If you were coming from an older snapshot then you might be seeing this: https://rcs.pfsense.org/projects/pfsense/repos/mainline/commits/2d4003aab1d969ed9ba3e52f2fe3ec083e4bef8c We were not calculating the bandwidth received from RADIUS according to the standard. You'll probably have to fix your bandwidth values in your RADIUS server.

Maybe a CAPTCHA on the landing page?

No, that isn't possible to do with the code as it is. It could probably be modified to do that, but it would be a bit of work to pull off. 2.0 can't do that either.

Many thanks for your response. There is a work around for this scenario - and that is to NAT into the existing LAN and 1:1 NAT from one subnet to the other. Hopefully the pfSense will provide firewall logs of translations so we can match user's traffic on the Internet to authenticated traffic on wireless LAN. I don't know of another distribution that supports this feature, maybe ZeroShell? - so we may just build one! Thanks Rob

Cool, thanks a bunch!

You probably want to upload your own error page in section "Authentication error page contents" (right below "Portal page contents"). That's what I did and my portal login and error pages are of the same style and look. Logout pop-up doesn't work, you're right. I guess it is a bug.

@ermal: You need a radius server to do this for you. Hi ermal, I've managed to make CP + Active Directory (through RADIUS in Win2k8 R2) work for my RC1 2.0 box. But i'm not sure where should I create groups for limiting bandwidth?

you don´t need to get this domain, this could work if you use a local dns server. i have a local dns server, but i have no idea, how i can change that behaviour.. i want the captiveportal redirect go to http://pfsense.company.com:8000  instead of http://ipadress:8000, but how i can i do this? any rule to set in pfsense, to forward from ipadress to pfsense.company.com, or configure captiveportal to use domain instead ipadress?

You can configure a passthrough IP for this. ("Allowed IP addresses" on the CP config page)

Done!  :)

Thank you ermal for the answer that I hoped to see :)

Okay, I figured out I have to configure RADIUS in my Windows 2008 R2 machine and attach AD to that RADIUS. Working fine now :)

Am having the same issue Multiple VLANs is i use a non captiveportal VLAN it gets the page fine, else it fails

Captive portal doesn't work on a per-port basis, it controls all access. It can't be changed to work only on port 80.

OK, I will answer my first question regarding the timeout. 8) I forgot to clear the hard timeout setting - that was the cause of the TIMEOUT 60 minutes after previous login. The user didn't re-login and so it stayed like this. So everyone, don't forget to blank the default "Hard timeout" when setting up voucher system. Still this doesn't explaint those CONCURRENT LOGINs from the same IP/MAC.