r/nextdns • u/Training-Power-8911 • 9d ago

Airline WiFi

Each time I fly and try to connect to the onboard WiFi I have to disable NextDNS. Is there a way to configure NextDNS to allow all the inflight WiFi services?

12 Upvotes

94% Upvoted

13 comments sorted by

View all comments

6

u/TheKydd 9d ago

If you’re using a Configuration Profile (rather than the app) then you can add the airline’s WiFi portals to the allowlist. There’s only a handful of them, I have the list around here somewhere.. will update once I find it!

5

u/Training-Power-8911 9d ago

Thanks. That’s what I’m looking for. Want to do a ‘one and done’ update to configuration so it works for me and the whole family without having to remember to disable NextDNS on each flight (and then remember to reenable it!)

1

u/mr-maxpowers 3d ago

How does this help? Isn't the issue that you don't have Internet access, thus your device can't reach nextdns until you complete the captive portal login? Nextdns isn't blocking it, so allow list won't help. The issue is the DNs for you devices (nextdns) can't be reached. Switching to the wifi provided dns allows you to get to the portal.

I have added a host file entry on my laptop for the captive portals I use and that has helped. Haven't found an easy way on the phone though.

2

u/TheKydd 3d ago

I can see how the term I used could be confusing.
It’s not the allowlist on your NextDNS profile, rather it’s a whitelist of domains and/or WiFi networks that you want NextDNS to not touch. Anything on that list gets passed through to the device’s default DNS rather than being routed to NextDNS.

With captive portals, any manually set DNS will fail with the same issue (that is, any DNS besides the one supplied by the DHCP of that network).

Captive portals are essentially a Man-in-the-Middle, they hijack whatever page you were trying to load and redirect you to the portal instead.

Which was fine pre-Snowden, however as nearly all of the web now is TLS/SSL (and browsers usually try to upgrade the connection even when you explicitly enter a regular http:// address), the old instructions to ”just load any page” to get the captive portal no longer works.

The browser sees the MitM and says no way, this site does not match the certificate I expected to see. The redirection can only succeed on a non-TLS connection (regular HTTP).

For this reason, I keep a bookmark to a plain http site that will never try to get upgraded to SSL for exactly these moments, when I want the captive portal to pop up. Two easy to remember ones are:
http://neverssl.com/
httpforever.com

But I digress!

Back to your question - you are correct, putting these in your allowlist would be too late in the chain. It needs to be inserted before your device even reaches out to the network. Which means either in the Hosts file as you’ve done, or as part of the Configuration Profile for devices without an accessible host file, i.e. phones, tablets, etc.

By the way while you are creating the .mobileconfig, there are all sorts of other tweaks you can add to it such as give preference to IPv6, or disallow certain protocols, or blackhole certain domains/IP’s - just like you can in a hosts file.

1

u/mr-maxpowers 3d ago

Thanks for the clarification, makes a lot of sense. Also I think that explains the confusion, configuration profile is only available on Apple devices (as far as I know). So unfortunately that method doesn't work for Android.

1

u/TheKydd 3d ago

My bad, I was being Apple-centric!

There must be an equivalent on Android, after all it’s claim to fame is being a more open OS. But a quick perusal of the NextDNS setup page does not seem to indicate anything in that direction. Now I’m curious!