Hi again Sorry about my spelling I'm not very good at it.

It is about Captive Portal in that I want the captive portal to be active and blocking all users from the internet but want to figure out which hostnames I need to allow to cause my client computers to behave less flakily.

No way  ;) [ Check out yourself : /usr/local/captiveportal/index.php - lines 262 -> 280 and the function local_backed() (/etc/inc/auth.inc - lines 370 -> 401) So, actually, its phpeanuts to send back the "why" information ;) ]

Old topic, similar problem. After some of my guests complained about lack of internet access through the Portal, I found that they were trying through the Google app, which requires logging in to their Google account before anything else happens. Either they didnt have a separate browser installed, or if they did, they didnt know how to use it. If they had Chrome, that worked OK. On this subject, I get a lot less problems reported using the username only for logging on. That is enough to keep out the casual leachers, which is all I care about.

Unifi already support dynamic vlan over radius. I just need to make it work thru the captive portal. Anyone has succed with this?

It works! Thanks. And it also works if the pfsense LAN interface and the combo-router are on different subnets (10.0.0.x for pfsense and 192.168.1.x the combo-router). The smartphone gets a 10.0.0.x IP and 10.0.0.1 as the default gateway even though it cannot see the combo-router at 192.168.1.254. How can this be? Can the smartphone see all MACs?

@doktornotor: You obviously are NOT supposed to delete certificates that are being in use. In fact, I filed a bug about thing being allowed, already fixed in 2.4.x - except for the WebGUI case. https://redmine.pfsense.org/issues/6947 I did NOT delete the certificate while it was in use. I selected our certificate and deleted the default.

@jlorenz89: 2. They are redirected to the captive portal and have to accept the terms but pressing accept Use This means "Authentication method" must be set to "Local User Manager / Vouchers" or "Radius" so a login page (with hidden authorized user and password)  shows with your terms of use. Using a login page means : no more MAC temporary usage. What you want isn't possible. Are these terms of usage that important ? What about printing them on a paper, so you can skip this part..

Ok, right. This is the English support section, the other languages are here (below).

Just make sure they can't just "choose" to be elected your spanning tree root or something stupid like that. Are your wired and wireless networks on the same layer 2? You might consider separating them else someone who connects wired and wireless at the same time with something like an Airport express in "join a wireless network" mode will create a bridging loop. probably many ways to accomplish that with two ports to the same layer 2 in the same location. (one wireless, one wired). You ought to be able to just use the same CP on both networks.

No. Not until someone writes proper hooks for ipfw to be used in packages. Cf. https://redmine.pfsense.org/issues/5594

Thanks will look into it

@doktornotor: CP and Squid in transparent mode will NOT work. Thank you very much!

FreeRADIUS on pfSense? You can't. If you use it externally, there might be a GUI that lets you do that somewhere, but it's not a pfSense feature, it would be some other bit of software.

When trying to connect to WIFI with mobile devices it just hangs in "Connecting WiFi" page and not get redirected to captive portal. During this time shouldn't I be able to connect to captive portal by manually typing the captive portal URL. When I do so on mobile, it says connection refused.