Captive portal software for connecting Students own devices to WiFi network

[genesis]

Hi

 

We are using Ruckus Wi-Fi and we use NetSweeper as an internet filtering system for staff and students.

NetSweeper agent is installed on domain joined laptops and desktops . When the user logs into the computer, NetSweeper client detects the type of user and assigns the appropriate policy to the users.

 

For example, when a staff logs in, NetSweeper assigns a “Staff policy”

And if a student logs in NetSweeper assigns a “Student’s - Filtered policy”

 

Now we have few requests which have come through and some students have brought their own device and they would like to have internet access on their devices and because these devices are not on the domain, NetSweeper will not be able to assign the correct policy and internet will not work.

 

Please let me know if these are there any third-party software such as Captive Portal which can be installed on our network and linked to our Ruckus wireless, so that when students own devices is connected to the school Wi-Fi network – It provides appropriate filtering policy for the students.

 

Thanks and you help would be great!

[m_m]

Saw https://www.packetfence.org/ mentioned on here the other day. Looks well rounded, never used it myself though.

[MatthewL]

I would recommend PacketFence, takes a bit of getting head around but its good for a free product. I'm pushing to make more use of it at our place but at the bottom of my pile at the moment.

[Katy]

Never used NetSweeper so don't know if it can do this or not - but every other filtering I've used you can set up a rule so that traffic where the filter doesn't know who it is gets redirected to a portal. If it can do this then you don't need a separate product.

[CHiLL]

Can you configure a RADIUS server on NetSweeper? It's been a while since I've looked at our configuration, but we have used our Ruckus's built-in captive portal in the past (we now use Sophos XG's built-in captive portal).

 

If you can configure (or already have) a RADIUS server, then you could configure both Ruckus and NetSweeper to contact the RADIUS server to query AD. As it is querying AD, you could use security group membership to define filtering levels, so anyone in the "All Students" security group gets student level filtering and anyone in the "All Staff" group gets staff level filtering, etc. For domain joined devices, it may also eliminate the requirement for having an applicaiton installed on them, with NetSweeper querying AD for user authentication.

 

Obviously this is all dependant on NetSweeper's functionality, which I don't know at all. Maybe someone who has a NetSweeper can confirm/deny or expand on the above.

 

I know our old Smoothwall was able to do this all on-box without any extra software, however our current Sophos XG has a client installed on our DCs to connect into AD and query users/groups.

 

Edit:

 

It's worth noting that if you have an open network that anyone can connect devices to, a lot of VPN clients on phones simply bypass the filtering. It happened on both our Smoothwall and now our Sophos XG (though to a lesser extent). If a student connects their phone and turns on their VPN, they don't need to go through the captive portal and have full, unfiltered internet.

Edited March 22, 2022 by CHiLL