Awesome!  That worked.  I had turned on Advanced before, but had not deleted the rule.  Many thanks!!

Many thanks for the input, but as I tentatively suggested the other day, in fact the problem was caused by my firewall rules - I was blocking too much!

Ah, ok.  Sounds easy enough.  It sounds to me like your clients can't resolve DNS, therefore can't get to much of anything.  What I would do (and what I have done before in a relatively similar situation) is create a bind instance that serves only this network and hand it out to clients.  In this bind (or whatever your DNS server of choice is) configure it to answer www.yourdomain.com for every query.  You wouldn't even need the CP for that.  You may want to also block DNS queries to any other servers to prevent folks from just configuring their own resolvers. nb

In fact, I use CP only for wireless user. Then, I just need to send a email for a user that user wired network. I'll try to explain. I have a wired and wireless network for my company. I use PF and Cp only for external people of my company. For some security policies, I need to change the CP password everyday and send the new password to the reception email. Then, when a external person come to the reception, the receptionist can give the new password of the day. To do this, did I realy need a external mysql database? can't I create and cron job to launch a scrit to change the local database?

Use onload to execute a javascript, which uses setTimeout() to submit the form after a few seconds. Note however that you still must have a hidden form embedded in the page.

Thanks! I look forward to testing it.

Stanelie Sorry by the time, I was on hollidays  ;D I don't remember what was wrong, but it was somehing with the Radius server on W2k3 server, so use this guide to solve your problem http://www.pfsense.org/mirror.php?section=tutorials/cp_config/radius_win2k3.htm bye

@mechanicalmetal: But as far as setting the subnet for the interface, do I do that through pfsense? On PFSense go to the menu 'Interfaces' then to 'Opt1' Set 'Bridge with' to none and Set the 'IP configuration' to something like 10.2.0.1 / 24 or you could use 192.168.2.1 / 24 your choice on the IP you want. Services -> DHCP Server -> Opt1 And set up a DHCP range for your optional interface. Firewall -> Rules -> Opt1 tab Action: Pass Interface: Opt1 Protocol: any Source: any Destination: any Description: Opt to Any That should be enough to get your Opt1 interface working for a laptop or anything connected to it.

Hmmm, is this a NAT or routed setup?  All of mine are currently routed and I don't see this behavior.  Once the timer is expired their connectivity is killed.

No problem.  If it can be done with the CP, I've probably done it.  =P

u can write it to conf

I'm not sure about IP address because engineer write it to me. But the structure look like in the picture. For NAT. If they don't use NAT. We can put only CPU on the router1. But if they use NAT. If we put CP on Router1, 3,4, 5. How about re-authentication problem? If user already login on Router 3,4,5, Do they need to re-authenticataion on Router1?

I replied at this other post. http://forum.pfsense.org/index.php/topic,10392.0.html Please, keep this under the same thread so it can be tracked easily.