Articles


2013-01-09: DD-WRT and annoying Windows Security prompts?

     

Every time you open a browser window or access the internet, or reboot your machine, you have to click "CANCEL" about 3 times consecutively or log in with your DD-WRT router password. You might have allowed your computer to "Remember my credentials" but then the other people on your network probably don't have that option and they have to click cancel multiple times. Chances are someone is being annoyed, how would you like to put a stop to this prompt?

The problem is that windows is looking for your network-doamin/wpad.pac file for Windows Automatic Network Settings Detection which (powered by the Web Proxy Auto Discovery Protocol), if the network domain resolves to the DD-WRT router address then the router requires credentials to access it's http and https resources; with the possible exception of the router status page. That is why you get the 3 login prompts upon trying to access the internet and then it goes away for a while; windows will try 3 times and before it can fail it must ask for a password for a protected recourse even if it does not know it is there.

To make the security prompt go away once and for all on just machine that uses a direct connection, do the following.
START > Control Panel (Classic View) > Internet Options > Connections Tab > LAN Settings > Un-check "Automatically detect settings"

Afterwords Web Proxy Auto Discovery Protocol will no longer be used and create these prompts. You will have to set each and every machine or device on your network to always use a Direct Connection manually.

To make this work for all machines and devices on your network automatically.


1) Log in to your router.
2) Navigate to the Services TAB.
3) Specify the following "Additional DHCPd Options"
option local-pac-server code 252 = text;
option local-pac-server "http://127.0.0.1/wpad.pac";
4) Specify the following "Additional DNSMasq Options"
dhcp-option=252,http://127.0.0.1/wpad.dat
5) Apply Settings.
6) It is probably a good idea to reboot router, then devices.

This will cover you both ways if you use regular DHCP Server or if you use DNSMasq. In my configuration I use DNSMasq with options (DNSMasq, Local DNS, No DNS Rebind) enabled.

What this effectively does is set the address of the wpad.pac file to localhost where it will quickly fail without the need for authenticating prior to failure and default to direct internet connection.

Hope this helps.