Captive Portal with Mac Catalina

[ChrisColotti]

I installed the CLI with Homebrew and it's working well. I have seen a few times where open WiFi with a captive portal though does not work unless I remove the 127.0.0.1 setting in Mac DNS. I suspect the NextDNS servers are not reachable until the portal is authenticated but can't get to the portal otherwise. I am not sure the work around but wanted to log the issue for tracking and ongoing testing of the Mac CLI.

I think the mac VPN app is fine as it won't connect until the internet is active, but I use the CLI so I can support other VPN's.

Once I removed the manual 127.0.0.1 portal came up and I could re-add 127.0.0.1 but that's not ideal for the average user.

[rs]

It will be fixed soon.

[ChrisColotti]

It will be fixed soon.

Thanks. Let me know and I can test it I have a captive portal at home for testing purposes.

[ChrisColotti]

Also interestingly, I am not sure if this is related... It very well could be, but in the case yesterday I was able to get the captive portal once I removed 127.0.0.1 but it's worth tracking with the CLI update.

https://poweruser.blog/macos-catalina-wifi-issue-captive-portal-broken-45610cc016b5

[rs]

@ChrisColotti the feature is in the master. Can you validate it is working with your captive portal? Don't forget to add the -detect-captive-portals option.

[ChrisColotti]

Hmm...

sudo nextdns install -detect-captive-portals -report-client-info -config

Returns Error:
flag provided but not defined: -detect-captive-portals

Maybe I am missing something? I tried "true" and "yes" as options but nothing in the readme says any definitions are needed.

[FernandoMiguel]

@ChrisColotti I assume you built off master ?
this feature hasnt been released yet

[FernandoMiguel]

~/go/bin$ sudo ./nextdns run -detect-captive-portals
Password:
I: 14:48:33 Starting NextDNS on localhost:53
I: 14:48:33 Starting mDNS resolver
W: 14:48:39 Endpoint failed: https://m247-lon-1.edge.nextdns.io#XXXX roundtrip: context deadline exceeded
I: 14:48:40 Switching endpoint: https://dns1.nextdns.io#XXX:
I: 14:48:40 127.0.0.1 tcp api.apple-cloudkit.fe.apple-dns.net. (53/-1) 5321

[ChrisColotti]

Oh my mistake I thought the earlier post asked me to test it and thought it was in 1.1.8

"@ChrisColotti the feature is in the master. Can you validate it is working with your captive portal? Don't forget to add the -detect-captive-portals option."

I have it installed via homebrew so looks like that hasn't been added as a new version I just assumed it was in 1.1.8 :)

[ChrisColotti]

@ChrisColotti I assume you built off master ?
this feature hasnt been released yet

Doing that now, I was just updating via homebrew...oops :)

[FernandoMiguel]

@ChrisColotti if you have go installed, clone the repo and go install
if you don't, there's a Dockerfile that builds the artifact for your

[ChrisColotti]

So I setup from source. Still not seeing captive portal. Here's the specifics.

Installed from source
ran:
sudo ./nextdns install -detect-captive-portals -report-client-info -config
sudo ./nextdns activate

DNS on system is set to 127.0.0.1 at this point

connect to non portal wifi = success
connect to captive portal = failure, no portal is presented (testing on Mac 10.14.6) to rule out Catalina specific issues.

the DNS is remaining on 127.0.0.1 so portal is not coming up as expected. Once again I still need to remove the activated 127.0.0.1 setting to get the portal.

I think the goal here is to keep the client "active" at all times but someone deactivate when a portal is present.

[rs]

Can you show the logs please?

[ChrisColotti]

Sorry was offline for PTO. Happy to send them....silly question with the GO master build where are the logs?

[rs]

Do you use systemd? If so, journalctl -efu nextdns

[ChrisColotti]

Do you use systemd? If so, journalctl -efu nextdns

Does not appear I am on my macbook with GO installed. So I am not sure how to view the logs. Also the go build stops working for me at least once a day, the stable build on my other laptop is fine (Probably something I am just not familiar with go) . I am not a developer, more an end user so I am not sure how else to test this, but it's easily re-produced by someone that can maybe capture the logs better.

[rs]

What is the compile error?

On mac, logs can be found in the console app. Search for nextdns.

[FernandoMiguel]

You can run it in the foreground
nextdns --log-queries
Will output on your shell

Brew install golang
Will have you set to to build the cli tool (it will live in ~/go/bin/ )

[ChrisColotti]

I will have to come back to testing this and getting logs in a few weeks. The laptop I can test it on is not with me at the moment. I do want to help get this fixed for others. For now I know to remove the local loopback for DNS when at a hotel first, but it can definitely work better. Unless someone can re-produce and get the logs sooner than I can with my work schedule. Also the "VPN" client on Mac seems to work fine on other machines I have that don't need the CLI version to run other VPN clients on.

[rs]

Please test v1.2.0.

[ChrisColotti]

Please test v1.2.0.

Okay will do, it may take a few days to test with a captive portal I am on the road and need one to expire.

[ChrisColotti]

I have not been able to tell if 1.2.7 is working consistently. I am now noticing when the Mac goes to sleep and wakes up (Closed and open cover), the client will not connect. I have to keep uninstalling and re-installing and re-activating to get it working again. This may be a new issue of some kind so do we want a new thread? This is currently on Catalina as well. I can't check Mojave for a few days.

[rs]

The last version should have fixed that. Can you confirm you are testing with the last version?

[ChrisColotti]

The last version should have fixed that. Can you confirm you are testing with the last version?

Looks like 1.2.10 still exhibits the same on Catalina. I really need to side by side test on Mojave later next week.

[rs]

I can’t reproduce on Catalina. Can you please give a step by step way to reproduce?

[ChrisColotti]

Hmmmm. It’s just simply after my Mac has been closed for a while when it wakes up there’s no DNS resolution. I’ve tried waiting a bit thinking the client has to start up but the only way to get it back is to deactivate/uninstall. Then install and activate again. (This is nothing related to captive portal coming up) I’m currently just on standard internet which is think would be easier. I didn’t want to confuse the original issue.

[rs]

Can you send the logs of the daemon when that happens?

[ChrisColotti]

Dec 7 11:37:06 Chris-MBP com.apple.xpc.launchd[1] (nextdns): This service is defined to be constantly running and is inherently inefficient. Dec 7 11:37:12 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:50120: use of closed network connection Dec 7 11:37:12 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:50125: use of closed network connection Dec 7 11:37:12 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:50119: use of closed network connection Dec 7 11:48:24 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:50744: use of closed network connection Dec 7 11:53:01 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:51097: use of closed network connection Dec 7 12:10:01 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:51672: use of closed network connection Dec 7 12:25:15 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:52294: use of closed network connection Dec 7 12:25:15 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:25:36 Chris-MacBook-Pro nextdns[31867]: Endpoint failed: %!s(<nil>): Get https://216.239.32.21:443?stack=dual: unexpected EOF Dec 7 12:25:36 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:26:25 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:52377: use of closed network connection Dec 7 12:27:06 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:06 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:12 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:13 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:15 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:47 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:52 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:54 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:57 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:33:59 Chris-MacBook-Pro nextdns[31867]: Endpoint failed: https://vultr-seattle-1.edge.nextdns.io#66.42.79.152,2001:19f0:8001:81e:5400:2ff:fe17:3007: roundtrip: context deadline exceeded Dec 7 12:50:04 Chris-MacBook-Pro nextdns[31867]: doh resolve: read tcp 192.168.171.201:52744->45.90.28.0:443: read: connection reset by peer Dec 7 12:50:10 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:50:13 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:50:14 Chris-MacBook-Pro nextdns[31867]: doh resolve: context deadline exceeded Dec 7 12:50:25 Chris-MacBook-Pro nextdns[31867]: Endpoint failed: https://vultr-seattle-1.edge.nextdns.io#66.42.79.152,2001:19f0:8001:81e:5400:2ff:fe17:3007: roundtrip: context deadline exceeded Dec 7 12:50:30 Chris-MacBook-Pro nextdns[31867]: Endpoint failed: https://dns1.nextdns.io#45.90.28.0,2a07:a8c0::: roundtrip: context deadline exceeded Dec 7 12:50:35 Chris-MacBook-Pro nextdns[31867]: Endpoint failed: https://dns2.nextdns.io#45.90.30.0,2a07:a8c1::: roundtrip: context deadline exceeded Dec 7 12:50:35 Chris-MacBook-Pro nextdns[31867]: dns resolve: dial: dial udp 192.168.171.1:53: i/o timeout Dec 7 12:50:35 Chris-MacBook-Pro nextdns[31867]: dns resolve: read: read udp 192.168.171.201:50147->192.168.171.1:53: i/o timeout Dec 7 12:52:29 Chris-MacBook-Pro nextdns[31867]: doh resolve: read tcp 192.168.171.201:52876->66.42.79.152:443: read: connection reset by peer Dec 7 12:52:30 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:52954: use of closed network connection Dec 7 12:52:30 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:52953: use of closed network connection Dec 7 13:01:56 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:53165: use of closed network connection Dec 7 13:13:33 Chris-MacBook-Pro nextdns[31867]: doh resolve: read tcp 192.168.171.201:53256->66.42.79.152:443: read: connection reset by peer Dec 7 13:13:34 Chris-MacBook-Pro nextdns[31867]: write tcp 127.0.0.1:53->127.0.0.1:53552: use of closed network connection Dec 7 14:55:42 Chris-MacBook-Pro nextdns[31867]: doh resolve: read tcp 192.168.171.201:53704->66.42.79.152:443: read: connection reset by peer Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:54948: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:57569: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:54948: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:51854: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:58084: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:57569: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:58084: use of closed network connection Dec 7 17:35:01 Chris-MacBook-Pro nextdns[31867]: write udp 127.0.0.1:53->127.0.0.1:51854: use of closed network connection Dec 7 17:48:34 Chris-MBP com.apple.xpc.launchd[1] (nextdns): This service is defined to be constantly running and is inherently inefficient.

This is all I can dig up from the system logs. It's very consistent that I have to deactivate/uninstall then reinstall/re-activate and DNS lookups work fine.

[rs]

Both issues should be fixed with 1.3.0 (captive portal and out of sleep issue). Please reopen if not the case.

[ChrisColotti]

Not re-opeing just feedback that after waking up mac today the client was online right away. I do believe there is underlying Catalina Captive portal issues (not related to this client) that are documented elsewhere. I will also test on a different mac that does not have Catalina, but great work and happy to continue helping better the product.

[rs]

I tested it on Catalina, so if it does not work, I'm interested to know more.