Feature #7158
closed
Captive Portal should have logs facilities for blocked sites
Added by Jose Torres over 8 years ago.
Updated almost 6 years ago.
Description
Whenever I have problems connecting to sites from client software that does not have proxy settings there is no way to identify the address that is being blocked.
When there is no proxy service then there is no way to identify blocked sites even with client software that does have proxy settings.
- Status changed from New to Rejected
The subject says Captive Portal, description says proxy. Captive Portal doesn't block sites, it redirects everything it can to the portal, so logs for that would be a bit useless. Browser detection of portals is much better these days than it was when this issue was opened as well. I don't think there is anything actionable here.
Jim Pingle:
Since it was rejected. Please tell me an alternative to get the address that is being redirected to the portal in the server side. Or provide sample code compatible to all Browsers to place in the portal html to show the redirected address or to generate some log file. Please note the user of the Browser requests an address but many times the web server redirects to other address not known to the user. Also not all network requests are made by Browsers but by applications that run in the users computer which requests an address that the user never see so the portal response is also hidden to the user thus making impossible to the user to noticed the portal response.
The firewall has no way to know what any of that is. It sees a request to an IP address on port 80, for example, and redirects it. If it showed the IP address the user, it would almost certainly be meaningless. Currently nothing is logged from ipfw, and there are no plans to start that I'm aware of.
A proxy can get the entire URL, but the firewall cannot.
Jim Pingle:
Having the IP address being requested I could make a reverse lookup to identify the owner of the IP thus the application that is having problems. Also I can add the IP to the portal allow addresses to let pass the network request solving temporarily the need of the user or client app.
As of now without the IP I have to turn off the portal completely to the user computer IP or MAC which is not a secure way.
That is why I asked for a log facility. Something simplistic could suffice (from IP or MAC, requested IP) hold for 24 hr or less.
Reverse DNS almost never bears a relationship to a website these days. You'll only get a random CDN or other hosting server that may have hundreds or thousands of sites on it.
I don't think you're trying to solve the right problem here. And this site isn't for discussion. Start a forum thread outlining your actual problems and goals and someone can probably help you find a way to make it happen.
Also available in: Atom
PDF
Updated by 
Updated by