Services –> captive portal --> "allowed ip addresses"

Thanks

@dclemens: I'd rather go with pfSense, but I need the option to limit the volume we allow each user to use on a daily basis. And I understood from a previous reply that this is not easily doable in PFS. Maybe you could comment further on this? Cheers Using FreeRadius as AAA solution with PFS can help you to achieve that. Yes, I know that it is not easy but there is "small" application (dial-up admin) added to FreeRadius which can be used to do what you need but you must to put some effort to get that running as you need. It is true that you need to know some scripting/programming and SQL to set/fix some things (not in PFS) but it is FREE. If your budget is not tight or not-existent go for other solutions. Well, if you are a good programmer you can write your on application behind FreeRadius, PFS have all what you need. That's only my opinion and some other people will say differently or disagree with me but … it is up to you. Regards

@illamas: I've got RADIUS working with CA to another box, I also want to use local accounts for guest users (to have expatriation dates and such) I have searched but don't seem to find a solution. Anyone have an idea? You can use database behind radius and then re-authenticate user in some period predefined on CP. You will need to write some business logic for that to work. I think that there is some example in free-radius (application dial-up_admin) how to do that.

Possibly cisco controller is using a tunnel between controller and access point so that it can enforce policies to the users who connect to wireless AP. Use the spare interface which u have on pfsense to connect to Cisco controller and see that the whatever IP you are assigning to that PFsense spare Interface will be the default gateway for cisco controller. Enable captive portal on that spare interface. In captive portal allow requests to dns server ip without authentication. and disable all the captive portal authentication on cisco controller and keep it as open SSID without authentication or use a simple wep key so that u can provide basic authentication for wireless Access. Enable DHCP on pfsense Spare Interface. things should work fine for you. :)

Thank you for your reply. We will try it out once stable version of 2.0 release.

@SiY11: You could turn off hard and idle timeouts in the CP so they only need to login once, the problem with this is if they use a different network card/computer they must login again. Ok, this solution sounds good. I think, that ought to work. I'll try this. :) Thx! Edit: hm, ok I tried … next problem ... each user can now access the internet from this pc. I thought only the user, who was logged in, can access without a new login.

Thanks a million for the explanation i was trying to figure out how to copy the config file but after the explanation i realised its really simple i just choose backup in the web admin instead of all i just chose captive portal then opened it with excel 2010 and chose as an XML table and it looks like this which is very similar to the excel sheet i have of the new users [image: 12696430.png] which is very similar to the excel sheet i have of the new users would there be any way to display the passwords in plain text or to convert plain text to the way its display in the XML file i.e letmein123 -> 88a0082b6c5419f41937ebcc7b876010 Sorry to be a pain but it would be a useful feature for as most of the list changes often

Suggest you use the script provided in your other post http://forum.pfsense.org/index.php/topic,27717.0.html That script will achieve your requirements. You may need to just adjust the radius call to use your local radius user file (instead of radius service call)

From the radius.inc and captive portals index.php file it looks like the following should work (Nomadix attributes): [Vendor = 3309  (Nomadix)] ATTRIBUTE      Nomadix-Bw-Up ATTRIBUTE      Nomadix-Bw-Down Imagine you would add these to your radius radreply table, e.g. insert into radgroupreply (groupname, attribute, op, value) values (“slowspeed”, “Nomadix-Bw-Down”, “:=”, “1024″); not 100% sure on this though - would be good for someone to confirm this.

thank you sir. sir, may also ask a minor clarification with the "concurrency" you've just mentioned, is this means that this will "only" work if I had put "checked" on "Disable concurrent logins"? oh, how if I would like to stop using it or remove it from running? how will I do it? /* no pruning for fixed mac address entry */ if (portal_mac_fixed($cpdb[$i][3])) based on your code, what do you mean "fixed mac address", is this the Pass-through entries? -cruzades still researching/learning how to use cron job :)

You can make your own page and upload it to the pfSense. If you put the IP/MAC of the server on which the page is on the passthrough list, then it shouldn't be much of a problem to load it into the page on the pfSense.

@LostInIgnorance: I had a problem like this a bunch of times.  If you end up changing the IP of the interface where the captive portal is running on, it tends to think it is still using the old IP.  I never did figure out what caused it, but even after reboot or disabling and re-enabling the captive portal, the IP wouldn't change.  I know there is a place through shell to edit the address manually, but I never did find it.  Easiest thing that I had found being a newbie, just start from scratch, setup all the IPs, then enable the captive portal again. Thank you for your answer. I also think if i do a factory defaults reset it will work then but it's a bit tough for me to do that now. If somebody knows how to edit the address of the captive portal manually from the shell please share :) I found a some config files but are not the right ones for editing manually the portal ip : lighty-CaptivePortal.conf and lighty-webConfigurator.conf

could set hardtimeout to 60 min, but they can just log back in.

That just means RADIUS didn't respond those times, which probably corresponds with your server rebooting. Looks like it picked back up just fine after the server was back up. At least that's what I've always seen on my IAS server, and the setups I've done for a number of other companies.