Simple definition
A captive portal controls network access by requiring the user to authenticate, accept terms, or complete another action before normal connectivity is granted.
Technical definition
The network initially places the client in a restricted state. Connectivity-check requests or selected web traffic are directed to the portal, while a walled garden may allow essential services. After validation, the controller changes the policy applied to the device or session.
How it works / role
The portal does not decrypt HTTPS simply to display its page. Modern operating systems use captive-portal detection mechanisms and dedicated URLs. After the user is validated, the Wi-Fi controller, firewall, or NAC system allows traffic according to the configured duration, identity, device, or role.
What is it used for?
Provide guest Wi-Fi access, require acceptance of terms, collect authentication, or apply policy before opening network access.
Practical example
A visitor joins a company’s guest SSID. The phone detects the captive portal, opens the validation page, and after the terms are accepted the controller grants Internet access while keeping the device isolated from the internal network.
Common issues
- The captive-portal window does not open automatically
- DNS or the walled garden is too restrictive to load the portal
- HTTPS or HSTS sites cannot be used for transparent forced redirection
- Randomized MAC addresses or session expiry cause repeated authentication
Key takeaway: A captive portal is an access-control mechanism, not complete network security; combine it with isolation, segmentation, and appropriate policy.