any idea please ? :'(

The pfSense captive portal is pretty much time-based, not usage-based.  I think making it do that would be a great deal of work.

As said, this isn't a pfsense issues, but an error in the design of the network hooked up to the portal interface.
When using more then ONE AP - and these AP's works like switches, this kind of trouble pops up.

We are in 2014 now, so some OS's that clients use have this famous question:
Is this a private or Company network ? Or a public network ?
(I guess we all know now which OS this is  :) )
If the clients choses "public", then their PC can communicate ONLY with the gateway, and block ALL other incoming/outgoing connections.
Problems solved, the pfsense portal network engineer can go the bed again.

But, of course, there are clients that consider the portal Wifi network as their home network - and they share all their holiday photos on the network ("because then it works at home"). They just hit 'Home network' when their OS says "This is a new network, please chose …".
The same clients (our Wifi portal network clients) start to yell when they discover that pure strangers are 'surfing' their PC ... ad all their holiday photos are indexed by Google Images a couple of days later on.
(You better get a lawyer when you get home, your wife isn't gona like this one)

Anyway: I present https://forum.pfsense.org/index.php?topic=66368.msg365658#msg365658
It started here https://forum.pfsense.org/index.php?topic=1268.msg7542#msg7542 (even Sullrich was surprised  ;))

It all boils down to: activate AP isolation - and route all trafic from clients to gateway - and back. NO CLIENT TO CLIENT communication.
The rule to be enforced is "You, as an pfSense operator, do NOT OFFER A LAN PARTY, but Internet Access only".

@xamber:

…..
Well i get the following error "Fatal error: Call to undefined function mysqli_connect()"
....

Troubleshooting wouldn't take long if you called this function: phpinfo();
You will discover that PHP as it executes on pfSEnse, has NOT, by default, MySQL (client) support activated.

I don't recall how, but there is a trick to activate it.
(it's on this forum).

Awesome, used lower case "portal" and only that one turned on in the test system :D  I'm learning slowly ::)

Edit: My meeting got canceled so no live run, but it is working great on my virtual machines.

@xzmz:

2. Radius

Miss-communication with a Radius server returns a message:
"System reached maximum login capacity"

Btw:
Client get disconnected ?
Means: look at your portal log
Are clients disconnected ?
Because, if they don't the all goes well: the system will blow up (== "System reached maximum login capacity" because clients connect - and have to disconnect (are disconnected) to make pleace for new connections)

@xzmz:

4. hard time out is present
5. IDLE timeout 10080 min; Hard timeout 40320 min; DHCP lease time 604870 sek

Hummm.
This DHCP time-out is fine for a wired LAN setup using fixed clients.

Portal software runs fine with:
Idle time out : 3 -6 hours max
Hardware time out + xx %
DHCP time out hard time out + xx %

Wifi clients, per definition, are network-guest-users.
If your clients are semi residential, (staying there for days or weeks) or if they need a connection that is active for hundreds of hours, you should use something different as what pfSense offers.

Btw: the program logic can handle the clients, although I really would like to see what happens when the portal software keeps hitting hard this one:
/etc/inc/captiveportal.inc : line 1366 + 1377 (and 1389 + 1409).

Y'know, looking at the paragraph again, I think I misunderstood it. Thanks for that pointer.

Which is why you need to look at history (graphs) because if you have a flat line at 12Mbps, then that's all you have, not 18.  Don't guess.  Measure, log, and evaluate.

WAN gateway quality graph will likely show you exactly why it's slow.

Thanks for u help , sir

Glad it's working.

You probably want to start another thread with your specific openvpn question in the openvpn forum.

@mendilli:

could you please tell us where(inwhich file, which line) this code must be replaced

It was mentioned in reply #15.

Function configure_cron() in services.inc, replace the pkill line with the new code.

@GS850L:

Update: I was reading through captiveportal.inc and found this gem on line 663.

/* activate ipfw(4) so CP can work */
mwexec("/sbin/sysctl net.link.ether.ipfw=1");

It appears  that : "/sbin/sysctl net.link.ether.ipfw=1" turns on ipfw and therefore CP and
"/sbin/sysctl net.link.ether.ipfw=0" turns off ipfw and therefore CP.

I tried it on my test system and it seemed to work. Haven't spent much time testing though.

the captive turns off and dont turns ON! :(

Hi,

That feature won't let more than one user/voucher logs in. It will disconnect the previous for the new user.

Look here

https://forum.pfsense.org/index.php?topic=46015.msg445420#msg445420

@rahulmkhj:

Hello Everyone!

I want to put my captive portal pages i.e. splash, login form etc. on some external web server and when user tries to connect redirect them to that (login page on external server) instead of one hosted on pfsense itself. Is that possible??

Thank you,

Rahul

First sry for my bad english

I made time ago this…

At server side (replace the ip of external server)

<form action="http://192.168.1.2/index.php" method="post" id="redirectform"> Javascript is disabled, click to </form>

At your external server side (change ip of PFsense server)

<form method="post" action="http://192.168.1.1:8000/"> Código </form>

In web page of PFsense, open ur captive portal -> allowed ip addresses and add the ip of your external web server there.

Is just this ;)

networkinggeek,

Radius server allow you to set the time period user are permitted to login.

For freeradius, you set Login-Time attribute to the appropriate time period for your particular user, each user can be assign different range. Logging in outside of this period and user will be rejected.

It works on native freeradius, the pfsense package should have this feature.