Hey @cmr - I know this is somewhat old but I'm actually possibly running into this issue myself using OPTION 2 and what I believe are possibly older iPhone devices. It's a hit or miss situation, sometimes they struggle, most of the times clients don't. Again I suspect it's just old iOS devices. What list did you end up putting in? I did a pcap with an old and new iPad but both seem to be showing similar resolutions for DNS queries prior to clicking the accept button to get past the walled garden.   captive.apple.com captive-cidr.origin-apple.com.akadns.net captive-cdn.origin-apple.com.akadns.net captive.g.aaplimg.com ... View more

It is indeed possible to logout a user from splash.   If you use "Sign-on with SMS Authentication", you can only do this via dashboard. If you use "Click-through", this is network-auth.com, you can revoke a client via API.     Let me know if you need help implementing this.      ... View more

The API may work here, but something to consider. The API changes and in all honesty breaks certain times. My trust level with that in this situation would be kind of low. You are looking for more of a set it and forget it solution. In that case I would use the logoff url from the whitepaper to test. Then in a windows logoff script have it visit that page or on a scheduled interval (60mins) ... View more