I know that captive portals depend on DNS and that could be the reason that all traffic goes through router. It controls that user would be authorized to go to the Internet, it doesn't resolved any domain name unless you're authenticated. If we open our DNS server to hotspot users there won't be anything that stops them from using Internet free of charge. They don't need to be authenticated. We break the idea of a captive portal or am I incorret?
As for me.... Hm, let's say I'm an advanced user, but administrating networks isn't my area of expertise. I understands some basics, but analyzing traffic.... I'm out of my depth.
What should I do? Is there any magical tools for hacking networks? Please share your baggage of knowledge with me. I appreciate your help.
Ah. I see. You're trying to configure something fairly complex without understanding how it works for many many hours of frustration fun. The classic "glutton for punishment." :-)
I originally thought you wanted your hotspot clients to be able to query your internal DNS server. Now I believe you want it to be conditional (I think).
Unfortunately, I haven't worked on hotspots, captive portals, or walled gardens in quite a few years, so I'm pretty rusty and won't be much help. On the other hand, I analyze packet captures all the time, so that's easy. Depending on the hotspot client OS you have, you can use tcpdump in *nix, or Wireshark in Windows. On the router, you can navigate to Tools > Packet Sniffer (I'm assuming GUI), then set the interface you would like to capture on and any filters. I always set a filename on the general tab there so captured packets are written to a file. Then you can copy the file to your tech PC and view it in Wireshark.
Once you have packet captures, you're looking for where the client is sending the DNS queries, where the router is sending them, and then what, if anything, is replying to the DNS queries.
Good luck. Soon you'll be much more than an "advanced user."
