DNS resolution not functioning - the clients on the captive portal interface must either be using the DNS forwarder on pfSense, on the IP of the interface where the client resides (which is the default configuration), or if using some other IP for DNS, it must be an allowed IP entry. If DNS fails, the browser never issues the HTTP request, hence it cannot be intercepted and redirected.
Para que se cumpla esto, lo más simple es que los clientes tomen su IP con el DHCP de pfSense y que, a su vez, pfSense sea su servidor DNS. Verifica la configuración IP otorgada a tus clientes mediante comandos:
Linux
ifconfig
nmcli dev list iface eth0 | grep IP4
nm-tool
Windows
ipconfig /all
Firewall rules on the captive portal interface do not allow the initial HTTP request - if the user is trying to browse to google.com, but you're not allowing HTTP to google.com, the HTTP request will be blocked and hence cannot be redirected. Under Firewall>Rules, on the interface where captive portal is enabled, you must be allowing the traffic that you want to be redirected (most commonly HTTP to any destination).
Tus reglas deben permitir el tráfico http. Deshabilita el portal cautivo y prueba que sea así.
