For anybody finding this convoluted, if you have a grapheneos phone and are connected to your router, you can create, screenshot and print out a qr-code for your firewall directly on it. it's not perfect, but works nonetheless

@tianakex Replace de entire function ? Humm ... that's bad. Just for my own curiosity : When : [image: 1785409266165-a2bc9abd-def1-4cd4-a31d-76af44826de6-image.png] is checked, after login, using voucher or user/password, the MAC get added. If the portal-voucher-user goes off site, comes back again, no need to login, as the MAC let in right in. Up to the admin to delete the MAC from the "MACs" list when the voucher has expired. What bout not checking this option ? True, the voucher user has to re enter the voucher code upon hard-time out. Btw : the 'php script' you've pasted is unreadable. Were are humans here, not PHP interpreters. What about : function captiveportal_prune_old_automac() { global $g, $cpzone, $cpzoneid; $cpzone_config = config_get_path("captiveportal/{$cpzone}", []); if (is_array($cpzone_config['passthrumac']) && isset($cpzone_config['passthrumacadd'])) { $tmpvoucherdb = array(); $writecfg = false; .... Use this button : [image: 1785409668522-cbb53e35-a26d-4914-b535-faff98f2c177-image.png] and propose what to add and or remove with exact line numbers using this as a guide line ?

@Irondude I'm using 26.03.1 myself. Remote syslogging with this option : [image: 1785306957813-ea57448c-6f86-495e-a52f-930490d56910-image.png] and that works fine. Maybe partial logging has an issue ?

Thank you @EDaleH for the reply. Just to be safe we will follow the captive portal timeouts should be less than the DHCP lease times.

Thank you @johnpoz and @Gertjan for the replies that are helpful as always.

Thank you @Gertjan for the reply. I followed your guide and it works after these steps: Add a new SAN for the portal in acme Generate updated acme certificate that now includes the portal SAN Add this new portal in System > "DNS Resolver" > "General Settings" > "Host Overrides" pointing to the portal IP Change Services > "Captive Portal" > "HTTPS server name" to point to the new portal SAN

@johnpoz Sorry didn't exsplain myself im not using ppsk at the moment I trying to get it to work, then i can turn captive portal off. I was wondering if anyone has setup ppsk with tunnel-passcode as the login in freeradius and openwrt APs?

@marcosm Applied

@Gertjan We are now at Version 26

Got it, thank you for the response. I added the feature request #16734.

@scilek said in Is it possible to create a multi-page custom captive portal?: However, there's a missing component: the PHP PDO library, which I believe should be included in the default installation A 'default pfSense' doesn't use SQL. If you need SQL yourself, all you have to do is : said in Is it possible to create a multi-page custom captive portal?: Note : Just install (don't need to set it up) the pfSense FreeRadius package, and you have the MySQL client PHP part installed as a bonus. @scilek said in Is it possible to create a multi-page custom captive portal?: the person that asked me to concoct the custom CP to obtain a DNS name I have the PHP PDO library : [image: 1770622043000-9f66c3f2-fb12-4d0a-bbc8-ff1878fc65f2-image.png] If you recap everything I've said above : There is an investment to make : a portal network which includes dedicated switch(es) and access points, and a domain name to rent. @scilek said in Is it possible to create a multi-page custom captive portal?: Also, the only information that is asked is the mobile phone number, which I think shouldn't be an issue. I agree with you. A potential portal visitor has now the choice : He uses its own phone's monthly 'data' from his phone company. Or, against the phone number, (so, example, she/he can receive an SMS with an portal access 'user and password ?!) he can use the portal.

Thank you for all these answers. We will look into this more closely.

@Gertjan ah so that's why mine won't work... I haven't found any solution yet... whereas with the old versions it worked...

@mpeterson0418 Be assured : my pfSense GUI is also only accessible from only the 'main' LAN, and not from the other non-trusted LANs which is a captive portal (I've a hotel here, that's worlds most none-trusted collection of network users ^^) and another LAN with 'other' stuff I don't trust like cameras and other "worse then Temu and Aliexpress"' combined stuff.

@Dmc it doesn't have to be easy then...

The pfctl error is already resolved upstream (and in 26.03).

@_malek said in I cannot used google analytics for captive portal: I know DNS and DHCP work as expected, but standard GA scripts seem completely blocked in this pre-auth phase. The device using the GA (?) script, or the GA script isn't portal aware. Be aware : most of the portal support isn't what pfSense does. The actual portal support must be build into the device you use. Most recent OS's are portal aware, but there can still be 'programs' (processes) that 'see' the Ethernet interface is 'up' so a 'Internet' connection' must be there. This is a wrong assumption. You don't do "Google Analytics" or anything else for that matter before the user has been authenticated on the portal. Like unlocking your phone before using it, or leaving the toilet before unlocking the door. @_malek said in I cannot used google analytics for captive portal: or is it technically impossible due to browser/portal restrictions? A good browser is portal aware by itself. Stupid browser plugins might exists that break this. That's not new. @_malek said in I cannot used google analytics for captive portal: or is it technically impossible The portal can have "Allowed IPs" and "allowed host names" lists : these two destinations types - both are eventually the same : a list with IPs - will pass through the portal firewall even when the user (device) hasn't been granted portal access yet. So it's a matter of 'find all the IPs' and your done. The thing is : you want to use services from the "big ones" (Meta, Google, Microsoft, Apple, etc) and that is hard. These guys have thousands of IPs, entire AS sections, and they swap them in and out all the time. Basically, what you are trying to do isn't the correct way. If you have to use "Google Analytics" because, for example, you sold your user's device Internet usage to Google, don't put these devices behind a portal. Or tell the users that they should connect first, and then and only then they can do what they have to do. Like : before driving a car, they have to start it first. They'll understand. The portal is just a concept that gives you the control "who us using your Internet resources". For example, I have a hotel, so I want to offer an Internet connection to my hotel clients as an extra service. Not everybody surrounding the hotel. After all, I am still somewhat (more or less) responsable for what these stranger 'do' with 'my' connection. Ones connected, the entire 'Internet' opens up for them. They can even launch nukes if they have the credentials to do so. What they are doing isn't my business. If needed, I can route all portal traffic out over a VPN connection, so my hotel visitors , who use my ISP WAN IP (!) won't blacklist my (static) WAN IP. This rarely happens though, as the portal ads - I think - a strange effect to them : they think they are watched ^^

@_malek said in Tracking User Interactions in Google Analytics for a Website Opened via an iFrame from a Captive Portal: I added all required URLs (including google-analytics.com) to the Allowed Hostnames, Google Analytics still doesn't record any events When you add "Allowed Hostname" to the portal, a DNS lookup is performed and an ( 1 !! ) IPv4 is rteurn so the pf firewall can filter to 'allow'. Remember : a firewall can ='can't filter hos names. Just "IP addresses" (see for yourself : [what is in an Ethernet packet header]( what is in an Ethernet packet header)). Gues what : "Google Analytics" isn't one IPv4 - it changes all the time, as that site (service) is used by billions any moment thousands of times per second (everybody want to do Google Analytics for some reason) so the load is DNS pre distributed / balanced over a lot of (major understatement) IPv4 addresses. https://docs.netgate.com/pfsense/en/latest/captiveportal/allowed-hostnames.html : [image: 1763986053001-41301874-d0e5-4a18-a5fe-8d55e22431f6-image.png] If you manage to get them all, and you add all the possible IPv4s to the "Allowed IP Addresses" list, it might work.

@paulatz said in Skip captive portal for static ARP: some documentation Euh, it's open source. So everything you need to know is already there. No one ever wrote a book, guide or manual about these millions of lines of 'script'. If you know what 'PHP' is : ssh into your pfSense and start to discover. this will take you some time ;) If you want write scripts for a system, you have to know (some what) that system.

@EDaleH Thanks for your input on this matter. This issue is not related to the DHCP server, especially KEA DHCP. We are still on pfSense 2.6 as mentioned, so ISC DHCP is in use, and there are no lease problems. Lease times are already configured correctly. The core reason that @Gertjan pointed out is correct and seems to be the right direction to get this resolved. It doesn’t affect everyone, but systems under heavy load during peak hours are the ones that usually run into it. The issue is a race condition under load. If the pruning process takes a long time to enumerate and remove old entries, and a new session or disconnection occurs, or if the process is interrupted or times out, the lock file may remain or the process might not finish its database write cleanly. This can leave the system in a partial state where the voucher record is removed but the session is still present. I also believe this issue also exists in pfSense+ since the captive portal code is same in the areas related to this behavior.