@bucky31: Will I need to set my wireless controllers default gateway to the pfsense LAN IP address? I'm not familiar with those wireless controllers but I would guess: No if the wireless controller gets its "WAN" IP address from pfSense by DHCP. Yes if you have configured a static IP address on the wireless controller's "WAN" interface. One problem with using snapshot builds is that there might be a temporary bug introduced as part of a fix for a different. I've had good results with the official RC3 built Tue Jun 21 17:40:54 EDT 2011 and with the snapshot build in file pfSense-Full-Update-2.0-RC3-i386-20110719-2331.tgz

update to latest build…this option already available

I think I figured this out.  It appears that newer browsers make multiple embryonic connections to the user's homepage – based on my testing they try to make more than 16 connections, which is the max allowed to the portal at the same time. Two questions: On the portal settings page (Services -> Captive portal -> Captive portal tab), if the maximum concurrent connections setting is blank, does that mean that the default of 4 per IP is used, or does that mean the same as setting it to zero?  When I set it to zero and click Save, the number disappears -- so does that mean 4 connections per IP, or the max of 16? Is there a way to increase the max beyond 16 to see if that resolves the problem with newer browsers attempting to make more than 16 connections?  I didn't see that as a system tunable. Update on more browser testing:  this doesn't appear to be a problem on Firefox 5.0 and IE8.  So far I've only seen the problem on Chrome 12.x and IE9...but that represents a significant portion of users so would be great to get the problem fixed. Thanks, Mike

or even use "Bypass proxy for these destination IPs" and block whole LAN subnet via normal firewall rules. thanks for the support

Hi wallabybob, you are right. Changing the dns rule didn´t will fix the problem. Today, i have checked the problem with one of our device. If i didn´t enter a voucher ticket and try to catch mail or do other communication to the internet, so transfer will blocked. If i will go to a www url over port 80, the captive portal catch me and ask me for a voucher. Looks all ok. Only the firewall log makes me crazy.

You are not clear on your request! How can you resolve that? Give a description of the problem Give a description of your setup

Ermal…... I created a rule that prohibits all but the captive configured on the interface. It seems that when the captive-enabled interface, they do not respect the firewall rules, after the user authenticates to the captive rules are then followed. Something that I think should happen is just spotting nmap tcp port 8000 for authentication, nothing more. Thank you very much

UP

When I was running the July 4th (before the snapshot location changed) I had the problems outlined above.  As of yesterdays (2.0-RC3 (i386) built on Wed Jul 13 18:38:42 EDT 2011) build, the user is now showing up.

Presently not. It could be achievable through some tricks but i am not interested for the moment.

Thank you :)

I´m using a syslog server and…. I have all logs the voucher..... Could you try. Thanks

@Piplfox: I’ve managed pfSense with captive portal (voucher auth.) and on LAN I have WiFi AP. Clients that connect thru wiFi AP, I don’t want them to be able see or communicate to each other. Is there an options to so. To add to the previous post, this is sometimes called "wireless isolation" in your router's GUI. Regards, Stuart

@ermal: I just put a fix on this. Please test later snapshots. Thank you very much, I'll wait for next snapshots and test it again.  ^^

No worries, i worked it out.. Authentication is now working to my FreeRADIUS server through captive portal. On a side note, does anyone know of any good software that i can use for billing?

The email could be sent with a bit of custom PHP on the portal page. The user being able to receive that response is the problem, with so many various mail providers you'd have to let them out to the entire Internet to reliably receive that response.

rc.prunecaptiveportal is run every minute so i do not think there is an issue there.

NO, it will run until completion.