No, I don’t run a firewall. It’s their own firewall that blocks their own landing page where I would see an “accept terms” prompt.

A difference my phone has from a usual setup is that I replaced the http://connectivitycheck.android.com/ ping address with 127.0.0.1 (which never fails so my phone does not complain about “limited” networks). A side effect is that I have to go to http://neverssl.com/ or another HTTP-only page in my browser to show captive portals. This is why the right screenshot is in Firefox, not WebView.