Skip to content

Captive Portal (Public Wi-Fi)

Supported versions

Assisted public Wi-Fi login is available in versions 3.10.0 and above on Windows.

See our step-by-step Public Wi-Fi login guide.

What is a captive portal?

A captive portal [1] is the sign-in or "welcome" page that some networks display before they let you reach the wider Internet. You have probably seen one on public Wi-Fi in a hotel, café, airport, or train, where you have to accept terms, log in, or pay before you can browse.

Until you complete that page, the network holds your device "captive" and blocks access to everything beyond it. A network that works this way is sometimes called a captive network, captive Wi-Fi network, or public Wi-Fi.

When does a captive portal block Internet access?

A captive portal can stand between your device and the Internet at two common moments:

  • When you first join the network: access is blocked until you have accepted the terms or signed in.

  • When timed or paid access expires: for example, if you bought an hour of Internet access on public Wi-Fi, the portal can reappear partway through your session once that hour is up.

This means a portal can interrupt you unexpectedly, not only when you first connect.

How do devices normally handle captive portals?

Operating systems such as Windows and macOS routinely check whether they really have Internet access. They do this quietly in the background by requesting a known web page and looking at what comes back.

If the response is not what the operating system expects, it concludes that a captive portal is in the way. It then usually alerts you and opens a sign-in window so you can log in to the network. Once you have, the background check succeeds and normal access resumes.

Why does this not work when Connect is running?

Connect protects your traffic by routing it through the Trusted Area Network (TAN), often by way of an exit node. That protection is exactly what gets in the way of the operating system's built-in sign-in flow.

The result is a chicken-and-egg problem:

  • The operating system's sign-in window tries to reach the portal through Connect's secure tunnel. The portal blocks the encrypted request and so the login page cannot load.

  • The operating system can also misjudge the situation, sometimes reporting full Internet access when there is none due to the additional secure routing provided by Connect. This can stop other software from functioning correctly when offline.

For these reasons, the built-in operating system flow cannot be relied upon while Connect is running.

How does Connect solve this?

Connect uses a combination of its own check against a trusted web address and the operating system's connectivity signals to tell the difference between a genuine outage and a portal that is waiting for you to sign in.

When Connect finds a captive portal, it lets you know and helps you reach the network's sign-in page so you can log in, just as you would without Connect running. It then keeps checking in the background and, as soon as you have signed in and Internet access returns, tidies up and resumes normal, secure operation automatically.

While Connect waits for captive portal login to occur, it will display one of two warning messages:

  • Open Wi-Fi network login page to continue — shown when public Wi-Fi is detected while Connect is already running; for example, when timed Wi-Fi access expires or when joining a new public Wi-Fi network.
  • Open Wi-Fi network login page before activating — shown when public Wi-Fi is detected while Connect is activating.

Keeping your traffic secure

Connect is careful to protect your data throughout this process. When an exit node is in use, only the sign-in traffic needed to reach the portal is allowed to leave directly over your physical network connection; everything else stays inside the TAN.

This is a deliberately narrow exception: just enough to load the login page and no more. This ensures Connect provides secure login and does not require users to manually de-activate and re-activate Connect, making it more secure and efficient than many VPN solutions by not exposing the rest of your traffic to the local network and the public Internet.

Tip

While a portal is being resolved, Connect displays a message in the client so you know why Internet access is paused and what to do next.

When a captive portal misbehaves

Captive portals are not built to a single standard, and some are simply poorly behaved. A portal might fail to load, insist that you install an app, fail to forward you to its sign-in page, or provide authentication methods which do not work. It is likely to behave this way even on a device that is not running Connect.

Note

If you cannot get online through a particular portal, the problem may lie with that network rather than with Connect. Trying the same network on a device without Connect can help you tell the two apart.

See Also