Yes. Good access to global DNS prior to punching through the portal is a requirement for CP to function. Well, DNS queries have to return some IP address for the client to try to connect to.

I could solve the problem by adjusting the MTU on the wanted Interface to be around 1400 Bytes . thanks for your trying to help

The limit's 1 Gb per pipe, which would be per-customer in that kind of scenario, so that shouldn't pose any issues for you unless/until you want to offer >1Gb per customer.

You can restart the lighttpd instance associated with a captive portal at the CLI, but it's different than actually saving on the CP settings to reinitialize the portal: : ps uxawww | grep "[l]ight.*testz" root    54907  0.0  2.4  46636  5472  -  S    2:03PM    0:00.00 /usr/local/sbin/lighttpd -f /var/etc/lighty-testzone-CaptivePortal.conf : pfSsh.php playback svc restart captiveportal testzone Starting the pfSense developer shell.... Attempting to issue restart to captiveportal service... captiveportal has been restarted. : ps uxawww | grep "[l]ight.*testz" root    58835  1.0  2.4  46636  5472  -  S    2:04PM    0:00.00 /usr/local/sbin/lighttpd -f /var/etc/lighty-testzone-CaptivePortal.conf

First - I am NOT a windows person (I work mostly with networks and Linux/Unix).  Our Windows server person set up what I think you are looking for. They set up their domain controller to provide a Radius server.  Then depending on the settings in the domain controller, users could also be in the radius listings.  The radius listings contained user names and passwords.  Then when somebody was to authenticate by VPN on a PfSense box, the PfSense box would perform a radius lookup and those in the radius server would then authenticate in the VPN on PfSense. I hope this helps some… North Idaho Tom Jones

You can only have a single CP instance on a given broadcast domain. There are a lot more complications to it than CP itself, for instance your clients would have to be on a different DHCP scope, which isn't possible unless you have DHCP reservations defined for every device on the non-default subnet. In that type of network environment, if you're not isolating broadcast domains between different customers (I presume the use case there, not sure why else you'd want diff domains), your network design is fundamentally wrong.

@FeierAll: …. Do i miss something? MAC addresses that are added to the MAC tab are not considered as "Logged in" anymore. They have gained permanent CP access. Just check that that they are added to the MAC list (portal setup page) when they loggin once. The MAC tab (pages) is stored in config,  so will last after a reboot.

Hello. I believe that the error is in the custom file that I created. When I put the url field after authentication it works perfectly, I would like to turn this option off if I leave blank post authentication field simply nothing happens after authentication. I would have to change these file lines?

Either that, or set your PFS as a DNS forwarder and set the firewall as your clients' primary DNS referrer in your DHCP configuration.

Strange… some hours later everything just worked fine on the new Machine... Until now there are no more problems. I have multiple Nets... Opt1, Opt2, Opt3, WAN -> Wan Connections LAN -> Management Interface 192.168.30.0/24 Opt4 -> VLAN Interface for: VLAN 31 -> WLAN 192.168.31.0/24 VLAN 32-36 -> Different LAN Vlans 192.168.32-36.0/24 I think that there was a Problem with the Multi WAN and the configured DHCP Servers... Thanks @ all for the support ;) Hope that everything works now as expected. Cheers

Hey ho, okay - got it! The Vouchers are generated "ont he fly" with the file "usr/local/bin/voucher". As written in the documentation the vouchers are generated based on an RSA Key. That means there is NO Database in wich the NOT USED Vouchers are stored!! So i manipulated the config.xml file and did an import of this config. I needed some trials because monowall and pfsense have a slightly different format but figured it out. After "importing" the Vouchers i still had to mark the already used Vouchers within the function in the portal section but everything is working fine :) So anybody having the same problem try this method!

Hey ho, okay - got it! The Vouchers are generated "ont he fly" with the file "usr/local/bin/voucher". As written in the documentation the vouchers are generated based on an RSA Key. That means there is NO Database in wich the NOT USED Vouchers are stored!! So i manipulated the config.xml file and did an import of this config. I needed some trials because monowall and pfsense have a slightly different format but figured it out. After "importing" the Vouchers i still had to mark the already used Vouchers within the function in the portal section but everything is working fine :) So anybody having the same problem try this method!

There should only be one file manager.  Either only a file manager tab page on the first portal, or every portal showing all the files.  The way it is now is stupid.

Glad to be of help. You can PM anyone in the forum - myself included -  but if you have any further questions, please direct them to the forum only. Your questions may go some way towards helping someone else looking for answers and queries that go via PM aren't generally seen.

Awesome, I might need this (not exactly, but same code area), because I want to present a after login page but also a clickable link to the initially requested page, or even open it in a new tab (with JS). Thanks a bunch.

Any news on this?