@slth: This might be a stupid question, but as the bug if ipfw related ("ipfw entrystats is returning wrong values, leading RADIUS accounting to have values considerably higher than reality."), does this mean every bandwidth monitoring package mentioned at http://doc.pfsense.org/index.php/How_can_I_monitor_bandwidth_usage%3F has the same problem? No, none of those use ipfw entrystats. ipfw isn't even loaded unless you're running CP.

@slth: ISC dhcpd only checks via ping to ensure that an IP is not actively in use when making assignments. Making a static mapping does not "reserve" that IP out of the pool. The static mapping in this case merely represents a preference for an IP, and others are not prevented from taking the IP if it is not in use. So suppose I'd have a DHCP pool 192.168.0.10-192.168.0.50 with static IP mappings for ip 192.168.0.20 and 192.168.0.30, associated to the respective mac addresses. The text you quoted is meant to say that DHCP static IP mappings must be outside the range reserved for dynamic IP addresses. So if you have a DHCP pool of 192.168.0.10 to 192.168.0.50 you can have (for example) static DHCP mappings for 192.168.0.60 and 192.168.0.70.

Ok, narrowed this down to a specific setting. When I uncheck the "Enable per-user bandwidth restriction" traffic passes as expected. When I check the box and my default download is set to 4120 and default upload is 1024 traffic does not pass.  my radius server is set to return wispr-bandwith settings that where working with 1.2.3. these settings are wrong for 2.0.  They need to be multiplied by 1000. looks like you can't use the same radius server for 1.2.3 and 2.0 if you use wispr to set bandwith. read http://forum.pfsense.org/index.php/topic,41372.0.html

The way that the web request is forwarded, it must land on an IP address. You could setup a DNS forwarder entry for the hostname you want, in the captive portal html (it will take php) code up a redirect such that if the URL is the IP, redirect to the hostname, then the user would only see the IP address if they caught it quickly before the second redirect kicked in.

Talking to myself. Hopefully it may help someone else in the same situation. I edit the following files: /etc/inc/captiveportal.inc /usr/local/captiveportal/index.php References to port 8000 was changed to 8080. Enabled Captive Portal and viola! I'm now redirected to "pfsense-ip":8080 and ends up in the Portal login page. /var/etc/lighty-CaptivePortal.conf was automatically update by the changes made to the above files. This was done one my own (home/work environment) installation of pfSense. Next test will be to move my own pfGUI to another port than 80 and then change the Portal port to 80. I'll be back on this one. If anyone here with deeper knowledge can fill in on the subject I'll be very glad. For example will my changes survive a reboot? Is there another way of doing this? Using a proxy in someway? PAUSE I'm back. Changing the port to 80 was no success. Resulted in a redirect loop. Don't have the time right now to continue my experiment. But if somebody has more knowledge and wants to fill in, please do! /iorx

What reports cannot access no dns? I can think of many more interesting things to do than meddle with pfSense pages trying to make one report cannot access no dns Sorry, I don't understand the following and have no idea what "it" refers to. @dy6amj: what i want to do is there should be a captive portal so that it cannot get access thru the wan Firewall rules would normally be used to prevent access to the WAN. Maybe another reader can figure this out.

I don't think captive portal is quite the right tool to do this. How about using outbound NAT on the wireless client interface to redirect any outgoing port 80 connect to the IP address of the wireless client interface? I don't know enough about outbound NAT to know if its possible to redirect to the "local interface IP address" but if it isn't, it should be possible to redirect to one of the allowed external servers (which presumably are under control of the same organisation) which then issues a http redirect back to the local server. I have not ever configured squid but I see it is described as having the capability of rewriting URLs. Perhaps it could be configured to not cache and to rewrite URLs to the local server if they don't reference the local server or one of the allowed external servers. There is a pfSense vHosts package which extends the inbuilt web server. The fairly limited RAM on an Alix might make it unsuitable to be running packages like squid and vHosts. (My home pfSense runs fine with 256MB but I run a small number of small packages, certainly nothing large enough to force my system to swap.)

I have used them as both routers and AP's. I used them for radius auth for AP's. Mikrotik is a very stable product and has been used to provide wireless to entire cities.  A lot of wisp use mikrotik. Mikrotik has many features and in some ways I prefer over pfSense especially as an AP or WDS/mesh.  It can do both gui and command line like cisco which some like as all configuration can be done via ssh. I went back to pfsense for 2 reasons.  1.  Captive portal/radius improved in 2.0 2. I am very familiar with configuring pfsense and mikrotik required too much time for me to learn.  Also no paid support for mikrotik though many 3rd party engineers can support for $65/hr. If I were to deploy a very large infrastructure ..ie 25 to 50 AP's or larger I would go with mikrotik…  Cost wise it is also less expensive as it is primarily used by WISP's..... I would definitely recommend buying a level 4 mikrotik router and playing with it.  The experience was worth it as I now have a better solution for wireless which feature wise is on par with cisco for the price of a linksys/netgear device from a retail store!

I dont know about using the FreeRADIUS package if that is what you are thinking.. but all this is possible with an actual external FreeRADIUS server.  I do basically all of this already with FreeRADIUS with MySQL backend, and daloRADIUS for web management

I use Ruckus equipment, and highly recommend it.  Very simple to setup and install, cheap enough also.

@Metu69salemi: If you have wireless users, then that repeated mac-address could be access point. because there are quite a few ip-addresses behind it I have wireless users, but all the access points are config in bridge, so pfsense always see the real MAC of client.

pfsense adds a "captiveportal-" prefix to all files uploaded, so ensure you're referencing the correct new filename of the image file in your html form.

Hi, i just solved this issue. As it turned out, it was the switch, that was dropping some of vlan tagged packets when set in non-vlan mode. When i set it to vlan aware mode, all started to work.

Is the dhcp server for network interface in which you have enabled captive portal using the same interface IP as the DNS?  Not setting this up properly will cause this.  Ahem… First hand experience....