@canefield: Q1: lends Captive Portal itselfs to do this? Should I use another program/package? CP can be used in such a scenario, however if you expect this to be a permanent setup, you might also want to look into using PPPoE as alternative. Check the posts by luke240778 to see the kind of issues that you might encounter.

@cmb: that's not true, it means the system's routing table and will use its default gateway. Then my original question still stands. I have outbound NAT rules for both WAN and OPT. The OPT->* firewall rule allows Captive Portal users to access the internet. However Internet access only works if I set the rule to use the WAN gateway (or the failover gateway group). It does not work if the rule is set to use the default gateway. I must remove the BACKUP gateway from the OPT interface settings in order for Internet to work with the default gateway in the rule.

0 checksum would just be hardware checksum offloading. Can capture from the destination to get the checksum that's actually on the wire.

Oh I just noticed your captive portal is way over on the left side of that diagram, I assumed it would get dropped in where the AP is. That's not possible, it's not possible to use any CP when it isn't inline in the network path to the Internet.

@dhatz: Well, there has to be some in-line device that coordinates this type of functionality, unless the WAP itself has what's needed (e.g. some people do the CP functionality in Linux-based APs). If you really want this to be: Cisco LWAPs -> L2 switch -> DSL line, then you'd need to check what options those WAPs offer you. that's how I  have it .. they are not LWAPS thought not lightweight, cisco ap - l2- switch - dsl line … I just can't put a cp server in every location, cisco aps 1200 series don't offer hotspot. anyhow thank you for your help.

@mutheu: Thank you for your quick response. But I use external Freeradius server. Will this have any effect? Aahh, I am sorry. I talked from the pfsense freeradius2 package. But this confirms that it is a NAS problem and not a freeradius2 problem because the effect is the same with CP and freeradius2 package from pfsense :-) edit: ../raddb/sites-available/default go to "preacct" section and comment out "acct_unique". Then try again.

@Gertjan: you can get these for free these days. Well, i am currently living in a somehow very stingy part of our planet right now, so, nothing is free around here, sometime people even try to charge me for what i own! however that's a bit off topic  :D I choose the USB stick installation after having seen all the reports of people loosing all their files once PFSense was installed, and guess what? everything i had on the stick got erased, however they were just duplicate files, so not a problem. I got another spare old pc right here, i was hoping of being able to operate both PFSense and my webserver on the same pc, but once PFSense is running, doesn't look like i can do anything else on that pc…. :-\

@Nachtfalke: http://www.mhfoto.com/web/pfsense-traffic.jpg On the right you can see the IPs. But you are right. Not very comfortable. Ya that works but what I really want is a webpage like the captive portal how it shows logged in users and it would have speeds. That page u linked to flashes faster than a busy whore lol

@ermal: Its a patch to the OS so you need a new snapshot. Please advise how to apply new snapshot without losing everything. Thanks

The primary file is /etc/inc/captiveportal.inc pfsense creates and uses files under /var, e.g. /var/etc

@mutheu: For me, I think the best solution to your problem is to setup a Radius server and use a counter. Instead of specifying 5 days, you simply convert the 5 days to seconds : 5d x 24hrs x 60min x 60sec. Counter will keep on reducing time even if your server goes off, it will pick up on where it left - especially with re-auth every minute. The time counter module only works on "accounting stop" packets. The time value in Accounting stop packets from CP are not correct in 2.0.1. Ermal did some changes on this (redmine) and perhaps it will be implemented on 2.1. But I am not up-to-date with this problem. But if the NAS or the server reboot - the user has to re-login - and that's the problem and not the "time management". That's the way I understand qbik's posts.

Yes I understand that. But is there anyway to have a Pass-through MAC for a limited time? Some hacks? Thank you for your help, Antoine

I managed to delete it and get back to working.. but this basically doesnt solve the problem. Doesn't anyone else out tehre have a customsed login and error page that both work ? and the error page show the error message from radius server?  Invalid credentials.. and MAC address invalid and so forth.

Thanks for the reply.. another thing in the meantime.. my Website is currently hosted else where.. am i able to have the CP login page on my site (www.mysite.com/login.html) for example ?  Can the CP settings on pfSense redirect user to login page that is on my site? I want to build and host my own webserver shortly.. but if i can get this working noe it would be great.. so i can use google analyitics on it.

Ok.  I appreciate that.  That is what I expected.  I'll just use router ACLs and be done with it.  Thanks!

If you'll be using CP then you shouldn't run transparent Squid on that same pfsense system. I guess it's a matter of personal preference, but I'd prefer to run disk-intensive software like Squid on a separate system anyway, with its defaults tuned to be a "server". Others prefer to have an all-in-one system, running a dozen services (e.g. antivirus, caching proxy, URL filtering, reverse proxies etc). IMHO a reasonable compromise would be to run a couple of VMs on the same physical server.

@filip_pag: Is it possible to create user account to access internet that is fixed to one MAC or IP address? for example user: jerry jerrys MAC: xx:xx:xx:xx:xx:xx / IP: xxx.xxx.xxx.xxx so jerry can log in only from devince with that MAc/IP Do you mean that the access should only be allow if: Username + mac + IP are correct !? This cannot be done in just one step. I do not know any possibility to solve this in just one check. MAC <-> IP matching: enable DHCP and static MAC entry create a firewall rule for this IP which allows traffic and disallows other traffic from other IPs Enable Static ARP entries on DHCP for username/password check you can use different things: CaptivePortal Squid in non-transparent mode with user access Perhaps it will be possible with squid or CP and freeradius2 package as user backend. Setup a username/password entry in freeradius and add a custom "Check-Item" attribute for the client IP address. This will look like that: Framed-IP-Address == 192.168.10.125 So if the NAS (CaptivePortal or Squid) send the "Framed-IP-Address of the host to the RADIUS than you can do a check against this attribute (Framed-IP-Address) and if the IP is wrong then the user will be rejected. You can do this with the MAC-Address, too if CaptivePortal or Squid is sending this: Calling-Station-ID == 00:11:22:aa:bb:cc But be careful, both attributes need to be CHECK-ITEMS and must not be REPLY-ITEMS to work !!! You can use both checks together, too. Hmm - if I read this again, then it could be possibly feasible to realize that in just one step  ;)

I am using DMA Softlabs Radius Manager software along with my RADIUS server.  This software has a User Control Panel which you can setup and the user can login, see their account details and change things like their personal details and password. I suggest you take a look at this.