I am interested in captive portal architecture. Initially my understanding was that places such as airports and internet cafes would have all the RADIUS and AAA infrastructure on the local side of the firewall. After looking at WISP (wireless internet service provider) models, my initial ideas seemed wrong. Even if a company offers several different public wifi hotspots, would they still potentially keep the AAA server, captive portal web server and RADIUS internals on the local side of the firewall?
If they kept the RADIUS and AAA servers centralised, would they connect to this via a VPN from the firewall and have a non-VPN out onto the internet for after the users have been authenticated?
I am just trying to understand a general architecture for public wifi.