Hummm. Good details here. I guess you found this http://forum.pfsense.org/index.php/topic,56812.msg303237.html#msg303237  ;) edit: Better yet: it's in the oven : https://github.com/bsdperimeter/pfsense/commit/f89afb4765f317a532cb71f3b3883e8f897cfebb and will be served when ready.

@elratt0r: The php error came from an invalid initialized array. See attached patch. Kind regards Michael Thanks, made a pull request on github.

@fsantaana: Does the built-in freeradius2 package allowing pausing of the timer or must this be done through a MySQL database for the accounting? This must be done through CP (disconnect) or the user itself (CP logout window). So when a user authenticates the CP sends an accounting start packet with the time. freeradius is counting the time transferred from CP to freeradius. If CP sends an accounting stop packet, the freeradius is stopping counting. accounting stop is in general send when the user disconnects from CP. The user can force that with the "logout window". The time counting used by freeradius is just counting the time the user is really connected. Using a voucher is different - there you start a countown with the first connection - no matter if connected or not.

Give it a try…...& let me know your result. http://forum.pfsense.org/index.php/topic,57260.0.html

Thanks for you help. In my DCHP service on pfsense, i put a dns server address, so that clients get this dns address. But solution is to drop this dns address in dhcp service configuration for this interface and enable dns forwarder.

It seems that it is something special for freeradius. I found this on the web: > Looking at that debug, where exactly is it resetting the counter ?   The "counter" module is resetting the counter. > In the db.daily ?  Because it's not resetting in SQL.   Yes, the counter module doesn't say it's using SQL. > Also what is the db.daily ?  How do you read that file ?   You don't.  Its used by the counter module to keep it's count. > What I'm trying to achieve here is to get mysql to reset the counters > its doing, and then start a new row if possible. > Within the table radacct.  AcctInputOctets AcctOutputOctets. > Is it possible to do this ? > Does the counter actually do that ?   You want sqlcounter.   Alan DeKok. http://freeradius.1045715.n5.nabble.com/sql-counter-clarification-and-issues-td2741790.html

@Nachtfalke: Yes, it is. Could you point me to, what a solution might be?  :)

Your WAN is on private IP space, do you have allow Private Net/bogons on the WAN interface? Looking at the radius debugging output would have shown that there was no connection to the radius server.

use the radius to restrict bandwith per user not vouchers.

I solved!!  I unchecked :  Do not use the DNS Forwarder as a DNS server for the firewall -> in System: General Setup. Now DNS lookup in -> Diagnostics  resolve in my FQDN . thanks bye

In 2.0.2 and newer versions that are going to be release the problem has mitigated presented on that paper.

I would say you find a common basis for all clients which use CP. Make sure the network settings of a working client are the same as the settings of a "broken" client Use the same browser or change the browser if it is not working Try the same destination URL and try different URLs to find differences between the URL. If you have one client which gets the CP page, gets correctly redirected after authentication - compare this client with clients which are not working.

Check the docs, i think you will find the answer ;) http://doc.pfsense.org/index.php/Main_Page http://doc.pfsense.org/index.php/Captive_Portal PS: a "forum Search" will help too  ;D

thanks for the reply now i'm enlightened… ^_^

Local user manager/ vouchers is selected. It then is supposed to pull from the user manager where the access code is created and saved.

That is better handled inside your Access Point. Your Access Point may have a way to do authentication via RADIUS or similar (802.1x, WPA2 Enterprise) that would require a password from the AP to associate and get an IP address. Otherwise there is no way to get someone a portal login without an IP address (which you already asked in another thread) and at that point they're already on the local network, but AP isolation can prevent them from reaching other wireless clients.

@nguy5417: However, anyone that connects to my AP can connect to my network resources. Can that be blocked until the user authenticates? You would have to block "local" access in the AP or put the AP on a separate pfSense interface so pfSense can control the traffic from the AP to "local" network.

So I ended up using pfSense 1.2.3… user self registration via the php script above works beautifully. Too bad I couldn't get this working on 2.0. Since deployment I have run into some other issues in pfSense 1.2.3 that 2.0 would fix.