What I did is to configure CP to "no authentication" and load the "Splash Screen" with no post button.

That way the clients that does not know about the proxy when they tried to access the Internet directly will receive the "Splash Screen" blocking their access.

If you want to allow some machines you do it by adding their MAC address to CP, or if allow to some sites add them to the "Allow Hostnames"

There has almost a month since I started this thread but did not had any reply.

I guess then that there is no way to know the blocked sites by Captive Portal.

So maybe this should be a feature request to pfsense, and in my opinion an important one.

Noop.
You have two option :
Code it yourself.
Have it coded.

The default in my experience is <ip-address>:8000. So in your case it would be http://192.168.12.1:8000.

Provided your access points are all on the same VLAN as the RJ45 users, you should be able to get a CP page once your client tries to navigate anywhere on the internet.</ip-address>

I use Daloradius. Makes management of the accounts a lot easier and reporting - including data usage - is available.

http://www.daloradius.com/

Sorry if this sounds a bit like a commercial.

Thank you Gertjan

It seems that reconfiguring DNS (forwarder –> resolver) and removing 8.8.8.8 helped.
Problem is solved.

Hello Gertjan, thanks for your reply!

I discovered the issue, I had enabled the following options in Captive Portal settings:

Reauthentication - Reauthenticate connected users every minute

RADIUS MAC Authentication - Enable RADIUS MAC authentication

So, when I disabled them, the php-fpm service decreased the CPU usage and now everithing is fine!

Regards

Olá Gertjan, obrigado por responder!

Eu descobri o problema, eu tinha habilitado as opções abaixo nas configurações do Captive Portal:

Reauthentication - Reauthenticate connected users every minute

RADIUS MAC Authentication - Enable RADIUS MAC authentication

Então quando desabilitei, o serviço php-fpm diminui o consumo de CPU e agora está tudo funcionando!

Abraços

Did you get this fixed? I am running into the same issue.

@jimp:

captive portal is not a package -  it's part of the base system.

Fair enough

Status => System Logs => Captive Portal Auth

Logs shown in GUI will 'expire' but your can extend the delay.
You'll find the info.

If you use vouchers etc, do use an external syslogger.

Wow, I didn't even think of that. Nice work!

Got it! So, I can stop knocking my head against the wall.

I'll try the configuration you exposed

Thanks very much for the clarification :)

@muswellhillbilly:

Your clients have to be able to resolve DNS correctly before the CP page will load. So your Windows DNS server should have an external forwarder set and your DHCP settings should have the Windows server set as your clients' primary name server.

Hi the dns server external forwarder where should i point it? should i just point it to 8.8.8.8?

i can confirm that the dhcp and dns is being used in the clients pc is coming from the windows server though. i use a VM for client pc.

EDIT: adding the FQDN and ip on the DNS of windows server did the trick.

@Aliabro:

helloo friends i need some help i find the google voucher code ganrater and downlownd file but how i sat this in my pfsense to with out login to make a voucher code and get code by sms im my mobile

What about this one :
Go here : https://forum.pfsense.org/index.php?board=34.0
Read the rules.
Detail your needs.

It would be simpler if you write in your own language : https://forum.pfsense.org/index.php?action=collapse;c=3;sa=expand;e2e6bcf=c7ed5cf996928da5f4698f4e4934f651#c3

@Mr.Clay:

Thanks!

What i mean is. When I try to allow only the facebook IPs. The captive portal is just showing an error and try to access connectivity.gstatic.com/generate_204 link..

This isn't coming from the (default) portal page, neither from pfSense elsewhere.
Let me guess : your browser is 'Google' infected. Also known with the name 'Chrome'.

@watabigeye:

but it works only in view in the settings.
?

I mean this the view settings.

http://imgur.com/a/OPyt7

Aah … that one.
Doesn't work for me neither.
Because : when I click on the "View button", this URL is being loaded into my navigator :
https://pfsense.brit-hotel-fumel.net:8003/?zone=cpzone1 (I'm visiting the pfSense GUI from LAN)
Or, my captive portal is running on interface "OPT1", and uses this :
https://portal.brit-hotel-fumel.net:8003/?zone=cpzone1

Btw :
https://portal.brit-hotel-fumel.net… is 192.168.2.1 or the captive portal interface
https://pfsense.brit-hotel-fumel.net… is 192.168.1.1 or the LAN interface

Know that I use the https version (with a certificate which is signed by a known CA like startssl.com)

My portal page can't be visited from LAN because of the certificate I use for the captive portal page (URL).

But, you do NOT need this "view button", I actually never use it anyway.
The default, built in page just works very well - do NOT modify this default page if you can't write correct 'html' files (using the pfSEnse variables and syntax).

When the captive portal is set up - on its own interface like OPT1 - (LAN is possible, though) - DHCP server is running - clients use DHCP to get an IP from pfSense (and DNS, gateway, etc) and then when clients visit with a browser a http page (never ever https !!) then … the captive portal page pops up.
Like that.

Hi,

Don't keep that old version, get a most recent version 2.3.2

2.3.2-RELEASE-p1 (amd64) built on Tue Sep 27 12:13:07 CDT 2016 FreeBSD 10.3-RELEASE-p9

pfSense can not be 'hacked'.
Said otherwise : you have a 0,000001 % chance that the guy takes down your system and a 99,99999 % chance that your 'setup' is … well .. how to say it : "not Ok".

sorry gertjan  if  deactive squid cp running normally
this problem squid-into-captive portal-integration problem.

Screenshot_2.png
Screenshot_2.png_thumb

@Aliabro:

halloo frinds i need some help for my pfsense my problin is i am use pfsens captvel portol and use username and password all user and mac address on all user mobiles i at the all user expire date that is working fine off to user his date of expire but mac address is not off the user and net is workig on user mobile i go to manualy mac address and delte on user mac address and net is off on user mobile i need to mac address working on username and password expier date off the net on user
:(

What I made of it :
One user doesn't gets disconnected.
Right ?
:)

Btw : the captive portal always uses the MAC address as a device identification.