MAC passthrough on CP use keep-state option of ipfw. It's means that dinamic rule will be generate on first packet and than will be destroy by inactive timeout. In your case, i think, inactive timeout come for some reason. But why? i don't know. Let's look on your 'ipfw show'…

Possible? Sure, you can modify the logout window even more than just changing the color. Add additional functionality to it, it's all php.

thank hoba for information

Where'd you see the error? Unfortunately I can't just use it because I get disconnected periodically. Minus captive portal it works fine.

system -> packages -> install freeradius server service -> captive portar -> activate and change proper settings, pretty self explained /F

ok thank you. The problem is i have only 700ko to store, so doing all that just for that  :-X I'll try to reduce the size of my pictures, it will be easier  :D

Well no, like I said. I don't know if I should just leave it bridged or if I need the wi-fi on a subnet etc. Edit: Righty, wireless OPT interface is now on 192.168.3.1. LAN is on 192.168.0.1. I've added a firewall rule and whammo, it works. I'm on the web from a wireless client. But, er, what happened to the captive portal? It's turned on allegedly… Edit2: Ah, just needed to kill it and restart. It works. Yipee!

Thanks for your answer. for instance, I'm going to use freeradius + ldap , and waiting for the 1.3 pfsense

thanks it works now  ;D

take a look in etc/hosts

Captive portal developement is mainly done in m0n0wall. We just sync over their code and to keep syncable we don't touch this portion of the code too much. If m0n0 adds it we'll sync it over but besides that I wouldn't expect this feature in pfSense soon.

I suspect that your are not using the pfSense DNS forwarder. You can either remove your external DNS address from your captive portal DHCP configuration and use the DNS forwarder, or add the DNS address to the allowed addresses in the captive portal configuration.

just realized that the first time I grabbed the wrong file and tried to do the upgrade with the embedded, which obviously didnt work properly DOH!! once I grabbed the right file, and did the upgrade everything is working great! I have another issue, but that is for another forum post :) Thanks a bunch

The pfSense captive portal is exactly the same as the m0n0wall captive portal.

Just a side thought here. This 'problem' could be solved more radical - and more logical. If we presume that hotspot IP's, like the disconnect window, are always local LAN IP's, it would be nice to say to your browser "do not accept popups from the Internet…..' but popus coming from the LAN range should be accepted (always ?). Popups from a local source can’t be really annoying, because YOU, or the one that gave you YOUR connection, controls them. So: browsers should accept, or handle at a second level, popus coming from local IP’s (gateway in this case). On the Firefox feature request list this item exists. IE: keep on dreaming…. When the gateway isn’t local, the problem is solved otherwise: users are asked to keep the main login windows open, so they can disconnect (they have to open a second browser window!).  This is important because many are actually billing for their ‘wifi/network’ usage. Loosing the disconnect windows/button introduces the opportunity for the operator to take another hour, or more, before disconnection for ‘non-usage’.

That should work just fine. The clients don't need a portforward to be reachable by the radius server as the clients establish the connection to the radius server and not vice versa.