Captive Portal

• 

  LAN ip blocked but seems to be passing traffic
  • h1pp13p373  

  23
  2
  Votes
  23
  Posts
  93
  Views

  

  @Derelict Thanks!
• 

  Captive Portal with AD - LDAP authenticates without a password !!,
  • olakara  

  27
  0
  Votes
  27
  Posts
  1096
  Views

  D

  Thankyou @free4 Give me some days to implement a laboratory clone because I have all the firewalls in production environment.
• N

  CAPTIVE PORTAL PLUS CANNOT PRINT VOUCHER ON PDF
  • newIT28  

  4
  0
  Votes
  4
  Posts
  213
  Views

  F

  @newIT28 i dont know what is "captive portal plus". this is not a pfSense feature. please contact the devs of your plugin/patch ?
• L

  Captiv portal tuning
  • lucas1  

  7
  0
  Votes
  7
  Posts
  274
  Views

  L

  @heper Those. in any way it will not be possible to achieve by means of PfSense (Captive Portal) that the window for entering the name and password in the browser does not appear and the users do not have to specify the name and password each time? 2.Removed the privilege for the group Captive portal login. Removed the user from the corresponding group in Active Directory. Authentication passes through the portal. Diagnostics \ Authentication also passes. True This user is a member of groups: is empty. I restarted the portal service.
• O

  Cavtive Portal
  • omeryayinci  

  2
  0
  Votes
  2
  Posts
  484
  Views

  

  What is your question ? pfSense and/or the captive portal has nothing to do with a 'modem'.
• I

  Disconnetct!
  • ilarioQ  

  18
  0
  Votes
  18
  Posts
  76
  Views

  I

  @free4 thanks!
• E

  Captive Portal with Carp HA and Multi Wan
  • emacri  

  3
  0
  Votes
  3
  Posts
  538
  Views

  E

  Great, I haven't even reached that problem yet, I just can't get redirect to work. Guess it was just a fluke that I got it working at the 1 site. Thanks,
• I

  Problem with custom page
  • ilarioQ  

  3
  1
  Votes
  3
  Posts
  356
  Views

  I

  @Gertjan Thanks for your reply, I'll try to change the page, in case I can't write again.
• Z

  Slow redirect after successful authentication
  • zak_coslat  

  4
  0
  Votes
  4
  Posts
  389
  Views

  

  Hi, This : @zak_coslat said in Slow redirect after successful authentication: Database insertion is very quick is important. I'm quiet sure you can also check quickly ( read this so you know how to check ) that the device's MAC and IP are added to the two ipfw tables that are related to your captive portal instance. ipfw is the firewall the captive portal portal is using for it's magic. Which means : it's all open ... Btw : the GUI firewall rules for the interface that the captive portal is using are ok, right ? If you have the possibility to add a cert - one that is signed by a know and recognized cert authority like Letsencrypt - to your captive portal's login page you will see things speed up quiet a lot. You can use the acme package to handle all the details. The bad news is : you will be needing a domain name like "my-site-network.tld" and have to create a cert like "portal-my-site-network.tld" and use this cert on the captive portal's setup so the portal login page will get loaded using https. ( and will you're at it, ask the entire "wild card" cert for "*.my-site-network.tld" so you can also use it for your pfsense.my-site-network.tld and nas.my-site-network.tld and printer.my-site-network.tld etc etc on your local network (for all your https capable devices )
• Z

  captive portal and VoIP phones
  • zaber01  

  2
  0
  Votes
  2
  Posts
  458
  Views

  

  Hi, The best choice would be, imho, adding the MAC addresses of these devices to the MAC tab. When done, the captives portal 'internal' firewall (ipfw) will become transparent for any address, any protocol, any port for traffic coming (or going) to this device. For that device, behaviour would be identical as shutting down the captive portal on that interface. Test this yourself. Btw : @zaber01 said in captive portal and VoIP phones: all pc in that network getting ip manually The IP is a good start. Do not forget the network mask, gateway and DNS. The lather should be set to the IP of the pfSense portal's interface. But you could, of course, complicate things a bit more.
• G

  captive portal
  • georges  

  5
  0
  Votes
  5
  Posts
  444
  Views

  G

  @free4 thank you a lots sir . I guess i ll do it with browser then. have a nice day :)
• D

  Captive portal block connection on the yrong interface
  • dreis74  

  2
  0
  Votes
  2
  Posts
  234
  Views

  F

  hi this is a known bug : https://redmine.pfsense.org/issues/7553 the issue seems related to ipfw and its interactions with the freebsd kernel, it can't be resolved easly.
• M

  Pfsense syncing user/directory with google g-suite for VPN and WIFI authentication
  • mephisto  

  3
  0
  Votes
  3
  Posts
  267
  Views

  M

  it sort of overlaps with pfsense a fair bit as I want people to openvpn to pfsense and use freeradius, if that is the right approach as well. Is there any other way to get pfsense to connect to google ldap and manage user authentication?
• D

  Pre-Auth URL Send MAC Address
  • diocia  

  1
  0
  Votes
  1
  Posts
  466
  Views

  No one has replied

• F

  [Solved] Slow captive portal on smartphones
  • fmattbp  

  11
  0
  Votes
  11
  Posts
  1426
  Views

  

  @fmattbp said in [Solved] Slow captive portal on smartphones: just a little update. I issue the certificate as example.mydomain.com and What I do : I asked for a wild card cert. @fmattbp said in [Solved] Slow captive portal on smartphones: portal loads instantly in every device I'm seeing the same thing. Actually, we all know why : browser prefer by far https sites I guess, before they fall back to old school 'http'.
• 

  Captive portal with RADIUS MAC Authentication
  • dwolfix  

  2
  0
  Votes
  2
  Posts
  33
  Views

  

  I myself found a solution. "Login page Fallback" matches "Auth Error Page". It was also necessary to replace this page with our version.
• S

  simple toggle for children VLAN
  • sgw  

  12
  0
  Votes
  12
  Posts
  138
  Views

  S

  @akuma1x said in simple toggle for children VLAN: Ok, if it's all hard wired, how about sacrificing a small smart switch (because you said VLAN's) and power said switch with one of those "smart home" wifi power outlets? The power outlet thingie can be turned on and off on a schedule, or even better, on demand with a smart phone app. https://www.amazon.com/Gosund-Compatible-Required-appliances-Certified/dp/B079MFTYMV If the switch doesn't have power, then the network traffic isn't going to pass. I'm NOT saying it's bullet-proof, or kid-proof either, but it could be a cheap & easy way to do this. We will consider that, thanks. Maybe we could even toggle the existing switch-port via FHEM somehow.
• I

  One Voucher Per Device
  • ishtiaqaj  

  107
  1
  Votes
  107
  Posts
  2033
  Views

  

  @wazim4u said in One Voucher Per Device: did you get any way to unbind MAC with IP ? That means a rather big rewrite of most functions in /etc/inc/captiveportal.inc .... Portal code is IP and MAC based .... This exists : but that one doesn't interest you ... @wazim4u said in One Voucher Per Device: DHCP sometimes renew IP of some clients so Yep, and the DHCP will renew the IP -> and it will grant the SAME IP. One exception : if this IP is already used by some other device (pool to small, so IP's get recycled). On my portal, I always receive the same IP when I connect with my PC or Phone.
• D

  Captive portal manual logout page address
  • Dario Palmisano  

  101
  0
  Votes
  101
  Posts
  39575
  Views

  

  @netx34 said in Captive portal manual logout page address: btw only the logout.php can apply FQDN for the domain name What do you mean ?
• S

  Auto guest account or self create
  • seobbr  

  1
  0
  Votes
  1
  Posts
  203
  Views

  No one has replied

• C

  [SOLVED]Captive portal in 1 step with QR Code
  • cordon  

  5
  0
  Votes
  5
  Posts
  294
  Views

  C

  @lexxai Yes, I've found this site https://knobelbecher.net/vouchergenerator/ It gives you (on the botton of the page) a new index.php that is patched for the QR code. got it working just fine Thx
• R

  HELP Users on Captive Portal use their smartphones as mobile hotspot
  • Rapboy2019  

  5
  0
  Votes
  5
  Posts
  428
  Views

  C

  I'm new to pfsense but, can't you limit the bandwidth by voucher or put some download limit ? and use 5ghz antenas.
• Z

  how to setup captive portal without enabling dhcp on lan
  • zaber01  

  2
  0
  Votes
  2
  Posts
  310
  Views

  F

  simple : enable captive portal without enabling DHCP, then set up static IP on your clients.....
• L

  How do I call Radius server to my Access Point outside the local network?
  • louger  

  2
  0
  Votes
  2
  Posts
  639
  Views

  

  @louger said in How do I call Radius server to my Access Point outside the local network?: I followed this tutorial Why ? The original 'from the authors' video isn't good enough ? If your Radius server isn't hosted on pfSense using the FreeRadius package and The Radius server isn't hosted on the captive portal network segment then Add the IP of your Radius server to this page :
• T

  Anyone that can configure a captive portal?
  • Tom8888  

  3
  0
  Votes
  3
  Posts
  387
  Views

  T

  @Gertjan said in Anyone that can configure a captive portal?: Hi, Be aware that the guy who offers a captive portal should also support it. Like : you want to drive a car : you'll get best results when you actually are trained to do so Oh thanks for the suggestion, but i don't need that, once we test it and it works, i am fine with that, no need for support, i will pay again if necessary.
• B

  Custom logout page
  • brinch  

  3
  0
  Votes
  3
  Posts
  171
  Views

  

  For reference : https://forum.netgate.com/topic/69307/captive-portal-manual-logout-page-address/94
• M

  [Portal Cautivo] Autenticar por redes sociales
  • Maxi_Rosario  

  10
  0
  Votes
  10
  Posts
  454
  Views

  N

  Hi, @ felipe-volpato. First of all thank you very much for sharing the video. I'm looking to do something like that, would you be so kind as to share some information on how you did it? Thank you very much in advance for your time
• I

  Captive portal 404 redirecting
  • ilarioQ  

  4
  0
  Votes
  4
  Posts
  432
  Views

  B

  Ok, that's what i thought, GJ
• T

  Accessing Captive portal from remote host returns NXDOMAIN Error
  • tolga  

  7
  0
  Votes
  7
  Posts
  43
  Views

  

  Only way you could do that would be to setup a VPN to pfSense and run the captive portal on that. It would probably still be painful though. Steve
• T

  Captive Portal Configuration, willing to hire someone...
  • Tom8888  

  10
  0
  Votes
  10
  Posts
  212
  Views

  T

  Still willing to hire someone, if there is anyone which can do the job online, kindly let me know your fee, thanks.
• N

  Captive portal + WPAD + Squid
  • nilux17  

  5
  0
  Votes
  5
  Posts
  749
  Views

  N

  @free4 thx, i've setup a transparent proxy + HTTPS/SSL Interception on the netgate itself and use my existant proxy as a peer proxy. it works
• I

  Help whit login page customize
  • ilarioQ  

  2
  0
  Votes
  2
  Posts
  745
  Views

  I

  @ilarioQ Find solution, in same place to image.
• I

  Captive portal does not "delete" expired user device
  • ilarioQ  

  8
  0
  Votes
  8
  Posts
  272
  Views

  I

  @free4 I disconnected everyone, stopped and restarted the captive portal. I had some users connected with the vouchers, some were reconnected and some were not. Thanks.
• C

  Redirect does not work
  • Crunch1788  

  17
  0
  Votes
  17
  Posts
  90
  Views

  

  @Crunch1788 said in Redirect does not work: type anything in the browser it just dont redirect... This "anything" should not be a https site that you already visited before. These days, certs are persistent, ans some of them even completely forbid that you use the http:// destination. So, type in a http (not https) site that you never visited before. This would start the usual DNS questioning and when the answer comes in (the A one) then the browser will (try to) connect to it using port 80. Nifty ipfw firewall rules on the Captive portal interface will redirect any "connections to port 80" to the firewall itself. And guess what, the web server that servers the captive login page is listening over there. So you see that, instead of the site you wanted to visit. So, this "anything" should be something valid, if not the DNS exchanges "anything" for "does not exist" and you still have a no go. But : these days there is no need any more to explain these things. All OS's are captive portal aware these days so it works out of the box. I tend to say : activate the portal with as Authentication Method : None. and your done. The trick is : a good working DNS isn't optional thing. The captive portal really needs it - that is, the clients do. So, people that m*ss up the DNS (Resolver) settings will wind up with a non working captive portal. Most issues are being handled here : https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-troubleshooting.html Btw : I could show you the video that my brother made about captive portals. Very nice except that it wouldn't help nobody. If you want a video, use the real videos from Netgate, the official ones. "Done by the guys who build it". Like having Windows explained to you by the guy from Microsoft. Not your car dealer. really, it makes a difference. edit : I was typing to slowly .... (during work hours) ... What I advice you to do : (All) device use DHCP - and pfSEnse should hand out the IP mask gateway and DNS. The latter two are the IP of the network where the captive portal is running. The DNS resolver settings should be "default" : example adding 8.8.8.8 and you're out of business. First test : just use one (1) ether-net cable, no switches - no AP's, nothing except the one 1 $ cable. This should work. Now you can include a switch. A switch has no settings so this can't go wrong. Test again. Now add an AP ... and be careful : an AP - not some "router-with-AP-with-router-functionalities" like DHCP/Firewall/NAT etc still activated. Just an AP. Shut down the rest (DCP ... DNS ....). Give this AP a static IP - gateway being the IP of pfSense - DNS is the IP of pfSense and you'll be fine. About the OS detection : example : an iPhone : Select the captive portal wifi network. Wait 5 seconds. The portal login page shows up "as by magic" : no need to open up a browser first. Same thing for Microsoft Windows since version 7. I think even "android" devices have it working out of the box these days. No interaction from your side is needed.
• 

  Captive portal for Public WiFi network
  • 0daymaster  

  1
  0
  Votes
  1
  Posts
  112
  Views

  No one has replied

• M

  Captive Portal + Radius Server : Create a generated users list
  • moelharrak  

  5
  0
  Votes
  5
  Posts
  126
  Views

  M

  Hi , Thank you for your reply , I have two instances but still can't see where can I separate users for each zone, Because when I create users I see nothing that mention to whom the users will be applied to.
• S

  Freeradius user with multiple passwords
  • ssattannae  

  3
  0
  Votes
  3
  Posts
  54
  Views

  S

  Ah sorry I'll be more careful in the future. Is it okay if I delete this post?
• D

  captive portal to collect user info without authentication for guests at a restaurtant
  • DeanB_NYTS  

  18
  0
  Votes
  18
  Posts
  188
  Views

  

  @DeanB_NYTS said in captive portal to collect user info without authentication for guests at a restaurtant: was for device names for DNS filtering instead of IP address. I didn't know it could be used for urls!? URL (host names) or IP's : it's the same thing. The only difference is that the URL (host names) will get resolved first. Read https://docs.netgate.com/pfsense/en/latest/captiveportal/captive-portal-troubleshooting.html first. Now, use the mentioned ipfw commands (console or SSH access, option 8) and check he captive portals ipfw rules for yourself.
• M

  pfSense-Bandwidth-Max-Down not working on radius server
  • maherg  

  9
  0
  Votes
  9
  Posts
  110
  Views

  

  @free4 : I have seen the same logs - actually, when I run radius by hand, using the -X mode. For me, this is where error log comes from It's not the authentication, which probably just fine, but the REAUTHENTICATION which happens every minute. It's this one that checks upload/download bits, time etc. @maherg : what pfSense logs is useless info - it's far to minial - although it show (me) "where" the problem is. We told you now 3 times where to look for the what really happens. Just do what admins (have to) do.
• W

  Captive Portal - ntopng
  • WD_Doug  

  5
  0
  Votes
  5
  Posts
  87
  Views

  W

  @kiokoman - Thanks for the feedback. I haven't thought about squid. I will have to look in to it and research it a little. Then I can have a look at installing it to see some of its configuration & settings. Thanks again......