
  • The admin UI, DNS and update domains (e.g. dl.photonicat.com) are walled-garden allowed pre-auth, so you can't lock yourself out.

CLI verification (SSH)

ndsctl status          # daemon state
ndsctl json            # clients and auth state (authenticated / preauthenticated)
nft list ruleset | grep -i nds    # portal firewall rules

Negative test: a second device that has not tapped Agree must fail to reach the internet (https times out) until it does.

Photonicat 2 Smart WAN 智能上网 ｜ Photonicat 2 管理界面新功能 (2026)

检索自“https://photonicat.com/index.php?title=Photonicat_2_访客门户_Captive_Portal&oldid=914”