Setting up Hotspot Web Portal with SMS - Text Message Authentication

Web SMS Configuration

Set up an account with a suitable Web SMS provider - some providers may offer initial free credits for testing and this is recommended when evaluating suitability before purchasing SMS credits.

The SMS provider may have a web console for configuring access to their services through an API. An API Client must be configured before proceeding and will have a unique username & password that the router will use.

Some providers may also have an option to allow access to the SMS API only from the specified IP address.

In the example below, the API is configured to allow SMS messages to be sent through their system from the IP address of 198.51.100.153 only.

To configure the SMS provider on the router for use with Hotspot Web Portal, go to [Objects Setting] > [SMS / Mail Service Object] and click on an available Index number.

The first eight Indexes must use the pre-set providers (Built-In).

Index 9 and 10 can be configured for custom providers that use a custom string to access an API.

In this example, a custom provider will be used, the string used will be defined by the SMS provider in an API configuration document, with a format similar to the one below. This example is VoodooSMS, this string text can be used when configuring VoodooSMS on a DrayTek router.

Example:

www.voodoosms.com/vapi/server/sendSMS?dest=###txtDest###&orig=Hotspot&msg=###txtMsg###&uid=###txtUser###&pass=###txtPwd###&validity=1&format=php

Please note in this example, the "orig=Hotspot" value is the Origin. Some SMS providers allow this to be set to display a company name to the receiver of the text message. This can typically be up 15 numeric digits or 11 alphanumeric digits (a-z, A-Z, 0-9 only). Check the User Experience tab for an example of what a user would see when receiving a text message from this provider with the origin configured as Hotspot.

The items in hashes i.e. ###txtDest### are the details that are replaced by the router with the information that changes when sending a text message.

If using a pre-set provider, simply select the provider from the list.

Set the Username and Password for the SMS provider's API.

The Quota is the number of message credits available on the account that the router is aware of. If this value is 0, the router will not send SMS messages. The maximum allowed value is 65535.

The Sending Interval should be set to "0"

Click OK to save the SMS provider object and the Hotspot Web Portal profile can be configured.

Setting up Hotspot Web Portal

Check that the router has Internet access before continuing, using SMS as an authentication method requires Internet access to send the text message with the authentication code to users.

The router must have an SMS Object configured before proceeding.

Go to [Hotspot Web Portal] > [Profile Setup] and click on an available index number:

Enable this profile and set the name for the profile in the Comments field.

Select "PIN Code Login" and click Save and Next to continue.

Choose a login page design, customize the color and images as required then click Save and Next.

Customize the descriptions on the login page as required.

Set the message that will be received by modifying the Receiving PIN via SMS Content field. The <PIN> text must be included in the message for the user to receive the unique code.

Select the SMS Provider from the Receiving PIN via SMS Provider list.

Click Save and Next to continue.

On the next section of the profile, configure the required values and select the Default Country Code for the country that users will be presented with. The list is sorted alphabetically, "+44 United Kingdom" entry is at the bottom of this list. The Country Code setting can be selected by users when entering their phone number.

Important Note

 Hotspot Web Portal in 3.8.4.3 firmware does not automatically remove the leading "0" digit of a phone number and prepends the user's phone number with the Country Code selected (check the User Experience section for an example of this). It is recommended to advise users to remove the leading "0" in the Pin Code Message field.
The SMS provider will typically be unable to send a message to the user if the number sent is in an invalid number format.

Click Save and Next to continue.

The last page of the Hotspot Web Portal profile has options to select how users are guided to the Portal page, what happens once they have authenticated and which network segments / Wireless Networks this profile applies to.

It is recommended to Enable Captive Portal Detection so that devices connecting can detect that they are connected to a Hotspot network that requires authentication and will prompt users immediately upon connecting.

In this example, HTTPS Redirection is not enabled; this means that access to HTTPS sites before authentication is blocked by the router's firewall.

If Captive Portal detection is disabled, users must access an HTTP site to see the Hotspot Web Portal authentication page.

If HTTPS Redirection is enabled, the router will redirect access for HTTPS sites to the router's Hotspot Web Portal. Please read the HTTPS Redirection section below for more information.

Set up the landing page that users will see after they log in successfully. In this example, users will see www.draytek.com once they have authenticated successfully.

Select the interfaces to apply the Hotspot Web Portal to, then click Finish to save the profile.

HTTPS Redirection

The option to enable or disable "HTTPS Redirection" defines how the Hotspot Web Portal handles HTTPS connections for users that have not yet authenticated.

If this option is disabled, HTTPS traffic is blocked by the router until the user has authenticated and the user must access an HTTP webpage to be redirected to the router's Hotspot Web Portal welcome page.

Enabling HTTPS Redirection will modify DNS requests for access to HTTPS sites so that access to any HTTPS page will result in the Hotspot Web Portal welcome page on "portal.draytek.com" loading instead. HTTPS is designed around SSL Certificates, which validate whether an HTTPS site is legitimate or not through matching data in an SSL Certificate to the hostname / website being accessed. If these details do not match, a web browser will typically display a warning like the ones shown below:

This is caused by the HTTPS Redirection feature and is inherent to any Web Portal system that redirects HTTPS traffic. Note that in the image on the right, access to the site is blocked entirely because of HSTS - HTTPS Strict Transport Security.

Because of the confusion this can cause to end users of a Hotspot Web Portal wireless network, it may be beneficial to leave HTTPS Redirection disabled and recommend that users access a specified HTTP website to authenticate with the Hotspot network.

The Hotspot Web Portal configuration will be applied to users connecting to the interfaces selected. Click Preview to view the login page through the web browser:

When a user connects to a wireless network or network that has Hotspot Web Portal applied to it, they will be directed to the Hotspot Web Portal login page if Captive Portal Detection is enabled for the Hotspot profile.

Alternatively, access to HTTP sites will be redirected to the router's Hotspot Web Portal authentication page.

The portal page will display options to authenticate via SMS code, or log in with an existing PIN code (valid for 10 minutes).

Once the user has selected Receive PIN via SMS, they will be prompted to enter their phone number to receive the SMS.

The "+ 44" option is the Country Code for the number, with +44 being used for the UK. Pressing the "+ 44" option will present a list of available country codes.

The number must be entered with the leading "0" removed. In this example, the UK mobile phone number of "07778889999" has the leading "0" removed.

This is because the SMS must be sent with a Country Code specified. If the number is sent with both the Country Code and the leading "0" digit, the number will be invalid and the user will not receive a text message.

The user will shortly after receive a text message with the 6 digit code for use with the Hotspot Web Portal network.

This code allows a single device to authenticate, the router will generate a unique code for each user that requests an SMS code.

In the Hotspot Web Portal, the user would then enter that number and click Submit to authenticate with the router.

After a successful authentication, the user will be directed to the specified landing page, the original page they were accessing, or an HTML bulletin message depending on the action that was selected when configuring the Hotspot Web Portal profile.