Ok… Kinda quiet here in this part of the forum... :o After further deliberations I determined that you cannot edit the HTML using WinSCP... For anyone else trying to do this remember to edit your HTML and then upload using the upload feature in the CP Portal page. Cheers.... H.

@Afif90: lolx..that not english version.. yeah…. your right! Mmmmmm - Language must be part of the pfSense curriculum... ??? What are you trying to do? With every journey there are always first steps..... H.

if you use a layer2 switch with vlan's then you have virtual interfaces that you assign to squid …. interfaces not assigned will not pass squid and thus not get filtered

Thanks, I created the group, added some users with no privileges and it works great. The captive portal is now working exactly as it should. BTW everything in PFSense seems to be much easier to setup than other distributions I've tried, great job to those who worked on it. John S.

The file: /usr/local/etc/raddb/users It get filled with the config file /config/config.xml

In 1.2.3 its not possible only 2.0 allows you to use schedules with CP.

We're using the internal "user-manager", (no Radius Server) with username/password (built-in database) authentication. Are there other options? (As long as we want to keep it simple we are a little frightened to set up the radius-server..because none of us ever has).

Excellent.. I have been tinkering at it for the last hour and have got the captive portal working.. Doing basically what you just said. all i did was untick the box under the DNS servers on the general settings, and i put the LAN ip as the DNS server on the DHCP settings.  Althought it does also seem to work without this, so maybe just removing the tick in the box next to "Allow DNS server list to be overridden by DHCP/PPP on WAN " seems to do the trick.

@jimp: On the LAN, block traffic going to any destination on port tcp/443 (except from your proxy server and/or unrestricted client IPs) If someone has the proxy settings in their browser, it will never hit that rule since it's going to the proxy. You can't force someone's browser settings to reset to "automatic" if they have been set to manual only or no proxy. If you have WPAD setup then it will work for those already set to automatic. Some browsers default to not try automatic configuration these days. It's a little inelegant because we still need to retain access to the ssl services provided by google, but this actually works like a charm. Thanks!

OK, thanks for replies. I was thinking about this option - to generate new keys. I already tried to change the magic number - I ended up with "Services : Captive portal : Vouchers" page all greyed out, "add voucher" icon (plus sign) disappeared, page reload didn't help, so warning to everyone, this is most likely not the way to go in RC1!

Assuming the CP users are on a different subnet, on a separate interface or VLAN, you can do that just with firewall rules (with or without CP).

Without DNS, the hostname never resolves to an IP, if the IP doesn't resolve, the client never makes a request, and pfSense can't redirect to a page if the client never makes the request. Only possible way around that might be if you have some kind of default DNS response. I don't think the DNS forwarder in pfSense supports that, something like the ISP DNS setups that send you to a search page when they don't get a valid DNS response. If your clients were pointed at a local/internal DNS server that would return a response even on failure, it should work.

Ah, then it might be something to do with the expiration bit. I didn't try that, just a normal login. Not sure how much can be done about that since it's browser specific…

It's by MAC and IP (CP enforces the association between them). IP and MAC passthroughs have no limits in 1.2.3, they have per-entry limits in 2.0.

this is a good idea! keep us posted on your progress if i get soem time at work tomorrow i will play with this a little as well

I left my global DNS setting as provided from my ISP.  And leave the local OPT interface DNS config for the CP interface.  And I pipe OPT/CP traffic only through Squid.  Inside Squid I set the DNS provided by client.  This does a real nice job.  This solves your need, as it does mine.  And provides a real nice feature, even if the clients DNS servers entry is statically set, it will still resolve names from OpenDNS servers, transparent to the user, reducing the ability to get around my OpenDNS content filtering rules.

Captive portal works at layer 2 (read: MAC address), so unless your clients are bridged to the same layer 2 network as pfSense, and pfSense can see the client MAC addresses directly, then it will not do what you are after. We have a feature request open (not sure if it's on redmine or elsewhere) for a layer 3 captive portal that would work by IP, but it's something that requires quite a lot of time toward (and funding…) in order for it to happen.

i have add on Cp a idle timeout (30 min) and it seems to be fonctionnal …