Captive Portal

• I

  One Voucher Per Device
  • ishtiaqaj  

  101
  0
  Votes
  101
  Posts
  1460
  Views

  W

  @Gertjan said in One Voucher Per Device: caveat I would like to know if you have some latest development on your patch ( one voucher per device ) for 2.5.0 version. I have taken risk to use 2.5-Development version for captive portal service up to 2200 user with voucher system. testing service is running for one week and so far there is no issue and all issues i was facing like reboot system or changing setting in 2.4.4-p3 captive portal gone... made life easy for me. i have implemented your patch again to lock user with first login. It is working fine since 1 week. with a little bit of issues so far which i think fixable. 1-when you try to login again with already active voucher it gives error page in two forms field. one is giving notice ( reuse of authentication not allowed ) and second form ( voucher expired ) it should be only first one in this case. 2- Secondly it should be MAC based authentication not MAC & IP. if someone add voucher and his lease is changed from 1.1.1.1 to 2.2.2.2 he will not able to login again even MAC ( device ) is same. this is major problem at the moment. 3- Getting some crash error but doesn't effect captive portal operation. non numeric-value encountered in etc/inc/captiveportal.inc on line 1955
• F

  Slow captive portal on smartphones
  • fmattbp  

  3
  0
  Votes
  3
  Posts
  107
  Views

  F

  @free4 Thanks for the reply, the device is a Samsung Galaxy J7 Pro 2017 and it functions well in other captive portals it's only in the captive portal that i'm setting up
• T

  Anyone that can configure a captive portal?
  • Tom8888  

  1
  0
  Votes
  1
  Posts
  84
  Views

  No one has replied

• I

  Captive portal 404 redirecting
  • ilarioQ  

  4
  0
  Votes
  4
  Posts
  393
  Views

  B

  Ok, that's what i thought, GJ
• D

  Captive portal manual logout page address
  • Dario Palmisano  

  89
  0
  Votes
  89
  Posts
  38798
  Views

  B

  :D I've done it already. But that guy mentioned is the one! @Gertjan
• B

  Custom logout page
  • brinch  

  1
  0
  Votes
  1
  Posts
  110
  Views

  No one has replied

• T

  Captive Portal Configuration, willing to hire someone...
  • Tom8888  

  10
  0
  Votes
  10
  Posts
  198
  Views

  T

  Still willing to hire someone, if there is anyone which can do the job online, kindly let me know your fee, thanks.
• N

  Captive portal + WPAD + Squid
  • nilux17  

  5
  0
  Votes
  5
  Posts
  724
  Views

  N

  @free4 thx, i've setup a transparent proxy + HTTPS/SSL Interception on the netgate itself and use my existant proxy as a peer proxy. it works
• L

  How do I call Radius server to my Access Point outside the local network?
  • louger  

  1
  0
  Votes
  1
  Posts
  610
  Views

  No one has replied

• I

  Help whit login page customize
  • ilarioQ  

  2
  0
  Votes
  2
  Posts
  721
  Views

  I

  @ilarioQ Find solution, in same place to image.
• I

  Captive portal does not "delete" expired user device
  • ilarioQ  

  8
  0
  Votes
  8
  Posts
  260
  Views

  I

  @free4 I disconnected everyone, stopped and restarted the captive portal. I had some users connected with the vouchers, some were reconnected and some were not. Thanks.
• C

  Redirect does not work
  • Crunch1788  

  17
  0
  Votes
  17
  Posts
  70
  Views

  

  @Crunch1788 said in Redirect does not work: type anything in the browser it just dont redirect... This "anything" should not be a https site that you already visited before. These days, certs are persistent, ans some of them even completely forbid that you use the http:// destination. So, type in a http (not https) site that you never visited before. This would start the usual DNS questioning and when the answer comes in (the A one) then the browser will (try to) connect to it using port 80. Nifty ipfw firewall rules on the Captive portal interface will redirect any "connections to port 80" to the firewall itself. And guess what, the web server that servers the captive login page is listening over there. So you see that, instead of the site you wanted to visit. So, this "anything" should be something valid, if not the DNS exchanges "anything" for "does not exist" and you still have a no go. But : these days there is no need any more to explain these things. All OS's are captive portal aware these days so it works out of the box. I tend to say : activate the portal with as Authentication Method : None. and your done. The trick is : a good working DNS isn't optional thing. The captive portal really needs it - that is, the clients do. So, people that m*ss up the DNS (Resolver) settings will wind up with a non working captive portal. Most issues are being handled here : https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-troubleshooting.html Btw : I could show you the video that my brother made about captive portals. Very nice except that it wouldn't help nobody. If you want a video, use the real videos from Netgate, the official ones. "Done by the guys who build it". Like having Windows explained to you by the guy from Microsoft. Not your car dealer. really, it makes a difference. edit : I was typing to slowly .... (during work hours) ... What I advice you to do : (All) device use DHCP - and pfSEnse should hand out the IP mask gateway and DNS. The latter two are the IP of the network where the captive portal is running. The DNS resolver settings should be "default" : example adding 8.8.8.8 and you're out of business. First test : just use one (1) ether-net cable, no switches - no AP's, nothing except the one 1 $ cable. This should work. Now you can include a switch. A switch has no settings so this can't go wrong. Test again. Now add an AP ... and be careful : an AP - not some "router-with-AP-with-router-functionalities" like DHCP/Firewall/NAT etc still activated. Just an AP. Shut down the rest (DCP ... DNS ....). Give this AP a static IP - gateway being the IP of pfSense - DNS is the IP of pfSense and you'll be fine. About the OS detection : example : an iPhone : Select the captive portal wifi network. Wait 5 seconds. The portal login page shows up "as by magic" : no need to open up a browser first. Same thing for Microsoft Windows since version 7. I think even "android" devices have it working out of the box these days. No interaction from your side is needed.
• 

  Captive portal for Public WiFi network
  • 0daymaster  

  1
  0
  Votes
  1
  Posts
  76
  Views

  No one has replied

• M

  Captive Portal + Radius Server : Create a generated users list
  • moelharrak  

  5
  0
  Votes
  5
  Posts
  101
  Views

  M

  Hi , Thank you for your reply , I have two instances but still can't see where can I separate users for each zone, Because when I create users I see nothing that mention to whom the users will be applied to.
• S

  Freeradius user with multiple passwords
  • ssattannae  

  3
  0
  Votes
  3
  Posts
  42
  Views

  S

  Ah sorry I'll be more careful in the future. Is it okay if I delete this post?
• D

  captive portal to collect user info without authentication for guests at a restaurtant
  • DeanB_NYTS  

  18
  0
  Votes
  18
  Posts
  154
  Views

  

  @DeanB_NYTS said in captive portal to collect user info without authentication for guests at a restaurtant: was for device names for DNS filtering instead of IP address. I didn't know it could be used for urls!? URL (host names) or IP's : it's the same thing. The only difference is that the URL (host names) will get resolved first. Read https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-troubleshooting.html first. Now, use the mentioned ipfw commands (console or SSH access, option 8) and check he captive portals ipfw rules for yourself.
• M

  pfSense-Bandwidth-Max-Down not working on radius server
  • maherg  

  9
  0
  Votes
  9
  Posts
  83
  Views

  

  @free4 : I have seen the same logs - actually, when I run radius by hand, using the -X mode. For me, this is where error log comes from It's not the authentication, which probably just fine, but the REAUTHENTICATION which happens every minute. It's this one that checks upload/download bits, time etc. @maherg : what pfSense logs is useless info - it's far to minial - although it show (me) "where" the problem is. We told you now 3 times where to look for the what really happens. Just do what admins (have to) do.
• W

  Captive Portal - ntopng
  • WD_Doug  

  5
  0
  Votes
  5
  Posts
  71
  Views

  W

  @kiokoman - Thanks for the feedback. I haven't thought about squid. I will have to look in to it and research it a little. Then I can have a look at installing it to see some of its configuration & settings. Thanks again......
• N

  pfsense
  • nit  

  3
  0
  Votes
  3
  Posts
  55
  Views

  N

  @free4 said in pfsense: packetFence I thought of packetfence but am not sure whether I will be able to configure packetfence on one machien and pfsense on another. The confusion was with respect to architecture. Should Packefence be inline with one link to the internal network and the other NIC connected to pfsense which has three nics(two wans and one lan) Will this solution slow down the speed with ths extra latency
• H

  Captive portal ignoring MACs in latest version and allowing all machines access
  • h2professor  

  42
  0
  Votes
  42
  Posts
  374
  Views

  

  I"m still reading here .... trying to figure out. Last couple of weeks I loaded a Hyper-VM on my 2012 Win server, it has 3 NIC's, so I can simulate and test without disturbing my companie network. Also : I'm using a second PC @home loaded with pfSense (using VM also). Detail these 2 phrases : @h2professor said in Captive portal ignoring MACs in latest version and allowing all machines access: After, with 28:c6:8e:0f:95:9b set to Block after.txt I note that the MAC is not found in the second output. As soon as the captive portal is activated on an interface, everybody (MAC, IP, whatever) is blocked. Even when you have this : on the LAN interface. ipfw takes precedence of the ip firewall. ip being the firewall you set up with the GUI. When you add a MAC on the MAC tab as a "pass" , this MAC will be part of your table "default_pipe_mac": 02100 145763334 141217081935 pipe tablearg ip from any to any MAC table(default_pipe_mac) This is a snaphot of your "default_pipe_mac" : dc:ef:09:9b:a8:c0 any 2671 1155484 1699152753 1560263421 any dc:ef:09:9b:a8:c0 2670 11 0 1560262129 You can see the MAC, the pipe rule numbers 2670 (down) and 2671 (up) and the number of bytes received and send. These are the related pipe rules 2670 and 2671 : ..... 02670: unlimited 0 ms burst 0 q133742 100 sl. 0 flows (1 buckets) sched 68206 weight 0 lmax 0 pri 0 droptail sched 68206 type FIFO flags 0x0 16 buckets 0 active ..... 02671: unlimited 0 ms burst 0 q133743 100 sl. 0 flows (1 buckets) sched 68207 weight 0 lmax 0 pri 0 droptail sched 68207 type FIFO flags 0x0 16 buckets 0 active ... Both are unlimited pipes. Btw : I found one (just 1) speed limiting (half a mega / s )pipe : 02223: 500.000 Kbit/s 0 ms burst 0 q133295 100 sl. 0 flows (1 buckets) sched 67759 weight 0 lmax 0 pri 0 droptail sched 67759 type FIFO flags 0x0 16 buckets 0 active Pipe 2223 : so this is device 28:c6:8e:0f:95:9b any 2223 11722 14806366 1560263421 any 28:c6:8e:0f:95:9b 2222 2 0 1560262183 is speed limited - this is the only device I found that was limited speed. The blocked MAC list : as you might have understand, MAC's that are blocked are not present in the ipfw tables and rules. When you add a MAC as blocked, it's been put in a list handled by the GUI. The Captive portal web server, when intercepting a (in your case : http) visitor web browser http requests, are redirected to this page page : (some conditions have to be met, like this page must is on the same LAN segment as the captive portal - there must be a http web server that can serve the page, etc - it might, it might not. For me, using an iphone, it didn't redirect well ) If no URL, the device is blocked, for any IP, for any port, for any protocol. But : when a MAC isn't present on the MAC tab, or it's set as a red block, it won't pass. I advice you to use and old PC to test - make sure there is a second NIC, and setup pfSense for yourself. Although I strongly advise you to use a captive portal on a dedicated - OPT1 - NIC, and leave the LAN for administrative purposes. When applied the minimal setup as per Netgate's video (there are 3 videos on Youtube, the Netgate channel, take a recent one that handles basic operations) no device can connect, and they will show the default Login when you use a web browser on a visiting device. https restrictions might apply. Now, when you add ONE MAC as a pass, this device can pass to the net. Right ? Still, no other device can pass. Right ? Add another MAC as a pass. It passes right ? An still, no other devices can pass. For the fun, add a MAC of a device that you own, as a BLOCK. It can not pass, right ? And again, other, non listed MAC's still can't pass. Etc etc. You could even import your entire "300 MAC" list. I would do this by exporting the config.xml - then use notepad++ to insert the block of .... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>7c:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> ..... in the correct section, and import that file back in again. Still, unlisted device you own can't pass as they are not part of the list. I ended up listing all my devices (9) as blocked : they didn't pass. I removed them from the MAC tab, so not listed as a pass or block : they still didn't pass. Btw : do not hesitate to reset firewall states. I don't know if it is really needed, but it would harm to reset they all the time, after changes. My main question is : can you replicate your issue on a barebone system, after a manual minimal setup. And if so, after which change your issue happens ? Also : export your .... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>bb:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> ..... section, and drop it in here. Mistify all MAC's be replacing the first byte by placing 'bb', as I did above. I'll import your list. I wonder if I see the issue then ...
• E

  images from file manager not showing
  • exofio  

  12
  0
  Votes
  12
  Posts
  63
  Views

  

  @kiokoman said in images from file manager not showing: of course not there is a specific section on the Captive portal to load images, Right. It's here : Check out this : Got it ? You see the first "check" : "Use custom captive portal page Enable to use a custom captive portal login page" ? It's not clear if @exofio is using the default, build in login page - which has an optional replaceable background and logo image, or if he is using a self-made login 'html' page.
• X

  pfSense config with daloRadius (freeRadius) to setup download quota limitation
  • xsmael  

  2
  0
  Votes
  2
  Posts
  69
  Views

  F

  I might say obvious things, but did you have a look to the documentation ? It has been updated recently https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-configuration.html
• I

  Send() failed (40: Message too long)
  • ishtiaqaj  

  38
  0
  Votes
  38
  Posts
  11135
  Views

  

  @wazim4u : Do you redirect a new, just logged-in user to an URL ( setting After authentication Redirection URL ) ? This is what I think : when a user logged in using the IP (or URL) of the captive portal page, the users browser gets redirected to the same URL (== the captive pprtal's web server).... which will redirect again - to itself -, and again, and again etc - recursif. The URL thrown back to the browser becomes to big, nginx will finally produce the "send() failed (40: Message too long)" error. For myself, I redirect, no matter what, to "https://www.google.com" but you can take any URL like a your companie's site. Another explanation : you have quiet a lot of portal users. Not every user uses the latest smart devices /PC's with the latest OS and the best browsers. Even I see still IE8 (Windows XP) connecting to my portal. These ancient devices are not portal aware. They won't behave correctly. Or even : not all the apps are written the same way. At least, Apple reviews (some what) each and every app before it's released - the Android society is a pure zoo. So, a bad app can throw out an URL that's to big. nginx will bail out. So, mind you, these are all theories. I do not have the test park to test them.
• D

  Template Roll Printer with options (for 2.2.6, 2.3, 2.3.4, 2.4.0, 2.4.4)
  • DanieleIT  

  70
  0
  Votes
  70
  Posts
  17181
  Views

  

  Hi, (sorry for necroposting here). Excellent and awesome! Kudos for keeping it working still in 2.4.4. Brgs,
• N

  SAML Authentication
  • nico77  

  4
  0
  Votes
  4
  Posts
  47
  Views

  

  Well, it seems supporting LDAP - which is supported by pfSense. Never heard from "shibboleth" related to pfSense .... A forum or Google search confirms. Edit : there is one : https://forum.netgate.com/topic/60524/cp-authenticating-to-idp-via-saml !
• 

  A couple of usability issues come to mind
  • awebster  

  6
  0
  Votes
  6
  Posts
  77
  Views

  

  I agree totally. People that use devices to connect to the Internet are aware of the fact that an capital X and small case x are not always the same. I know - again : we as a company still receive, ones in a while, mails in all capitals - or all lower case. Better yet : check out this forum, you will find the same thing. Btw : forcing whatever is entered as a user name to capital ? No big deal. Find line 216 in /usr/local/captiveportal/index.php Here it is : $auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context) Surround $user with "strtoupper" like this : $auth_result = captiveportal_authenticate_user(strtoupper($user), $passwd, $clientmac, $clientip, $pipeno, $context) This will force whatever the user entered, to capitals. True : when pfSense updates, you will have to redo this edit - ones or twice a year. A small shell script that starts when pfSense reboots could do this for you.
• B

  Images in the captive portal are blocked
  • bero.k  

  11
  0
  Votes
  11
  Posts
  623
  Views

  E

  thank you. i am adding the school's default background.
• S

  (SOLVED) PFS 2.4.4 Captive Portal not auto redirecting
  • seramis  

  5
  0
  Votes
  5
  Posts
  110
  Views

  S

  @Gertjan separating LAN and WAN works! great Sir! thank you!
• C

  Logo and Background images missing
  • Cameroncitro  

  4
  0
  Votes
  4
  Posts
  86
  Views

  

  @exofio said in Logo and Background images missing: i cant upload due to img limit size 10mib.. what to do? Serious ? An index landing page that weights over 10 mega ??? If you really have to, put the videos, images and other big resources in separate files, and link to them from the main index login page. Note : None of the files can be bigger then 10 M. Also : everything you upload will be stored into the config.xml file.
• M

  Caching image on external captive portal page
  • Mypfsense2016  

  5
  0
  Votes
  5
  Posts
  785
  Views

  E

  i uploaded the file to var/db/... what code will i use to call it on html file?
• 

  (SOLVED) Captive portal looping
  • awebster  

  4
  0
  Votes
  4
  Posts
  90
  Views

  

  @Gertjan said in Captive portal looping: The 'login' page and nearly identical 'login-error' page are not stored in /var/db/cpelements. Thanks for the tip, that was indeed the source of the problem. An older login page was uploaded (at some point in the past) to the captive portal error page.
• P

  Can't generate Vaucher
  • phdemartin  

  5
  0
  Votes
  5
  Posts
  43
  Views

  P

  @jimp I found the problem, in the Voucher config page, I entered the server ip, the port and the username and password. And it gave me those errors. But if I let them blank, the Local Database being on the localhost, everything work perfectly now. Thanks
• F

  Freeradius3 accounting bugs
  • FrottyZ  

  21
  0
  Votes
  21
  Posts
  1193
  Views

  

  Those are placeholders from when the old forum transitioned to the new one. Images from old posts were lost.
• 

  One account ONLY for one device on the captive portal
  • ontzuevanhussen  

  2
  0
  Votes
  2
  Posts
  62
  Views

  F

  @ontzuevanhussen said in One account ONLY for one device on the captive portal: one account for one device, but does not disconnect the account that was previously logged. not sure i quite understand...you mean you want to allow only one login per user, and block additional logins attempts using an error page? if yes : pfSense does not natively support this feature. since you seems to be using freeradius, you could nevertheless add some freeradius setting (like simultaneous-Use : 1) to prevent an user to log in more than once. keep in mind that this kind of freeradius setting is not compatible with "reauthenticate users" for obvious reasons... also, independently of "is this technically possible", you should not do this. pfSense is using a MAC address&IP address couple to identify an user. for privacy reasons, a device may change them randomly over time. once its MAC or IP has changed, a device will face the login page again but won't be able to login anymore...is that really what you want?
• 

  Change Notification on Captive Portal Login Page
  • ontzuevanhussen  

  3
  0
  Votes
  3
  Posts
  75
  Views

  

  @free4 Ok, I found it. Thank you so much friend..
• 

  How To Configure FreeRadius on pfsense with Unifi AC Pro?
  • ontzuevanhussen  

  2
  0
  Votes
  2
  Posts
  79
  Views

  N

  @ontzuevanhussen What are you trying to do? Have you registered the aps in freeradius or the controller, it needs to have the aps registered. Try running rasdniff -x from the pfSense cli, it might give you a clue. https://docs.netgate.com/pfsense/en/latest/captiveportal/using-captive-portal-with-freeradius.html
• S

  No internet access when user restarts device after connected to CP
  • ssattannae  

  10
  0
  Votes
  10
  Posts
  129
  Views

  F

  @ssattannae you are welcome if after further testing you still think that the patch is really fixing your problem...then don't hesitate to make a thumbs up on https://github.com/pfsense/pfsense/pull/4042 and/or make a small comment "friendly bump, this pull request resolve a very impactful problem..." The patch and pull request are ready since a while (2.4.4-p2)...the current stable release is 2.4.4-p3 and the pull request is not merged yet...
• D

  [HOWTO] Captive portal + FreeRADIUS + local MySQL user friendly single step
  • deajan  

  154
  0
  Votes
  154
  Posts
  75773
  Views

  

  @Nova9 said in [HOWTO] Captive portal + FreeRADIUS + local MySQL user friendly single step: Maybe the .js files aren't loading properly? Use the right button of your mouse. Every browser will give you the possibility to see the 'html source of the web page. You'll be seeing in a split second if resource files like css and js files are not load, most of the time because they have another file on the system name. Btw : The subject "Captive portal + FreeRADIUS + local MySQL user friendly single step:" is a rather big project. Nothing something that can be pulled of 'ASAP'. Using an old pfSense version gives you a new feature : you created a security time bomb.
• C

  Radius or voucher authentication on same captive portal.
  • christopheb  

  7
  0
  Votes
  7
  Posts
  2545
  Views

  T

  @Trel said in Radius or voucher authentication on same captive portal.: Here's an example multi-method login page. It's probably overkill for anything you're trying to do though. multicappor.txt Can I please have a copy of the code?
• K

  freeradius just stop working
  • kramtw  

  8
  0
  Votes
  8
  Posts
  72
  Views

  K

  i had two different urls in, one disable the freeradius and the other did not. i used both of them and that was the result i observed. with the url that is not disabling the radius i am also redirected to the redit URL.