Originally published at: https://tidbits.com/2018/11/28/how-to-work-around-wi-fi-hotspot-captive-portals-on-browserless-devices/
Many public Wi-Fi hotspots require you to click a button on a “captive portal” page before you can get online, which is a problem if your device doesn’t have a Web browser. Here’s a workaround you can try with a device like an Apple TV or Nintendo Switch.
1 Like
Nice tip. I was able to connect to a hotel WiFi recently with my Apple TV by calling the internet technical support 1-800 number. They were able to manually authenticate my MAC address.
Now you’ve done it, jack-booted DMCA thugs are going to rappel down your building and smash through a window for revealing how spoof MAC addresses 
Seriously, thanks for this, I’ve been familiar with the concept for a long time but hadn’t bothered to look for the exact procedure and didn’t know how easy it is. Before I read this article, I thought it was going to be about using macOS’s Internet Sharing; that could work with an Apple TV (assuming you had an Ethernet cable, oh, and an Ethernet adapter for the Mac) but not for something like the Nintendo Switch.
BTW, the Nintendo Switch has a “secret” web browser, specifically for these WiFi portals. Someone figured out a way to use the Switch’s browser for portals to visit any site (in a way that advertises their business).
Yeah, I was happy when Josh suggested the article, since I’d been vaguely aware of the technique, but didn’t really know how to do it either. 
I’ve never had a need for the technique either, but I can absolutely see how getting stuck in a hospital or hotel with dodgy Wi-Fi policies could drive one insane.
Huh, interesting. Unfortunately, it never appeared for me. (Or maybe fortunately, because otherwise there may not have been an article!)
Thanks Josh. What a great article. I’ve long wondered if there was a way to do this. Now if I could just find a way to spoof the MAC on an iOS device
This is a nice tip, thanks!
I wonder, would this work with an Apple Watch? I have a series 3 which can’t use the public WiFi network at my gym. That’s despite my iPhone having earlier joined and learned this WiFi network.
I’m not sure where the Apple Watch limitation lies exactly. Maybe it’s not related to the interstitial agreement since watchOS has support for WebKit now, so maybe this MAC address trick won’t help. It’s a nuisance I’d love to workaround. I filed an enhancement request with Apple some time ago, but it was closed as a duplicate.
1 Like
It’s very unclear how the Apple Watch uses Wi-Fi. I have a Series 2, and once it picked up Cornell’s network when I was in range without my iPhone—I was quite surprised to get the notification. But it never happened again, which in some ways isn’t too surprising because Cornell’s network generally requires visitors to log in at a portal page.
Thanks for the great tip, which I have never needed and hope never to need.
Enter your administrator password when prompted.
Do I need to be in an administrator’s account to make the change? In other words, is there a way to use sudo from a non-administrator account? If so, does any administrator password work or do I need to specify both an administrator account and the associated password?
Sudo is a standard *nix tool that has a configuration file that can be edited to allow use by a user who doesn’t have the macOS “admin” checkbox checked. But it absolutely should not be used by anyone who isn’t already very comfortable working the command line and knows what to do if (when) they screw up.
Instead, if you’re logged into your Mac as a non-admin and don’t want to use Fast User Switching, here’s how to do it just within Terminal:
su adminnamewhere “adminname” is the short name of an admin account- Enter adminname’s password when prompted. You now have a “shell” running as that account instead of the account you logged into the Mac with.
- Now run the sudo command you want to use. You’re now “adminname” so enter its password when prompted.
- When finished using sudo commands, enter
exitto close the shell running as “adminname.”
It’s not relevant for running the command used in this article but note that using su does not change what directory you’re in, you’ll still be in the non-admin user’s home directory. This is relevant if you’re using a command to write a file into the current directory. The cd command by itself will change you to the current shell user’s home directory, i.e. /Users/adminname. When you exit, you’ll be back in the directory you were in when you ran su. pwd (stands for Present Working Directory) always tells you where you are.
1 Like
Sure…just edit the sudoers file and add your non admin account…alternative ugh you will need to log in as admin to do that. Once you do that and relogin as mon admin…just use sudo whatever at the prompt and I put your non admin password when required.
I travel quite a lot for business, and for both security (having a firewall) and convenience sake (avoiding having to authenticate every device in my kit), I use an inexpensive, lightweight, USB-powered travel Wi-Fi access point/router.
https://www.gl-inet.com/products/gl-ar750/
I get on the captive portal with one device through the router, and all my other devices (which already know the SSID of my router) are immediately on the air.
Because it is USB-powered, I plug it into a USB battery pack when I want to be mobile (e.g., walking around an airport).
This is a lot easier than hacking the MAC address each time.
1 Like
Nice. Do you sign in to an embedded web server on the device to see a list of local WiFi networks to select the one to connect to?
Oh, that’s fascinating—have you run into any usage quirks because of adding another level of routing?
$45 is a good price too. It might be worth that just to avoid having to constantly sign in on multiple devices.
For routing, the travel router shouldn’t be any different than using a personal home access point/router in front of an ISP-supplied one or a Mac using Internet sharing. Two layers of network address translation (NAT) can create problems but I think it depends on the protocol used, web and email will probably be fine. Anything that’s peer-to-peer, including WebRTC, has a greater chance of having problems.
The cleverness of this box is using one set of WiFi hardware simultaneously as a client of one SSID and the creator of a second SSID. Years ago, I saw third-party software to make any Windows computer do this but I’ve never seen an equivalent for macOS.
1 Like
Yes. The router has a HTTP-based GUI. I keep a bookmark to the LAN-side IP address, enter the admin. password, and I’m in. There are actually two GUIs, one simple and mostly graphical, and the other labeled “Advanced” (which lets you get into the guts of it, but you don’t need it for this). Once into the simple GUI (reached by default), clicking on the globe icon brings up a dialog that lets you set up the WAN side. There is a tab for wireless repeater mode, and there you pick the SSID you want to attach to (I also carry a small, retractable Ethernet cable, so if there’s an RJ-45 in my hotel room, it’s even easier). That’s pretty much all there is too it. There have been a few twists (and I’ll reply to Adam about those).
1 Like
Adam, regarding usage quirks, most of the time, it’s pretty transparent (“it just works”). There are a few hotel chains (e.g., Best Western) that have portals that seem to be router-resistant. I did have a problem with one Residence Inn, struggled for most of an hour, and and it turns out there were rogue SSIDs operating on the property – it was a matter of picking the right one (and the front desk was clueless, but they gave me a number for their ISP, and we figured it out).
One caveat: Under the DNS settings, there’s a checkbox labeled “Prebind Protection” with a note to “Uncheck this if captive portal page cannot be resolved” – and I found it necessary to uncheck that box. I am planning to add my own DNS entries (likely 1.1.1.1 and 9.9.9.9, or the OpenDNS ones) vs. using the hotel default, but I haven’t made that change yet.
The device has the option to backup the configuration (download a file) and I suggest you do that (once it is set up). It once went bonkers on me, and I had to do a factory reset and restore.
1 Like
Oh, one more thing… I use Encrypt.Me (formerly Cloak) for auto-enabled VPN protection on non-whitelisted networks, and you need to temporarily disable the “Over-Cloak” (Mac) or Connect On-Demand (iOS) feature in order to access the router. Once the connection is made, I re-enable the VPN.
1 Like
Great stuff, Steve, and I may pick one of those up before my next trip, since it sounds like it can make things a lot easier and potentially more secure.
I happen to have an old AP Express lying around. Could something similar be achieved using just one Mac and such an old AP Express? Use the first Mac to connect to the wireless network. Then share that to an AP Express connected to that Mac through Ethernet (possibly via TB dongle). Set up the AP Express to use bridge mode. From then on just connect additional other wifi clients to the AP Express.