Hotspot, walled garden deny action

RouterOS General
1

Hi to all,

I have a small problem, maybe somebody can help solve it. I’m running a hotspot service and for 3d secure credit card payment reasons I must have port 443 open for all hosts.
But, I don’t want to enable access to secure webmail services (gmail, yahoo…) without authorization.

I’ve created following walled garden rules:
/ip hotspot walled-garden
add action=deny comment=“” disabled=no dst-host=mail.google.com dst-port=443 path=*
add action=deny comment=“” disabled=no dst-host=yahoo.com dst-port=443 path=
add action=allow comment=“” disabled=no dst-port=443 path=*
When user connects with target http://www.somehost.com/ he is redirected to login page, that’s ok!
But, when user connects to https://mail.google.com/, he just gets error page, he is not redirected to login page :frowning: .

Is there any way how to resolve this, ie, to redirect user to login page when he asks for https://mail.google.com/ ?

Thanks,

Petar

2

Petar,
I’ve come accross this one as well with the new security model for facebook.com. After reading the relevant RFCs from the IETF on HTTS and SSL we have found that redirections are not supported in HTTPS. Redirection is used - i.e. HTTP responce 302 temprarily moved - by the login page to get the user to it.

Tom