Extending open WiFi with Captive Portal to Secure Network WAN/LAN

[NMRAcer]

I live in the sticks and, until recently, satellite was the only method available to connect to the internet. We recently discovered Karma which uses a cellular connection to obtain internet connectivity which is broadcast over an open WiFi network.

The problem is that there is zero customization available for the hardware associated with Karma and devices (which are limited to three simultaneous devices) must authenticate through a captive portal (HTTP authentication). This means that I am constantly rearranging which devices have access and, more importantly, some of my devices (such as the BD-Player) do not have internet access since they do not use a browser to connect to the internet.

My plan is to somehow use a single device to connect and remain connected which then allows all of the other devices to connect through it.

Currently, I have an EnGenius ERB9250 repeater set up as a client bridge. It grabs the WiFi sent by the Karma device and pushes it over to my Belkin F6D4230-4 router. The router then rebroadcasts the connection via a secured/encrypted private network.

This currently works, but I am still having to authenticate via the HTTP portal.

So, would it be possible to spoof an authenticated IP and/or MAC address by the router? Or maybe the repeater? Surely there is a way to bypass the asinine captive portal?

Barring any easy solutions with this hardware, I am putting together a Raspberry Pi which I intend to use as a media server. Theoretically I could use this as the "default" access point in order to avoid the web authentication. Right?

Thoughts? Suggestions?

 

[bill001g]

If the belkin is acting as a router...ie not a AP then all traffic should appear to come from it WAN ip address. This is the pretty standard trick of authenticate using a PC behind the router and then all the other devices connected to the router also get access.

Unless they are loading some script/cookie to the client it should work.

Your solution is the pretty standard way to bypass a layer 3 authentication system like captive portal and why it is not consider a secure solution....which is why 802.1x was invented.

 

[NMRAcer]

If the belkin is acting as a router...ie not a AP then all traffic should appear to come from it WAN ip address. This is the pretty standard trick of authenticate using a PC behind the router and then all the other devices connected to the router also get access.

Unless they are loading some script/cookie to the client it should work.

I assume there is some way to test this?

There does not seem to be any rhyme or reason why it will allow or deny me access. It also seems to throttle back speed (0.9 Mbps vs 5.0 Mbps) via WAN but appears much quicker via LAN (though I haven't tested it yet). I'm assuming this all has something to do with how it's being authenticated.

 

[mikewest21]

I currently use an app on Android called netshare no root tethering cost 10.00 and allows me to connect to the captive portal on the phone then run that app which then shares that existing connection under a new access point ssid and password along with a proxy setting for those connecting to it. There is another app by the same developer for rooted phones that offers the same process but without having to enter a proxy setting to share. Would allow multiple devices to share one authentication.