DHCP Option 114, also known as Captive-Portal Identification, is defined in RFC 8910. It allows DHCP servers to inform clients of the presence and location of a captive portal — typically a web-based login page that the user must interact with to gain network access.
Purpose #
When a device connects to a network and requests an IP address via DHCP, the server can include Option 114 to point the client to a captive portal URL. This enables a seamless and standardized way for clients (e.g., phones, laptops, tablets) to detect and automatically interact with captive portal environments.
Key Benefits #
🔹 Standardized Client Detection #
-
Ensures consistent behavior across different operating systems (macOS, iOS, Android) that support captive portal detection.
-
Reduces reliance on DNS hijacking or HTTP interception to trigger login pages.
🔹 Improved User Experience #
-
Clients can automatically open the correct login page immediately after connecting.
-
Reduces confusion for users who expect to be redirected but aren’t due to network/browser restrictions.
🔹 Security and Transparency #
-
Since the URL is explicitly delivered via DHCP, there’s less need for network manipulation (like redirecting traffic), which can cause SSL/TLS warnings.
-
Can support HTTPS URLs, improving trust and security during portal access.
🔹 Better Compatibility in Enterprise Environments #
-
Especially useful in guest networks, schools, and enterprise deployments where BYOD (Bring Your Own Device) is common.
-
Streamlines onboarding for non-managed devices.
Typical Use Case in Netgraph #
When Option 114 is enabled in a Netgraph environment (such as through the Service Gateway DHCP configuration), guest and unmanaged devices can be directed to a custom authentication portal immediately upon connecting to the network. This feature enhances both control and usability in environments requiring authentication or user consent before granting full access.
Portal API Integration #
Your deployment supports a full Captive Portal API behind Option 114. Clients can interact with various endpoints during a session:
-
/api/session: Session start, including metadata such as client IP/MAC. -
/api/end: Triggered when the session ends, either by expiry or manual disconnect. -
/api/venue: Returns a link or content to redirect users to a local website (e.g., a city or venue page).
Platform Compatibility #
✅ Android #
-
Automatically detects the portal using Option 114.
-
Displays a notification and a persistent link in Wi-Fi settings for returning to the portal or venue page at any time during the session.
✅ Apple (iOS & macOS) #
-
Captive portal opens automatically on connection.
-
Users can return to the portal via Settings → Wi-Fi → [Network Name], where a link to the venue page remains accessible.
⚠️ Windows (Microsoft) #
-
Does not support Option 114 (RFC 8910) natively.
-
Uses a separate connectivity test method involving a probe to a Microsoft URL (e.g.,
http://www.msftconnecttest.com). -
As a result, Windows devices do not act on Option 114.
🛠 Fallback Mechanism #
To ensure broad compatibility, our implementation includes a traditional HTTP-based redirect. If Option 114 is not supported, devices like Windows will still be guided to the portal via HTTP interception on their first web request.