Captive Portal

Just me, or Plus 26.03 stopped 'sys logging' ?

Gertjan — Tue, 21 Apr 2026 12:40:42 GMT

@marcosm Applied

Enter TV MAC address on CP login in page?

Adamzsite — Fri, 10 Apr 2026 12:36:44 GMT

@johnpoz Sorry didn't exsplain myself im not using ppsk at the moment I trying to get it to work, then i can turn captive portal off. I was wondering if anyone has setup ppsk with tunnel-passcode as the login in freeradius and openwrt APs?

Called-Station-Id attribute [feature request]

yanqian — Mon, 02 Mar 2026 09:54:09 GMT

Got it, thank you for the response. I added the feature request #16734.

Is it possible to create a multi-page custom captive portal?

Gertjan — Thu, 05 Feb 2026 17:12:39 GMT

@scilek said in Is it possible to create a multi-page custom captive portal?: However, there's a missing component: the PHP PDO library, which I believe should be included in the default installation A 'default pfSense' doesn't use SQL. If you need SQL yourself, all you have to do is : said in Is it possible to create a multi-page custom captive portal?: Note : Just install (don't need to set it up) the pfSense FreeRadius package, and you have the MySQL client PHP part installed as a bonus. @scilek said in Is it possible to create a multi-page custom captive portal?: the person that asked me to concoct the custom CP to obtain a DNS name I have the PHP PDO library : [image: 1770622043000-9f66c3f2-fb12-4d0a-bbc8-ff1878fc65f2-image.png] If you recap everything I've said above : There is an investment to make : a portal network which includes dedicated switch(es) and access points, and a domain name to rent. @scilek said in Is it possible to create a multi-page custom captive portal?: Also, the only information that is asked is the mobile phone number, which I think shouldn't be an issue. I agree with you. A potential portal visitor has now the choice : He uses its own phone's monthly 'data' from his phone company. Or, against the phone number, (so, example, she/he can receive an SMS with an portal access 'user and password ?!) he can use the portal.

The login page no longer appears.

patbol — Thu, 29 Jan 2026 13:34:44 GMT

Thank you for all these answers. We will look into this more closely.

NSLOOKUP behavior when utilizing Captive Portal

Gertjan — Sat, 17 Jan 2026 19:27:47 GMT

@mpeterson0418 Be assured : my pfSense GUI is also only accessible from only the 'main' LAN, and not from the other non-trusted LANs which is a captive portal (I've a hotel here, that's worlds most none-trusted collection of network users ^^) and another LAN with 'other' stuff I don't trust like cameras and other "worse then Temu and Aliexpress"' combined stuff.

Tracking User Interactions in Google Analytics for a Website Opened via an iFrame from a Captive Portal

Gertjan — Fri, 21 Nov 2025 14:05:20 GMT

@_malek said in Tracking User Interactions in Google Analytics for a Website Opened via an iFrame from a Captive Portal: I added all required URLs (including google-analytics.com) to the Allowed Hostnames, Google Analytics still doesn't record any events When you add "Allowed Hostname" to the portal, a DNS lookup is performed and an ( 1 !! ) IPv4 is rteurn so the pf firewall can filter to 'allow'. Remember : a firewall can ='can't filter hos names. Just "IP addresses" (see for yourself : [what is in an Ethernet packet header]( what is in an Ethernet packet header)). Gues what : "Google Analytics" isn't one IPv4 - it changes all the time, as that site (service) is used by billions any moment thousands of times per second (everybody want to do Google Analytics for some reason) so the load is DNS pre distributed / balanced over a lot of (major understatement) IPv4 addresses. https://docs.netgate.com/pfsense/en/latest/captiveportal/allowed-hostnames.html : [image: 1763986053001-41301874-d0e5-4a18-a5fe-8d55e22431f6-image.png] If you manage to get them all, and you add all the possible IPv4s to the "Allowed IP Addresses" list, it might work.

Skip captive portal for static ARP

Gertjan — Fri, 21 Nov 2025 09:21:09 GMT

@paulatz said in Skip captive portal for static ARP: some documentation Euh, it's open source. So everything you need to know is already there. No one ever wrote a book, guide or manual about these millions of lines of 'script'. If you know what 'PHP' is : ssh into your pfSense and start to discover. this will take you some time ;) If you want write scripts for a system, you have to know (some what) that system.

pfSsh.php playback pfanchordrill (when portal is active)

marcosm — Thu, 20 Nov 2025 14:48:01 GMT

The pfctl error is already resolved upstream (and in 26.03).

Captive Portal DB Issue (Active Users VS Active Vouchers )

wazim4u — Sat, 15 Nov 2025 13:08:03 GMT

@EDaleH Thanks for your input on this matter. This issue is not related to the DHCP server, especially KEA DHCP. We are still on pfSense 2.6 as mentioned, so ISC DHCP is in use, and there are no lease problems. Lease times are already configured correctly. The core reason that @Gertjan pointed out is correct and seems to be the right direction to get this resolved. It doesn’t affect everyone, but systems under heavy load during peak hours are the ones that usually run into it. The issue is a race condition under load. If the pruning process takes a long time to enumerate and remove old entries, and a new session or disconnection occurs, or if the process is interrupted or times out, the lock file may remain or the process might not finish its database write cleanly. This can leave the system in a partial state where the voucher record is removed but the session is still present. I also believe this issue also exists in pfSense+ since the captive portal code is same in the areas related to this behavior.

captive portal page with only voucher login

Gertjan — Sun, 02 Nov 2025 19:26:38 GMT

@Balooshy said in captive portal page with only voucher login: there is any way to make the page with only voucher authentication without using custom portal page? Short answer : no. You don't want this : [image: 1762158273441-57565a19-49ba-4083-b5cc-0c267c6de242-image.png] You don't want the User and Password fields to be shown. Info : I use Firefox. When I see this page, I hit Ctrl-U and then I see the 'source' of the page : [image: 1762158477799-3bb1e934-bf62-443f-8361-4b6e6c173c0b-image.png] Copy paste this file in an editor like Notepad++. Remove these two lines : and
Save the 'html' file. In pfSense, check this button : [image: 1762158665190-ebb231af-8803-4798-9a54-89eb058ad92b-image.png] and upload your file here : [image: 1762158695260-d86d5757-b891-46d4-8505-7ac0a39e1871-image.png] and Save.

Captive Portal with Google Workspace and Browsing Logs

Gertjan — Sat, 27 Sep 2025 11:01:17 GMT

@leonida368 pfSense has a captive portal which allows you to control who and how a pfSense LAN (the portal network) is accessed. This can be done with or without login credentials. A LDAP or (Free)Radius access, or ordinary pfSense users can be used. pfSense has no notion what so ever of what "Google Workspace" is. Look at these forum messages. Btw : IP addresses : these are the logged in devices. As pfSense gave these RFC1918, they are known. Device MAC addresses, these are know and logged by pfSense, but are normally randomized by every device. Traffic - Ethernet packets, can be logged, so you'll know the destination IP, the web site the portal user have visited. You will not be able to see 'what they did there'. You could use Traffic Monitoring tools, or IDS/IPS although the latter won't show much, as all traffic is encrypted (remember : https = TLS) these days.

Captive Portal: Restrict Ports for Allowed IP Address?

Gertjan — Sat, 30 Aug 2025 09:13:30 GMT

@rds25 said in Captive Portal: Restrict Ports for Allowed IP Address?: As far as I understand, IPs listed under "Allowed IP Addresses" completely bypass the rules defined in the "PORTAL" tab. That's what I initially also thought. This is the portal rule that blocks all portal-to-LAN IPv4 traffic : [image: 1756797401971-c9aa3733-1739-40f8-b7cf-757f4f3abb37-image.png] I connected my phone to the portal, it got 192.168.2.10, and then I started to send ICMP packets to 192.168.1.33. While doing so, I was packet capturing on my portal interface for ICMP traffic, send by 192.168.2.10, my phone. I saw the packets, ICMP requests, coming in - but no answers logged. At the same moment, I was : [25.07.1-RELEASE][root@pfSense.bhf.tld]/root: tail -f /var/log/filter.log and I saw : ... <134>1 2025-09-02T09:15:05.661320+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,271,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,1564 <134>1 2025-09-02T09:15:06.661321+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,52479,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,1664 <134>1 2025-09-02T09:15:07.661337+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,19671,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,1764 <134>1 2025-09-02T09:15:08.661389+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,9817,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,1864 <134>1 2025-09-02T09:15:09.661321+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,17809,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,1964 <134>1 2025-09-02T09:15:10.661336+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,16478,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,2064 <134>1 2025-09-02T09:15:11.661399+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,17854,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,2164 <134>1 2025-09-02T09:15:12.661402+02:00 pfSense.bhf.tld filterlog 75062 - - 164,,,1655045805,igc1,match,block,in,4,0x0,,64,34051,0,none,1,icmp,84,192.168.2.10,192.168.1.33,request,63694,2264 ... which tells me that my firewall rule (shown above) was blocking my ICMP requests (to 1492.168.1.33). GUI equivalent : [image: 1756797907823-8d2a4a54-06d5-45d4-afb3-c5e359d61e79-image.png] The firewall log label is "LAN Block" so I knew which firewall rule was blocking, the one I showed above. This really makes me think that even when you Allow an IP address, the portal's GUI firewall rules still apply. As soon as I activated this first portal's firewall line : [image: 1756797755652-ed4331af-495b-42e3-ae7e-5464c718cba4-image.png] which allows ping packets from the portal interface to go to my LAN, 192.168.1.33, my NAS, ping packets came back / the NAS was replying.

FreeRADIUS won't start after updating package to 0.15.14

johnpoz — Fri, 15 Aug 2025 20:38:08 GMT

Yeah this use to be an issue, where once a new release came out updating packages could install package from new release even if you were on old.. But I thought that was addressed while back. From my understanding you shouldn't see new packages available for version Y when you are still on X.

Forcing captive portal only once a week

Gertjan — Tue, 12 Aug 2025 22:08:43 GMT

@DominikHoffmann said in Forcing captive portal only once a week: Do I extend the DHCP lease to six days, or would this be handled by the idle and hard timeouts of the captive portal configuration page alone? First, the basic rule is : DHCP IPv4 leases are typically a day or two max. That's the sweet spot. If you need to change this, something isn't 'right'. Very long leases might do the trick, but be ware, you have a limited pool size, for example (my portal) : 192.168.2.10 to 192.168.2.254. (the first 10 are reserved for pfSense portal IP itself, and several APs), so 244 devices can be logged into my portal. If you only have a couple of devices simultaneously every week, and if the device connects back after one day (night) decides to give to the same device - connected yesterday - the same IP, as the lease is still valid, then you'll be good. If you have 'many' devices, and leases are "7 days" you might run out of free pool IPs. Even if you use "7 days" vouchers : when the device comes back and the lease was 'recycled' the IP will change. They have to re enter the voucher code again - and as it is still valid, the connection resumes. Or : use "auto MAC pass through" : [image: 1755079584371-4efaf598-9a82-4dcf-9225-ba8aa2a7bd0d-image.png] so when the user connects ones, his MAC will get add to the list - so no more login needed (that is, it still must receive the same IP / same lease all the time). You, at the end of the week, you throw everybody out manually from the MAC list : There is still one thing you need to be aware of : some users (devices) are totally paranoid, and regenerate their device Wifi MAC all the time. In that case they have to re logging all time - not your fault (I've seen this twice now ...).

No captive portal auth logs anymore after upgrade to 2.8.0

refugeesonline — Tue, 12 Aug 2025 14:11:12 GMT

Hi community!
We run PFSense at around 200 locations and we are using voucher and captive portal intensively. All locations do remote syslog of its voucher auths.
We upgraded two locations to 2.8.0 (APU HW from PC Engines).
After the upgrade, logging has stopped working. No local file, no remote syslog.

Any ideas why this happens and how it can be fixed?

Best,

Volker

Captive portal from routed address

Gertjan — Mon, 11 Aug 2025 10:16:09 GMT

@Elnatan And without MAC info, portal management becomes more like, a lame duck. It might 'work' but will only by IP based.

Captive portal with external code?

DominikHoffmann — Wed, 06 Aug 2025 23:56:12 GMT

@Gertjan: My client has an ongoing relationship with a web development and graphic design firm. They programmed the image into the html code directly, by encoding it as base64. Makes it especially easy to handle in pfSense. They also skipped the fancy Google Analytics (?), fonts and external style sheet. It works really well now.

Captive Portal Stops Working pfsense 2.8.0. Hitting 'save' resolves the issue

neuf_16 — Tue, 29 Jul 2025 18:30:11 GMT

@Gertjan Thanks for taking the time to respond here For some context: I manage the gateway/firewall remotely for an IT admin who reports the issues to me. Not really sure what was going on at the time. The fact that the portal landing page was not appearing across the entire network but then would appear again after I would login to pfSense and hit 'save/Apply Changes' in the captive portal settings, remains a mystery to me. At the time the version was 2.8.0 but I upgraded to 2.8.1 as soon as I could. It seems stable now but will report if the issue comes back.

Captive portal blocks access to internet

stephenw10 — Wed, 09 Jul 2025 21:55:41 GMT

Maybe you have 'https login' set?

Blocked MAC Address Redirect URL Not Working on pfSense 2.8.0 [Issue After Update]

Gertjan — Sun, 29 Jun 2025 17:39:19 GMT

@LadiesMan217 @and those who do the same : Be aware that commenting this 'break;' will break "mac mask" support.

Strange (occasional) malfunction on captive portal and mac address whitelist

Luca De Andreis — Mon, 23 Jun 2025 14:38:05 GMT

@Gertjan said in Strange (occasional) malfunction on captive portal and mac address whitelist: Do you use several portal instances ? Yes I use two portal instances: [image: 1750968051898-0314ffa0-fd0b-4c1d-959d-3371f62da1cf-immagine.png] The first one for guest users (MAC white list and vouchers) The second one use MAC white list and LDAP auth, Indeed, there have only been reports of problems on the first one and not on the second one (in relation to the MAC white list) but it could be that users use the former much more while the latter is little used except with authentication by LDAP working properly.

Updating tables with SQL and data usage

reo.kmh — Mon, 09 Jun 2025 02:51:12 GMT

@Gertjan This is beautiful. I've managed to get things working good enough to accomplish my first-level goals and turn it over to my relief so I get to go on vacation without getting emails about radius. And I noticed from my attempts earlier that as I was making changes trying to get SQL to update the Portal would stop working every so often and need to be restarted, so I'm going to leave things here for now. I was able to brute force a bash script that could calculate daily data usage as a percentage of the cap by poking around the datacounter directory and scp it to my desktop, and my relief will just have to live with the GUI user manager for a few trips. But when I get back and have more than a couple days I'm going to dig into why radacct isn't updating then work on these changes you've outlined. Being able to view and edit all this through SQL will be a huge advance. (No smart children onboard so I added pHPmyadmin to my synology immediately after MariaDB.) Thanks so much for this, I really appreciate it.

Captive portal with "access code"

Gertjan — Fri, 16 May 2025 19:10:23 GMT

@regexaurus This usermod ? You have to re-polish your definition of pfSense pfSense maintains a (one !) system wide config. Nearly everything you see in the GUI is stored in this file. When the system boots, every system or process config file, for example the "GUI nginx web server" config file ( here : /var/etc/nginx-webConfigurator.conf ) is re-created with the GUI settings. Then the process (nginx) is started, and the GUI becomes active. The same thing is valid for system users. As you can see; under /home/, every portal user has actually a (limited) system account there. If you want to change delete or add a user, use the GUI. Everything you do with the command line will not be persistent, not taken in account, and undone when the related process restart. 'Real' CLI command is still possible, but you need to script things. For example, adding or modifying a user, see how the GUI does it. Know that, you know how to write your own script. It could be as simple as modifying the pfSense config.xml file, and then restart related processes.

CRASH REPORT CAPTIVE PORTAL

RaymondChauke — Wed, 07 May 2025 06:27:44 GMT

@Gertjan We are now at Version 26