Hi!

As I understand it, you want a way to see from what accesspoint a client is connected and then assign access rules based on what access point they are connected to? And you only want one captive portal connection for these multiple levels of access?

Do you always know exactly what access point a user is going to be connected to? What if they walk over to another and get other access privilegies? Isnt it better to base privilegies depending on what group they belong to? Do these users belong to different groups within the organization or are they public users? Maybe a mix?

I dont know if  i have understood what you are trying to do here and I feel that there is probably a better way than connecting vlan to users and try to set access rules based of that information.

In most cases you probably cant even get the vlan information from the client itself. Clients usualy dont know what vlan they are on, only the switches and APs knows about vlans and strip off the information before the frame is sent of to the client.

What if you configured one vlan per ssid, made a captive portal for each ssid and each group of users having the same privilegies could connect to that ssid using its captive portal?

This http://www.papy-team.org/munin/brit-hotel-fumel.net/pfsense.brit-hotel-fumel.net/index.html#portalusers has been done by counting the number of record in that database.

So yes, the only limit is our knowledge about PHP  ;)

I think that might be good enough for what I need to do. Now that I know how to do it, I see exactly where it's documentation.

I guess my question is which port do I need to be using, and what do I use for an admin password if my web gui is set to use radius for logins?

You might be able to have javascript auto-submit the form, but browsers may/may not allow that. That is more of a question for a web developer than the firewall.

Thank you; that's interesting and I appreciate your response.
I think I'll look at that further once I solve the php error showing in the logs, for example just now: php: /services_captiveportal_hostname_edit.php: The command '/sbin/ipfw -x cpzone /tmp/hostname_rules' returned exit code '71', the output was 'Line 3: setsockopt(IP_FW_TABLE_ADD): File exists'
when I added a website to the list.

I will try to submit the ticket.
Regards,
David

you need traffic to pass through pfsense in order to get a captive portal ….

so you need atleast 2 interfaces (WAN & LAN).

You typically run the portal on LAN, and connect the internet  on WAN

@cmb:

That log just looks like they got click happy on the submit button of the portal page and submitted it multiple times. No harm in that, but it will show as multiple logins since it is.

The "No valid RADIUS responses received" is what it says - your RADIUS server didn't respond.

Thanks you

About No valid RADIUS responses received, my RADIUS respond but this message appear whenever subscriber login fail (wrong password, wrong username, …) only one time fail, this message appear and must wait about 20s to login normally again.

That kind of scale is no problem for lighttpd, that's actually a low load. Whether you make 12 requests or 1 to the portal page, it shouldn't matter. Make sure your other resources in the page aren't generating redirects themselves. Also enable "Maximum concurrent connections" in CP so if there is some system out there making tons of requests in the background (usually malware) it's not trying to deal with potentially thousands of requests a second to a bot. The only thing I see on that crash is a 4 year old lighttpd bug that was fixed 4 years ago and long since fixed in our releases.

Support probably your best bet. One of us can check out the crash dump and track it down from there. If you go that route, include a link to this thread in that ticket for history.

@Derelict:

…..
Most "portal page won't come up" I see are due to trying to go to https sites.

:(
Stupid me: I forgot that one !

Hello Gertian, thanks for reply

but my question is another, sorry for my english…:)

So enabling the captive portal to its default pfsense displays a page in html for authentication .

I would like , first to upload the page , do the backup.

If I can do that You can indicate which folder is saved default page.

Thanks for reply to everbody

bye

It's a shame that this isn't a feature. Obviously pfSense has the capability since there is a setting to disable concurrent log-ins altogether. Looks like Windows doesn't have too much capability without 3rd party software, in terms of accounting.

Hi,*

Please clarify.

What do you mean by "your registration" and "your password" ?
What about "stones" ?

You can upload a home-made captive portal authentication page - and this page can do whatever you want it to do.
Some examples exists on this forum.

After completing a full backup, we went ahead and re-installed the same firmware through the Web GUI. This corrected everything and we rebooted successfully. Thanks everyone for the help.

Hi

did this work out for you? if not another solution may be to connect AD to a freeradius and connect that to your captive portal.

http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO

You really should present a diagram.  Just put a couple CPE units on it to represent them all.  I can't really tell what you're talking about Re: LAN and OPT1.