after every reboot pfsense ipfw rules start from 5000, 6000, 7000 and so on. the startnum is modified 2 to 50 and the end number is same 65400 but after reboots when the ipfw rules reach to 65400 then all the rules start from 1

What about using a switch ? Use one of the Juniper LAN port, put a 3 port switch (if it exists) on it, use port 2 f the switch to the existing network segment and the third to the pfsense box. Of course, bandwidth goes up to the capacity of the LAN port of the Juniper firewall. The DHCP server of pfSense isn't really from "pfSEnse". Its a industrial strengh DHCP server that is already known and being used on FreeBSD for years (also a reference). It can handle a lot of DHCP request … the only limit might be network bandwidth and "pure processor power" of your firewall. This is valid for your actual Juniper firewall, or the pfense box. I guess all possible setup-possibilities are there. I'm using pfSense as the main "firewall" at my work - about 10 PC's and seperate a Portal Wifi subnet for our customers (a hotel). I use a PowerEdge from Dell to handle it all (or an older Dell Dimension 51xx, an old retired desktop PC) with a quad NIC Intel PCI card - the onboard NIC is my WAN NIC. It runs fine for years now (it only breaks when I mess up the script/code ones more). Here are the stats: https://www.test-domaine.fr/munin/dyndns.org/brithotelfumel.dyndns.org/index.html As you can see, my 'firewall' is just twisting its fingers all the time ..... You could also consider buying a special appliance as said here: https://www.pfsense.org/hardware/index.html#sizing - stuff like this (example) http://store.netgate.com/Netgate-FW-7541-1U-Rack-Mount-System-BTO-P1903.aspx (6 Giga NIC's) will handle hundreds of PC's easily.

Hey gio, you could use "Automatic MAC Pass-Through addition" to automatically add the MACs of the users to the Pass-Through table. Although it is not really documented, if you select only one of the two check boxes, the MAC address is added and never deleted; when selecting both check boxes it should add the MAC and delete it after the voucher expires.

@ozlecz: thanks guys…...had it worked; = got to make the same zone throughout I have to admit I was shaking my head a little through this thread but it gave me the clue I needed. I don't see anywhere in the docs (perhaps I missed it) that the zone name must be the same at the locations syncing with the master. The sync reported success but none of the vouchers worked. I had a different name and since there is no way to rename in the GUI I had to edit the XML config file by hand to change the zone name. After I did that it worked, so thank you ozlecz! :)

With my current time zone(gmt -3), session last activity is almost 5 hours ahead. so I've tried to set my timezone to london (gmt 0) and for my surprise, last activity is earlier then start time.

@ermal: Yeah the behaviour has been that way but even until 2.1 there was no bw limits you could apply to such hosts. Hmm, which hosts are you referring to? The ones in the mac passthrough list? The bw limits definitely worked for all users who logged in through the captive portal. The behaviour has been changed to match the configuration since an allowed host is still a user. What you can do is specify 0 when you configure such hosts or the required bw. This is mostly to be consistent all over with the limits. That doesn't seem to be working for me - 0 isn't accepted. When I change an existing entry in the MAC passthrough list to have 0 as both the upload and download values, when I click on Save and open that entry again, the values are blank. If I set a number other than 0, it is saved. All the entries on my mac list have the up and down bandwidth blank. Following the description on the main config page, setting it to 0 or blank means that host will have no limit. However, the hosts are still limited. Thanks!

@m4st3rc1p0: ….all subnet that is allowed on the allowed IP address in the portal page should be or can be access by the client but we cannot i can only ping other than that sharing is not allowed. Can you make this more clear ?

add to cron script.sh with "rm /var/db/captiveportal_usedmacs_<cp>.db"</cp>

Wehre can i find this Information? "Question: What is your Hard timeout ? Idle timeout ?"

It depends on the details. Can you share what kind of frames are not understood by pfSense? Though reading again your post you are talking about stateless accounting packets(or outbound accounting packets) right? If that is the case no stateless accounting packets are not supported so far.

@mendilli: www.facebook.com automaticly redirects you to https://www.facebook.com, if you want to have portal login page for https/ssl try "enable HTTPS login" option in captive portal settings Thanks A LOT .  after try look like i have a lot of work.  :)

@laoistom: I've tested the solution above and while it works for a success page redirection it doesn't work for allowing the likes of Facebook, Youtube or twitter apps on iOS devices. Looks like i'll have to wait for an apple "update" to hopefully do something that fixes this. Cheers for the help guys TQ This solution is not intended to fix your Facebook problem. It is workaround for Apple's "CP improvements" as described on many other forums as well as here before. Maybe I hijacked your thread with this, sorry. I don't use/own Apple products, so I cannot test anything, but if you do some packet capture and post it here maybe we can come up with some solution.

if ($lastact && $lastact >= $cpentry[0] && (($pruning_time - $lastact) >= $uidletimeout)) { $timedout = true; $term_cause = 4; // Idle-Timeout $stop_time = $lastact; // Entry added to comply with WISPr } ı have added the code piece in red, this checks if lastact is bigger than session start and if not does nothing, I mean no kick out

When you visit the login-page of your pfsense-router, what url do you get? www.10.0.0.1:8000\….???....(What is here written?) When here is something like "generate" in the url, then you should read my post here: https://forum.pfsense.org/index.php?topic=75639.0 When it is not in the url, I hope any other can help you greetings

Test this: require("captiveportal.inc"); if (!is_array($config['captiveportal']))         $config['captiveportal'] = array(); $a_cp =& $config['captiveportal']; foreach ($a_cp as $cpkey => $cp) { $cpzone = $cpkey; if (!empty($cpzone))  { $allusers = captiveportal_read_db("WHERE sessionid <> '0'"); foreach ($allusers as $userid) { if (!empty($userid[5])) // echo "Removing sessionid = ".$userid[5]." "; captiveportal_disconnect_client($userid[5]); } } } ?> This will stop all users on all interfaces (zones). I didn't test it myself - to many users on my portal right now  ;)

Don't get me wrong, but have you tried to set up some sane values for the timeouts? I certainly fail to see how's forced logoff after two minutes useful for any purpose except for making your users extremely pissed off. The one minute idle timeout will even most likely be missed every other time by the minicron job.