Commuting to work becomes a torture when, instead of useful information or entertainment, you're forced to see invasive banners every time you connect to the internet. Public hotspots in the subway often use the system. captive portal, which forcibly redirects user traffic to the authorization page. It's there, in addition to the login form, that huge ad blocks typically appear, obscuring the content.
Many users mistakenly believe this is an integral part of free internet access, but there are technically several ways to bypass or block intrusive content. You don't need to be a hacker to do this; it's enough to know how network protocols work and what settings your smartphone hides.
In this article, we'll explore proven methods to help you eliminate visual noise. We'll cover operating system capabilities, the use of specialized DNS servers, and browser settings that can help you bypass forced authorization systems.
The nature of intrusive advertising on public networks
The mechanism for advertising in the metro is based on technology Captive Portal DetectionWhen your device connects to Wi-Fi, it sends a test request to the server to verify that it has real internet access. The network operator intercepts this request and redirects you to their authentication gateway.
It is on this gateway that it is located advertising contentThis is done to monetize traffic, as providing free internet requires equipment and communication channels. Advertisers pay to "capture" the user's attention while they wait for a connection.
Technically, this process looks like DNS spoofing or HTTP redirection. Until you log in (even just by clicking "Login"), all your traffic will be filtered by your service provider.
It's important to understand that you can't completely disable the login page itself from your provider, as it's part of the authorization protocol. However, you can minimize the time it displays or block advertising elements from loading on the page itself.
Using DNS to block ads
One of the most effective and secure ways to combat ads is to change the DNS server on your device. DNS (Domain Name System) acts like the internet's phone book, translating website names into IP addresses. Using a public DNS with filtering functionality will simply block requests to ad servers.
For Android and iOS, there are verified addresses that block trackers and advertising domains. For example, servers AdGuard DNS or DNS-over-HTTPS Cloudflare can significantly clean up your traffic. Android settings (starting with version 9) have a separate "Private DNS" field.
- 🔹 Enter the address
dns.adguard.comin the private DNS settings field for automatic filtering. - 🔹 Use the server
1dot1dot1dot1.cloudflare-dns.comfor speed and basic protection. - 🔹 Set up DNS in the Personal DNS app (for Android) or via a configuration profile (for iOS).
This method doesn't always remove the captive portal itself, as it's often located on the provider's local IP address. However, it does eliminate the loading of external advertising banners, videos, and trackers within this page or immediately after logging in.
Why doesn't DNS always work in the metro?
Telecom operators sometimes forcibly redirect all DNS requests to their servers (DNS hijacking), ignoring your device's settings. In such cases, only browser-level methods or a VPN can help.
It's worth noting that using third-party DNS may slightly impact network response times, but for browsing news and messaging apps on the subway, this impact is unnoticeable. The main advantage is eliminating the need to install questionable apps.
Configuring browsers and blockers
If system settings seem complicated, you can take advantage of the capabilities of modern mobile browsers. Many of them have built-in anti-tracking and ad-blocking mechanisms that work even when connected to public Wi-Fi networks.
It is recommended to use browsers that support extensions or have a built-in blocking engine, such as Brave, Firefox (with addons) or Samsung InternetThey allow you to block page elements, including advertising iframes and scripts.
In the browser settings Firefox You can install an add-on for Android uBlock OriginThis is a powerful tool that removes ads at the page code level. Even if the Metro login page loads, the ad units will be empty.
It's also worth paying attention to the "Data Saver" mode in some browsers (for example, Opera or Chrome in the past). It routes traffic through its own servers, which can filter content, although in the case of a captive portal, this can cause connection errors.
Android and iOS system settings
Operating systems provide tools for managing network connections that can help combat intrusive content. Specifically, these include the "Private DNS" feature in Android and the "Data Protection" feature in iOS.
In iOS the function Private Relay (available with an iCloud+ subscription) hides your IP address and encrypts traffic in Safari, which can also prevent ISP ads. However, for basic protection, simply enable "Tracking Protection" in the Wi-Fi settings for your specific network.
On Android, you can use the "Restrict background data" feature for the browser or Google system services that frequently initiate network checks. This will prevent the automatic login prompt from appearing when you unlock the screen.
☑️ Check your privacy settings
Please remember that aggressive advertising networks can exploit vulnerabilities in older OS versions. Therefore updating the operating system to the latest version is a critical step in closing security holes.
Using VPN services
Virtual private networks (VPNs) create an encrypted tunnel between your device and an internet server. This means the subway Wi-Fi provider only sees the encrypted data stream and can't alter its content or redirect you to an advertising page after logging in.
There's a catch, though: to establish a VPN connection, you first need to log in to the Metro network. This means you'll still see the "first ad" when you log in. But once you connect to the VPN, all subsequent requests will be protected.
There are VPN services with an "Always On" feature that attempt to maintain a connection at all times. Combined with obfuscation, these can help hide the fact that you're using a VPN from your network operator if they try to block such protocols.
| Method | Efficiency | Complexity | Impact on speed |
|---|---|---|---|
| Private DNS | High | Low | Minimum |
| Browser with a blocker | Average | Low | Absent |
| VPN tunnel | Maximum | Average | Decrease in speed |
| Manual authorization | Low | Low | Absent |
It's important to choose trusted VPN services, as free options may sell your data or inject their own advertising, which negates all your privacy efforts.
Alternative methods and bypassing restrictions
Sometimes standard methods don't work due to hard settings on your operator's network equipment. In such cases, you can try changing User-Agent your device. Some networks respond differently to requests from desktop and mobile devices, and changing the identifier can help avoid redirection to the mobile version of the portal with ads.
Another method is to use proxy servers. Setting up a proxy in your Wi-Fi connection (in the advanced network settings) will route traffic through a third-party server. However, modern captive portals often block such connections until authorization is complete.
⚠️ Attention: MAC address randomization is now enabled by default on Android and iOS to protect privacy. Some older Metro login systems may not work correctly with a changing MAC address, requiring a re-login. Try disabling randomization for a specific network if you're experiencing connection issues.
It is also worth mentioning the existence of specialized automation applications, such as WiFi Automatic or scripts for TaskerThey can automatically log into the network (if possible without captcha) or launch the VPN immediately upon detecting a familiar subway network SSID.
Data security on public networks
While we're fighting advertising, we can't forget about security. Public Wi-Fi networks, even official subway networks, are high-risk areas. Attackers can create access points with similar names (Evil Twin) to intercept your data.
Using HTTPS (a secure connection) is now the standard, and most websites use it by default. This means that even if you're connected to open Wi-Fi, the contents of your messages and passwords are encrypted. However, metadata (which websites you visit) remains visible.
Always ensure that you are connecting to the operator's official network. Avoid entering banking information or passwords for important services immediately after connecting until you are sure the connection is secure.
⚠️ Attention: If your browser displays a warning about "Insecure Connection" or certificate errors when connecting to Metro Wi-Fi, don't ignore it. This could indicate an attempt to intercept your traffic.
Regularly checking your smartphone's security settings and avoiding using open networks for critical operations is the best defense. Remember, the convenience of free internet shouldn't compromise your digital security.
Why do ads appear every time I connect, even if I've already logged in?
This is due to the session expiration. Carriers limit the time of uninterrupted connection or reset the session when changing towers (in the case of mobile internet) or access points. The timer can also reset if the phone screen is locked for an extended period of time.
Are free ad blocking apps safe to use?
Use with caution. Many free apps monetize by collecting user data or displaying their own ads. It's best to use proven open-source solutions, paid versions of well-known services, or system DNS settings.
Can the metro operator block my phone for using blockers?
Technically, blocking a device by MAC address is possible, but in practice, this is rarely used in large metro systems, usually only for traffic abuse (DDoS attacks, torrent downloads). The use of DNS or browser blockers typically goes undetected by the filtering system.
Do these methods work for Wi-Fi on buses and trams?
Yes, the captive portal operates similarly across all modes of public transport. However, on moving vehicles, the connection is less stable, and frequent reconnections may require re-authorization more frequently, regardless of advertising settings.
Do I have to pay to disable ads in official Metro apps?
Some operators offer paid plans called "No Extra Buzz" or "Premium," which remove banners and provide priority network access. This is a legal option, supported by the provider itself, if you don't want to bother with technical settings.