Why doesn't Windows make requests to msftconnect Captive Portal?

Question

Windows

I'm trying to build a Captive Portal on the local network without raising an access point.
I restrict access to the Internet, traffic does not pass, I allowed access to port 80.53. According to the logic of Microsoft NCSI, Windows should make a request to msftconnecttest.com, and without receiving the content, call the portal. The notification about entering the network comes out only in the Firefox browser, because I redirect all dns requests to my server. For some reason, the OS itself thinks that there is access to the Internet.
iptables rules

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.0.2:80
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination 192.168.0.2:53
iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT --to-destination 192.168.0.2:53
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -A FORWARD -i wlan0 -j DROP

Answer 1

NCSI for corporate and consumer versions of WIndows 10 is different. Make sure your requests are going exactly where you think they are.
You can do this, for example, by installing Wireshark on Windows itself or a linux router to capture traffic and analyze it.