@new_in_pf: pfsense 2.1-release  i386 Perhaps you could try with something uptodate…

yap you right…not a professional like you guys...but try to find short cut and learn something new!! Thanks for reply

Creating master master replication is way easier then creating some RADIUS monitoring script.

Got it, thanks for your input.

Squid and CP ? Read me first : https://forum.pfsense.org/index.php?topic=91435.0 Conclusion : forget about squid for the moment.

Ah, IE10 is fine, so I'm a little less worried - there probably won't be too many IE8 users trying to use the system (they're mostly smartphone users anyway). I guess some security stuff changed in between IE8 & IE10, and the upgrade of pfsense from 2.1.5 to 2.2.1 has exposed that. I'll still see if I can figure out what's going on and update here later.

good afternoon first you must go to decargarte FreeRADIUS packages then you have it downloaded notify us and we will tell the next steps so you can create the user with the captive portal

Read the manual. https://doc.pfsense.org/index.php/Captive_Portal_Pre-authentication_Redirect

Most information that transits the ISO layers is finally treated by ….... humans (our web pages, mails, etc). So ....

@Gertjan: The one with a free support phone number ? With all the Microsoft knowledge behind it ? Of course,  "Windows 2008 Xx Xxxxx server" users do NOT share their knowledge because they all paid the get it. Microsoft forces you to do the same thing … More serious : what about this idea : Windows 2008 R2 Radius server could replace FreeRadius - it your choice, so you adapt yourself. Thank for your help! Gertjan!

IPsec is not really an interface, it is a VPN tunnel. The gateway in DHCP is the OPT1 interface. Everything after this is already routed into the tunnel, so there is nothing else I could use as Gateway.

After doing all sorts of things, it would seem that all that I needed to do was make a rule allowing UDP port 53 on the OPT1 and everything became mellow. I am not sure why I would have to do a rule on the OPT1 but not on the LAN, but it is working.

I hope that one of the experts will explain what actually happened  ;)

@thuyle: _if ($username = "unauthenticated") {  // In captiveportal.inc#L2071  has only one equal symbol That was fixed in 2.2.1._

Ok i did reset the Pre Auth URL to "nothing", but nothing changed. After i did check the config of the DHCP on the COMPLAN Interface i found out that i did set custom DNS Servers (DNS) for this HotSpot, turns out that was my problem… After i set all back to nothing it works just fine, so i'm just a bit stupid  :D Tank you for this Hint, Problem solved. Greetings Chris-The-Tuner

Yep, it looks like current validation isn't strong enough :  http://www.w3.org/TR/xml11/#sec-common-syn  The first char (also called NameStartChar ) has limitations : ":" | [A-Z] | "_" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] | [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] | [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF]

Also, are the DNS servers whitelisted on CP?

@doktornotor: Sorry, you told us you want ANY request redirected to xyz.com "with no error message at all". For that, you need exactly ONE IP configured via the blackhole zone, and a webserver configured accordingly. Dunno really what's this talk about today.abc.com or tomorrow.abc.com. Not interested in moving targets here. Specify exactly what you want. Back on the job, I edited my last post to make the thought process more contiguous. I appreciate your help. gdelong