Dynamic Firewall Rule Configuration for Secure Captive Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Captive Wi-Fi networks pose a challenge for virtual private network (VPN) gateways, as they require interaction with captive portals that typically necessitate display screen access, compromising security when trying to connect devices protected by the VPN gateway to public Wi-Fi networks.
Innovation Solution
A system and method to dynamically configure firewall rules of a VPN gateway to securely access captive networks by probing for the captive portal, redirecting network traffic for authentication, and establishing a VPN tunnel while minimizing exposure to the public network, thereby maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the VPN gateway bypasses the gateway to allow device interaction with the captive portal, then the ease of operation is improved, but the security is worsened
Solution Approach 1:
The firewall rules are dynamically configured based on the authentication state. Before authentication, the firewall allows traffic to the captive portal. After authentication succeeds, the firewall rules are updated to enforce VPN tunnel routing for all subsequent traffic, creating a dynamic security posture that adapts to the authentication state
Solution Approach 2:
The system performs preliminary firewall configuration to allow captive portal access before authentication occurs. This temporary permissive state enables the authentication process to complete, after which the firewall is reconfigured to enforce security requirements
2Object-affected harmful factors
If the VPN gateway maintains strict firewall rules to protect devices, then the security is improved, but the ease of operation is worsened
Solution Approach 1:
The firewall transitions from a permissive state (allowing captive portal access) to a restrictive state (enforcing VPN tunnel routing) based on authentication outcome. This dynamic adjustment resolves the contradiction by temporarily relaxing security only when necessary for authentication, then restoring strict security afterward
Solution Approach 2:
The VPN gateway automatically detects the authentication state and self-adjusts its firewall configuration without manual intervention. The system monitors authentication status and autonomously updates routing rules to maintain appropriate security posture
Data Source
AI summary
An approach is proposed that contemplates system and method to configure firewall rules of a VPN gateway of a protected network so that users of devices in the protected network can access Internet securely via a captive network. First, the proposed approach enables the VPN gateway to probe the captive network with an HTTP request to discover a captive portal of the captive network. After the captive portal is discovered, one or more firewall rules of the VPN gateway are added so that network traffic from the devices in the protected network are redirected to the captive portal for authentication. Once the users are authenticated and a VPN tunnel is established between the VPN gateway and a remote VPN tunnel terminal, the firewall rules previously added are removed from the VPN gateway and all network traffic from the devices in the protected network are routed over the VPN tunnel.