Secure Captive Portal Check

Captive Portal Check on Android Devices

The Captive Portal Check on Android devices verifies whether a Wi-Fi network has an internet connection or requires a login portal (e.g., in hotels or cafés). When establishing a connection, Android sends a request to a server (default: http://connectivitycheck.volla.tech). If the device receives a specific response (HTTP 204), Android recognizes a direct internet connection. If redirected to a login page instead, Android opens it in the browser for the user to log in. This ensures an internet connection is available or login is possible. In simple terms: It’s an automatic test to determine if the Wi-Fi connects directly to the internet or requires a webpage login.

Impact on Wi-Fi and Mobile Data Connections

Home Wi-Fi: Android checks if the Wi-Fi provides internet access upon connection. If the server doesn’t respond, Android may mistakenly assume no internet connection exists, displaying a warning symbol (e.g., “!”). In some cases, if the “Auto-switch” option is enabled, the device may switch to mobile data despite a functional Wi-Fi. The connection usually remains usable, as the check primarily affects the display.

Mobile Data: The impact on mobile data is minimal, as it typically connects directly to the internet. However, an unreachable server might cause Android to mark the connection as limited, potentially affecting certain apps in rare cases.

In simple terms: If the test server doesn’t respond, your device might incorrectly assume Wi-Fi or mobile data isn’t working, even if it is. You can usually continue browsing, but warnings may appear, or the device may switch to mobile data.

Impact of VPN on Captive Portal Check

Using a VPN can, under certain circumstances, resolve temporary unavailability of the Connectivity Test Server (e.g., connectivitycheck.gstatic.com), but it’s not guaranteed and depends on the issue’s cause. Below is a concise analysis:

Potential Benefits of a VPN

• Bypassing Network Restrictions: A VPN can help if the test server is blocked by local network restrictions, firewalls, or ISP blocks (e.g., in restrictive countries), as traffic is routed through another server. Encryption and routing via a VPN server can bypass such blocks.
• Stable Connection in Unreliable Networks: In unstable or heavily monitored networks (e.g., public Wi-Fi), a VPN can stabilize the connection by tunneling traffic through a reliable server. Switching to another VPN server or protocol (e.g., OpenVPN instead of WireGuard) can reduce connection drops.
• Bypassing DNS Issues: If the test server is unreachable due to faulty ISP DNS settings, a VPN with its own DNS servers (e.g., VPN-provided DNS instead of ISP DNS) can resolve the issue.

Limitations and Potential Issues

• VPN as a Source of Connection Issues: An unstable VPN server or incorrect settings (e.g., blocked ports, wrong protocol) can cause connection issues, including test server unavailability. Android sends connectivity checks partially outside the VPN tunnel, which Google states is intentional but may affect reachability.
• Server Dependency: If the test server itself is down (e.g., Google server issues), a VPN won’t help, as the issue isn’t network-related.
• Performance Impact: A VPN can slow down the connection or cause instability, especially with high encryption (e.g., AES 256-bit). Switching to lower encryption (e.g., AES 128-bit) or another server may help.

Practical Steps

• Test different VPN servers: Switch to a server in another country to bypass local blocks.
• Change protocol: Use OpenVPN or Lightway (if available) for unstable networks.
• Check DNS settings: Use VPN-provided DNS servers or public ones like Google DNS (8.8.8.8).
• Disable VPN: Test if the issue persists without a VPN to rule out the VPN service as the cause.
• Check Always-On VPN: Ensure Android’s Always-On VPN is correctly configured for automatic connections.

A VPN can resolve test server unavailability if caused by network restrictions, DNS errors, or unstable connections. However, it’s not a universal fix, as VPNs can introduce issues. Test different servers, protocols, and settings to find the optimal configuration. If the issue persists, it may be due to the server itself or other device settings.

Thanks to: [[1]] and our diligent Marcus and Rüdiger from our [Community] for the guides already written in posts/PDFs, which I’ve slightly adapted.

Solution for a Failed Captive Portal Check

If the Captive Portal Check fails (i.e., the server defined under VollaOS, [[2]], is unreachable), there are two ways to resolve the issue:

Option 1: Using a PC and Terminal

Prerequisites

• PC and phone connected via a data cable.
• Admin rights on the PC.
• Developer options, including USB debugging, enabled on the phone.

Steps

1. Set Up ADB Tools on the PC

 a) Windows: Install ADB  
    - Helpful article: [[3]]  
    - Download Platform-Tools (e.g., for Windows: [[4]])  
    - Unzip the file, e.g., to `C:\`.  
    - Optional: Test ADB by opening `adb.exe` with Shift + Right-Click in the terminal and running `adb`. This lists all available ADB commands.  
    Important: In Windows, the command must be `.\adb`, as Windows otherwise looks elsewhere.  
 b) Linux: Install ADB Tools  
    - ADB Tools are often pre-installed. If not, run in the terminal:  
      sudo apt install android-tools-adb

1. Enable USB Debugging on the Phone

 - Activate Developer Mode: Go to Settings > About Phone > Build Number and tap 7 times.  
 - Navigate to Settings > System > Developer Options and enable them.  
 - Enable USB Debugging.

1. Download Captive Portal Controller

 - Download the “Captive Portal Controller” app via F-Droid: [[5]]  
 - Alternatively, if the phone has no internet: Download the APK from F-Droid to the PC, transfer it to the phone, and install it.

1. Grant Write Permission to Captive Portal Controller

 - Windows:  
   - Navigate to the `adb.exe` file, open it with Shift + Right-Click in the terminal.  
   - Run the following commands:  
     .\adb devices (should display the connected phone; check if USB Debugging is enabled).  
     .\adb shell pm grant io.github.muntashirakon.captiveportalcontroller android.permission.WRITE_SECURE_SETTINGS  
 - Linux:  
   - Open the terminal and run:  
     adb devices  
     - On first use, you may see “not authorized.” Authorize the connection in the popup on the phone.  
     - An output like `List of devices attached #DeviceNumber device` should appear.  
     - Run:  
       adb shell  
       pm grant io.github.muntashirakon.captiveportalcontroller android.permission.WRITE_SECURE_SETTINGS  
   - Close the terminal and disconnect the phone from the PC.

1. Activate the App

 - In the app, enable the “Enable controller” slider.

1. Set Alternative Captive Portal Check Servers

 - In the app, under Custom servers, enter the following addresses (or your preferred ones) in the four available fields:  
   URL Field 1:  
   https://captiveportal.kuketz.de  
   Alternative: https://connectivitycheck.grapheneos.network/generate_204  
   URL Field 2:  
   http://connectivitycheck.volla.tech/  
   Alternative: http://captiveportal.kuketz.de or http://connectivity-check.opensuse.org  
   URL Field 3:  
   http://captiveportal.kuketz.de  
   Alternative: http://captiveportal.kuketz.de/gen_204  
   URL Field 4:  
   http://captiveportal.kuketz.de  
   Alternative: http://connectivity-check.ubuntu.com  
 - Click “Save”.

Done.

Option 2: Using Apps from the F-Droid Store

With the following apps, which work together, you can adjust the Captive Portal Check addresses directly on the phone:

• [[6]]
• [[7]] or [[8]]