Case Studies案例研究 / Latest Case最新案例 A Game Console That Could Not Log In to the Building's WiFi: One Router That Signs In Once and Shares It (Shared Building Network, Darling Square)
游戏机过不了公寓网络的认证页：让一台路由器认证一次，剩下的设备一起用（集体网络，Darling Square）
On-site · Darling Square, Sydney City上门 · 悉尼City Darling SquareBuilding-supplied shared network公寓提供的集体网络Captive portal login on every device每台设备都要过网页认证Game console cannot authenticate游戏机无法完成认证One working wall port, 100 Mbps一个可用墙口，实测100兆OpenWRT router authenticates onceOpenWRT软路由认证一次
Shared building internet with a login page is fine right up to the moment you own something without a screen and a keyboard. A games console, a smart TV, a printer, a NAS — none of them can open a web page and type a code, so the network treats them as if they had never asked. The fix is not to argue with the portal. It is to put one device in front of it that can log in, and let everything else sit behind that device.
带网页认证的公寓集体网络，在你拥有第一台没有屏幕和键盘的设备之前，都还算好用。游戏机、智能电视、打印机、NAS——它们没有一个能打开一个网页、敲进一串验证码，于是网络就当它们从来没来过。解决办法不是去和那个认证页较劲，而是在它前面放一台能完成登录的设备，让其余所有东西都待在这台设备后面。
Why the console was never going to connect on its own
为什么游戏机自己永远连不上
A captive portal works by letting a device onto the network and then intercepting its web traffic until it has been through a login page. That design quietly assumes every device on the network is a thing with a browser, a screen and someone typing on it.
Plenty of devices are not. A games console, a smart TV, a printer, a streaming stick, a NAS — they connect, they wait to be let out, and nothing ever lets them out. From the user's side it looks like the console cannot connect. In fact it connected fine and is sitting behind a door it has no hand to open.
Recognising this is most of the work. Once you know the fault is the gate rather than the link, you stop trying to fix the console and start looking for something that can do the signing in on its behalf.
网页认证（captive portal）的工作方式，是先让设备接入网络，然后拦住它的网页流量，直到它走完一次登录页面。这个设计默默地假设了：网络上的每台设备，都是一个有浏览器、有屏幕、并且有人在旁边打字的东西。
可有很多设备不是。游戏机、智能电视、打印机、电视棒、NAS——它们连上了，等着被放行，然后永远没有人放行它们。从用户这边看，就是「游戏机连不上」。实际上它连得好好的，只是被关在一扇它没有手去开的门后面。
把这一点认出来，这一单的活就干了一大半。一旦你知道问题在闸门而不在链路，你就不会再去折腾游戏机，而是开始找一个能替它去登录的东西。
Where the console was getting stopped游戏机是在哪一步被拦下来的
Building network公寓集体网络
available / 可用
→
Wall port in the room房间墙内网口
1 of 2 works / 两个口只有一个能用
→
Captive portal login网页认证登录
needs a browser / 需要浏览器
Blocked here卡在这里
→
Game console游戏机
no way to log in / 无法完成登录
Nothing here is broken and nothing is slow. The console reaches the network perfectly well and is then held at a web page it has no way to display. This is a category of fault that no amount of restarting, re-cabling or speed testing will touch, because the link is fine and the gate is the problem.这里没有任何东西是坏的，也没有任何东西慢。游戏机能好好地连到网络，然后被拦在一个它根本没办法显示的网页前面。这一类故障，重启多少次、换多少根线、测多少遍速度都不会有任何变化——因为链路本身是好的，问题出在那道闸门上。
Why a switch does not help, and why MAC cloning is a gamble
为什么交换机不管用，以及为什么复制MAC是在赌
A switch was the customer's first instinct and it is the wrong tool, for a reason worth stating plainly: a switch has no identity on the network and signs in to nothing. Everything you plug into it still arrives at the portal as itself, and still gets stopped. Splitting one port into four does not get you past a login page.
The second idea — putting an ordinary router in and having it copy the MAC address of a device that has already authenticated — is a real technique and does work in some places. But it is borrowing an identity rather than holding one, and buildings that care about who is on their network often have checks that make it unreliable. We did not want to hand over a setup that might quietly stop working a week later.
So the criterion became: whatever we install has to be capable of going through the login itself, on its own terms, and staying authenticated.
客户第一反应是加个交换机，这是选错了工具，原因值得直说：交换机在网络上没有自己的身份，也不会去登录任何东西。插在它上面的所有设备，到了认证页面还是以自己的身份出现，还是一样被拦。把一个口分成四个，并不能帮你过一道登录页。
第二个思路——放一台普通路由器，让它复制一台已经认证过的设备的 MAC 地址——是真实存在的做法，在某些地方确实有效。但那是借身份，不是自己有身份，而在意「谁在用我这张网」的公寓，往往有相应的校验机制，让这条路变得不可靠。我们不想交付一套一周之后可能悄无声息就失效的方案。
于是判断标准就变成了：装上去的东西，必须能自己走完那道登录、并且保持在已认证状态。
Three ways to get a console past a login page让游戏机绕过认证页的三条路
| Plain switch普通交换机 | MAC cloning on a normal router普通路由器复制MAC | OpenWRT router (what we used)OpenWRT软路由（本次采用） |
|---|
| Can it complete the login?它能不能自己完成登录？ | No — it just passes traffic不能，它只是转发 | No — it borrows an identity不能，它是借用身份 | Yes — it signs in itself能，它自己登录 |
| Reliability in a managed building在有管理的楼里可靠吗 | Fails outright直接不行 | Uncertain — some buildings check不确定，部分公寓有校验机制 | Works within the portal's own rules按认证机制本身的规则走 |
| How often you authenticate要认证几次 | Every device, every time每台设备每次都要 | Once, for the borrowed identity一次，针对被借用的那台 | Once, for the router一次，针对路由器 |
| Devices with no browser没有浏览器的设备 | Still stuck照样过不去 | May work可能可以 | Work over WiFi and cable无线和有线都能用 |
| What it takes to set up上手成本 | Nothing没有 | A little configuration需要一点配置 | More configuration up front前期配置更多一些 |
One login, then everything behind it
认证一次，后面的设备全都跟着用
An OpenWRT router meets that criterion because it can be configured to handle the portal authentication itself rather than passing it through to whatever is plugged in behind. Once it is signed in, it is the network's authenticated client, and everything downstream of it — the console over a cable, the desktop over a cable, phones and laptops over its WiFi — simply uses that connection.
The practical difference in daily life is larger than the technical description suggests. Before: every device, every time, someone has to find the login page. After: nothing ever sees a login page again except the router, and the router does it without being asked.
We brought several routers to site and tested until the configuration held, which is the honest way to describe this kind of job — portals differ from building to building, and the only proof that a setup works is that it is still working after you have connected everything to it.
OpenWRT 软路由符合这个标准，因为它可以被配置成由自己去完成那道认证，而不是把认证页原样丢给插在它后面的设备。一旦它登录成功，它就是这张网上那个已认证的客户端，而它下游的所有东西——有线接上的游戏机、有线接上的台式机、连它无线的手机和笔记本——直接用这条连接就行。
这在日常使用上的差别，比技术描述听起来的要大得多。改造前：每台设备、每一次，都得有人去把那个登录页找出来。改造后：除了路由器，再没有任何设备会看到登录页，而路由器不用人催就自己做了。
我们现场带了几款路由器逐一测试，直到配置稳定为止——这是对这类活最诚实的描述：各栋楼的认证机制并不一样，一套方案能不能用，唯一的证明是把所有设备都接上去之后它还在正常工作。
How the visit ran这次上门的顺序
1
Established what the network actually is先弄清楚这到底是一张什么网
Shared building network with web login公寓集体网络，带网页认证
2
Checked the room's wall ports检查房间里的墙内网口
Two ports, one live, tested 100 Mbps两个口，一个可用，实测100兆
3
Confirmed the console cannot authenticate确认游戏机无法完成认证
No way to reach the login page没有办法打开认证页面
4
Ruled out a plain switch排除普通交换机方案
It cannot sign in to anything它不会登录任何东西
5
Weighed MAC cloning on an ordinary router评估用普通路由器复制MAC
Unreliable where the building checks楼里有校验时不可靠
6
Set up an OpenWRT router to do the login改用OpenWRT软路由完成认证
Router authenticates, then shares路由器先认证，再分享
7
Tested with several routers on site现场带了几款路由器逐一测试
Settled on the working configuration确定最终可行的配置
8
Verified console, desktop and wireless验证游戏机、台式机和无线
All stable at 100 Mbps都稳定在100兆
About that 100 Mbps, and the dead second port
关于那个100兆，以及那个不通的第二个网口
Two smaller findings are worth recording. The room has two wall ports and only one of them is live — common in apartments, where not every faceplate is patched through at the other end, and not something a tenant can change. Worth testing both on day one so you know which one to build around.
And the speed sits at 100 Mbps on both wired and wireless testing, which we confirmed is the port itself rather than anything we installed. On a shared building network that ceiling is what it is; the router in front of it does not lower it, and no router will raise it. What changed here was not speed, it was whether the devices could get on at all.
另外两个小发现值得记下来。房间有两个墙内网口，只有一个是通的——这在公寓里很常见，不是每一个面板在另一端都接了线，而这也不是租客能改的事。值得在第一天就把两个口都测一遍，好知道该围着哪一个做规划。
另外，有线和无线测速都停在 100 兆，我们确认这是网口本身的限速，不是我们装的东西造成的。在一张集体网络上，这个上限就是这个上限；放在它前面的路由器不会把它压低，任何路由器也不会把它抬高。这一单改变的不是速度，而是那些设备到底能不能上网这件事。
What to take from this one
这一单值得记住的几点
- If your building's internet needs a code on a web page, check before you move in how devices without a screen are meant to connect. Often the answer is that they are not.
- A switch will not get you past a login page. It has no identity of its own and signs in to nothing.
- Borrowing an authenticated device's identity works in some buildings and fails in others. Do not build on it if the building actively manages its network.
- A router that can complete the portal login itself turns "every device, every time" into "once, by the router".
- Test every wall port in the room on day one. Half of them being dead is normal, and you want to know which half.
- If you are living somewhere with a shared or authenticated network, a travel router or soft router is worth owning before you need it.
- 如果你楼里的网要在网页上输验证码，搬进去之前就该问清楚：没有屏幕的设备该怎么连。答案往往是「没法连」。
- 交换机过不了认证页。它自己没有身份，也不会去登录任何东西。
- 借用已认证设备的身份，在有些楼里能用、有些楼里不行。楼里在主动管这张网的话，别把方案建在这上面。
- 一台能自己完成认证的路由器，把「每台设备每次都要认证」变成「路由器认证一次」。
- 第一天就把房间里每个墙口都测一遍。有一半不通是常态，你要知道是哪一半。
- 如果你住在集体网络或需要认证的地方，一台旅行路由器或软路由值得在你需要它之前就先备着。
Result最终结果
The OpenWRT router now completes the building's portal login itself and shares the connection over both its WiFi and its LAN ports, so the game console and the desktop go online by cable with nothing to authenticate and phones and laptops join its wireless normally. Wired and wireless both test steady at 100 Mbps, which we confirmed is the wall port's own limit rather than anything introduced by the setup.
现在由这台 OpenWRT 软路由自己完成公寓网络的认证，并通过它的无线和网口把连接分享出去——游戏机和台式机插网线直接上网，不需要认证任何东西，手机和笔记本正常连它的 WiFi。有线和无线测速都稳定在 100 兆，我们已确认这是墙内网口本身的限速，不是这套方案引入的。