克隆 MAC 地址来绕过强制门户
MAC
![](/data/attachment/album/201911/11/234459tiio6ix8sx6pu0o8.jpg)


如果你曾经在家和办公室之外连接到 WiFi，那么通常会看到一个门户页面。它可能会要求你接受服务条款或其他协议才能访问。但是，当你无法通过这类门户进行连接时会发生什么？本文向你展示了如何在 Fedora 上使用 NetworkManager 在某些故障情况下让你仍然可以访问互联网。


### 强制门户如何工作


强制门户是新设备连接到网络时显示的网页。当用户首次访问互联网时，门户网站会捕获所有网页请求并将其重定向到单个门户页面。


然后，页面要求用户采取一些措施，通常是同意使用政策。用户同意后，他们可以向 RADIUS 或其他类型的身份验证系统进行身份验证。简而言之，强制门户根据设备的 MAC 地址和终端用户接受条款来注册和授权设备。（MAC 地址是附加到任何网络接口的[基于硬件的值](https://en.wikipedia.org/wiki/MAC_address)，例如 WiFi 芯片或卡。）


有时设备无法加载强制门户来进行身份验证和授权以使用 WiFI 接入。这种情况的例子包括移动设备和游戏机（Switch、Playstation 等）。当连接到互联网时，它们通常不会打开强制门户页面。连接到酒店或公共 WiFi 接入点时，你可能会看到这种情况。


不过，你可以在 Fedora 上使用 NetworkManager 来解决这些问题。Fedora 可以使你临时克隆要连接的设备的 MAC 地址，并代表该设备通过强制门户进行身份验证。你需要得到连接设备的 MAC 地址。通常，它被打印在设备上的某个地方并贴上标签。它是一个六字节的十六进制值，因此看起来类似 `4A:1A:4C:B0:38:1F`。通常，你也可以通过设备的内置菜单找到它。


### 使用 NetworkManager 克隆


首先，打开 `nm-connection-editor`，或通过“设置”打开 WiFi 设置。然后，你可以使用 NetworkManager 进行克隆：


* 对于以太网：选择已连接的以太网连接。然后选择 “Ethernet” 选项卡。记录或复制当前的 MAC 地址。在 “<ruby> 克隆 MAC 地址 <rt>  Cloned MAC address </rt></ruby>” 字段中输入游戏机或其他设备的 MAC 地址。
* 对于 WiFi：选择 WiFi 配置名。然后选择 “WiFi” 选项卡。记录或复制当前的 MAC 地址。在 “<ruby> 克隆 MAC 地址 <rt>  Cloned MAC address </rt></ruby>” 字段中输入游戏机或其他设备的 MAC 地址。


### 启动所需的设备


当 Fedora 系统与以太网或 WiFi 配置连接，克隆的 MAC 地址将用于请求 IP 地址，并加载强制门户。输入所需的凭据和/或选择用户协议。该 MAC 地址将获得授权。


现在，断开 WiF i或以太网配置连接，然后将 Fedora 系统的 MAC 地址更改回其原始值。然后启动游戏机或其他设备。该设备现在应该可以访问互联网了，因为它的网络接口已通过你的 Fedora 系统进行了授权。


不过，这不是 NetworkManager 全部能做的。例如，请参阅[随机化系统硬件地址](/article-10028-1.html)，来获得更好的隐私保护。




---


via: <https://fedoramagazine.org/cloning-a-mac-address-to-bypass-a-captive-portal/>


作者：[Esteban Wilson](https://fedoramagazine.org/author/swilson/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
If you ever attach to a WiFi system outside your home or office, you often see a portal page. This page may ask you to accept terms of service or some other agreement to get access. But what happens when you can’t connect through this kind of portal? This article shows you how to use NetworkManager on Fedora to deal with some failure cases so you can still access the internet.

## How captive portals work

Captive portals are web pages offered when a new device is connected to a network. When the user first accesses the Internet, the portal captures all web page requests and redirects them to a single portal page.

The page then asks the user to take some action, typically agreeing to a usage policy. Once the user agrees, they may authenticate to a RADIUS or other type of authentication system. In simple terms, the captive portal registers and authorizes a device based on the device’s MAC address and end user acceptance of terms. (The MAC address is [a hardware-based value](https://en.wikipedia.org/wiki/MAC_address) attached to any network interface, like a WiFi chip or card.)

Sometimes a device doesn’t load the captive portal to authenticate and authorize the device to use the location’s WiFi access. Examples of this situation include mobile devices and gaming consoles (Switch, Playstation, etc.). They usually won’t launch a captive portal page when connecting to the Internet. You may see this situation when connecting to hotel or public WiFi access points.

You can use NetworkManager on Fedora to resolve these issues, though. Fedora will let you temporarily clone the connecting device’s MAC address and authenticate to the captive portal on the device’s behalf. You’ll need the MAC address of the device you want to connect. Typically this is printed somewhere on the device and labeled. It’s a six-byte hexadecimal value, so it might look like *4A:1A:4C:B0:38:1F*. You can also usually find it through the device’s built-in menus.

## Cloning with NetworkManager

First, open * nm-connection-editor*, or open the WiFI settings via the Settings applet. You can then use NetworkManager to clone as follows:

- For Ethernet – Select the connected Ethernet connection. Then select the
*Ethernet*tab. Note or copy the current MAC address. Enter the MAC address of the console or other device in the*Cloned MAC address*field. - For WiFi – Select the WiFi profile name. Then select the WiFi tab. Note or copy the current MAC address. Enter the MAC address of the console or other device in the
*Cloned MAC address*field.

**Bringing up the desired device**

Once the Fedora system connects with the Ethernet or WiFi profile, the cloned MAC address is used to request an IP address, and the captive portal loads. Enter the credentials needed and/or select the user agreement. The MAC address will then get authorized.

Now, disconnect the WiFi or Ethernet profile, and change the Fedora system’s MAC address back to its original value. Then boot up the console or other device. The device should now be able to access the Internet, because its network interface has been authorized via your Fedora system.

This isn’t all that NetworkManager can do, though. For instance, check out this article on [randomizing your system’s hardware address](https://fedoramagazine.org/randomize-mac-address-nm/) for better privacy.

## James

Good article, but can you please edit it to say that you absolutely must change the Fedora system’s MAC address back before you put the cloned system and the Fedora system on the same network? Ethernet (including Wi-Fi) really doesn’t like duplicate MACs on the same network.

## Paul W. Frields

Good point — the article’s been edited to add the need to note down current MAC address, and restore it after authorization.

## Michael Williamson

I think, if your traffic is 100% UDP, then it doesn’t/cannot care, provided it’s going through the same radio. This might open up some possibilites getting a headless Pi on a hotel network if combined with a UDP vpn.

## Heavy

It’s a very good article, but I have question. There’s someway to build a captive portal in a open wireless network on Fedora?

## Esteban Wilson

You can try and do something with Unbound DNS or dnsmasq . There are also several open source captive portal options available.

## Joao Rodrigues

You could roll your own solution (see CoovaChilli) but probably the easiest way is to use a firewall-centric distribution, like IPFire or OpnSense.

## puffy

And no playing with aircrack-ng on public Wifi networks.

## Mark

Also, another workaround might be to open a browser and manually enter the IP address of the gateway into the URL, i.e. http://xxx.xxx.xxx.xxx and force the device to open the captive portal page that way.

This has worked for me most times when my Linux laptop or iOs devices wouldn’t pull up the portal page automatically

## Esteban Wilson

For a Linux laptop or IOS device that could work. This article addresses the issue when a device will not load the captive portal. Devices like the Switch, PS4, and other gaming consoles do not always load the portal page and need a little help. A Fedora system can provide that help.

## Vernon Van Steenkist

If your device can’t load a portal web page it probably shouldn’t be directly connected to a portal in the first place due to security reasons. What you need is a travel router. Flash OpenWrt Linux on the travel router, set up the travel router WiFi as AP+STA (WiFi Access Point and Wi-Fi client). connect the travel router WiFi to the portal, connect a device with a web browser (phone, laptop ect.) via WiFi to the travel router and authenticate to the portal. Now you can connect any device to the travel router and it will have Internet access and be protected by the travel router’s firewall since the portal only sees the travel router MAC address, You can add OpenVPN to the travel router and give all your devices VPN access as well. The device I use is the HooToo TM03 which fits in the palm of your hand, has an Ethernet port, and contains a battery which will either charge your phone or power the router for 15 hours. Zsun makes the smallest one. It fits on your key chain. The main drawbacks are that it doesn’t have a battery (You plug it in to any USB A port for power) and it is so small I lost it somewhere in my house.