@scifoflux said in Captive portal with sponsorship approval: Is this possible? You are effectively looking for a "validating parking" application. If the employee has to give them their email address, why not have the employee at the same time also send an access code good for a fixed amount of time. That access code could be a voucher or you could create a multiuser account and use the employee email address (before the @) as the login. If you still want to send the email, you could look at something like the phpmailer application. I do agree with Gertjan though, keep it simple. Why can't the receptionist just hand them the "info". It could be the wifi password and you could use unauthenticated access, just an "accept the terms" button. For that matter, the employee could email them that password in advance. You could change the password every Monday if you need greater security. Depending upon the number of employees, you could even set up a portal (on a separate VLAN) for each employee if your WiFi router supports sufficient number of stationIDs/VLans. OpenWrt on the WiFi Router could get that done. Good Luck.

@GeorgeCZ58 said in PHP Fatal error: Uncaught TypeError in /etc/inc/captiveportal.inc: Can somebody explain why that happen? Are you sure ? A portal user entered (with the keyboard) the URL manually, and forgot to add a mandatory paramter. He/she was using an URL like https://your-portal.your-hostname.tld:8003/ which would work, as /index.php would be tried by the browser. Or https://your-portal.your-hostname.tld:8003/index.php Better, but it will fail as https://your-portal.your-hostname.tld:8003/index.php?zone=CPZONE1 The zone paramter has to be present, with a valid ID so 'pfSense' knows what portal instance is accessed. A valid ID is this : [image: 1738676919067-efdc8fa7-cefc-4e7b-a920-6d332d9ff8fd-image.png] without it, the PHP triggers. The thing is, the fact that it is wrong or absent is detected. The portal user will receives a html page telling that an error happened. But to make this html page, the zone paramter is used, ..... and it was not there. => bug. Again, normally, this can't happen. Nobody has to or should type in manually the rather cryptic login URL ......

@Gertjan said in Does FreeRadius allow voucher creation?: activate vouchers in pfSense, you can see a third line showing up on the captive portal login p Thank you @Gertjan, at first this went little over my head but your solution is genius. It is all about perspective, essentially hard-coding the password into the code and renaming the field name from user to voucher. This is great approach. I am going to think about this a little more to fine-tune it further. To give you some insight, I am essentially operating a coworking space with about 250 users. Ideally, I would like to give each user their unique credentials which i would like to expire and only renewed once i receive subsequent months payment. Users are restricted to two devices (hence Radius) but it seems like a hasttle having to manually update their exprations. I thought perhaps i can mass print my vouchers in advance and distribute them as soon as payment is received. However, vouchers are not expired by date, rather time and do not allow machine limitations. Back to the drawing board.... seems like ill have to take the bullet for this administration task.

@dmchavoc said in Shortening voucher length in 2.7.2: @Gertjan What ? Who ? Me ? You've explained it very well already : It no longer is permitting 32bits codes for security measures. soo... i guess we can no longer do shorter codes? Just change the ? for a ! and you're spot on. What ? You don't like progress ? ^^ I can share my point of view, but you wish you didn't saw it. First of all, I don't use 'vouchers'. For me, these guy are (were) needed if an Internet needs to be sold. If you just want a fast and easy solution, a user name and password solution works well enough, and has no admin maintenance. Btw : I use it for a hotel, and I'm to lazy to explain to every client every day what a voucher is, etc etc. And make new sets, remove old sets etc. The user will find the login portal, the will know the room number (the portal user name) and the password is shown in the room directory they'll find in the room. This works for me - and for them. Dealing with voucher is a, imho, not good alternative as it needs me to baby-sit the system. When I see this : error:04081078:rsa routines:rsa_builtin_keygen:key size too small:crypto/rsa/rsa_gen.c:78: this tells me that pfSense uses existing software (some package, library, whatever) that wasn't created by Netgate. Probably "OpenSSL". And yeah, OpenSSL have their reasons not to allow insecure crypto stuff anymore. They've decides that for you. Normally, not an issue, as we don't care if out TLS connection to connect to this forum is based upon 512, 1024, 2048 or 4096 bits ... our browser handle this for us. This issue become apparent when you uses 'codes' which have to be manually entered, like voucher codes. @dmchavoc said in Shortening voucher length in 2.7.2: Findings with help of ChatGPT Sorry, guys. ChatGPT can be useful for hard questions like "how much eggs for the cake I want to prepare, 2 or 3 ?". And we don't want GPT to "really" work. I go for the fictional aspects of it.

@Neverstopdreaming too bad no one ever answered. I'm having the same problem, and it started after I configured carp HA. After entering CP settings and saving without doing any changes it starts working again, like your said. Logs after doing this show a check_reload_status activity followed by a minicron "(/etc/rc.prunecaptiveportal) terminated by signal 15 (Terminated)" message that is what actually gets it back to working.

@Gertjan I read the thread from @DanieleIT . I saw a new Version at bottom. Everything works properly now with voucher-template-printer-2.6.0. Thank you for your help

@Swicago said in Different rate limits based on login ?: I hope my voucher and radius mods will be able to help others as well. I am sure the working application will help numerous developers as the concept alone is powerful for freeRadius users that wish to "manage" Captive Portal Attributes that aren't exposed by the standard installation. iOS, i.e. Apple, created DHCP 114 and it is now mature enough that it is seeing wide spread use. See what you can do with the vendor URL in addition to just logging out.

@EDaleH said in FreeRadius: Something reduces the value in octet file (used): @jarlel said in FreeRadius: Something reduces the value in octet file (used): Once or twice every day/night something is randomly reducing the value I thought I would clarify one point even though implementing the reply above should have corrected it. I realized the explanation as to why I believe you see "reduced values" in the used-octets file may not have been clarified. Thank for the detailed explanation :-) We are and have been running "interim" for accounting updates. It seems that enabling "Idle timeout" solved it, then it will force an update that updates the octet-file and closes the session file. Maybe we also should change it to "Stop/Start (FreeRADIUS)" as you suggest above?

@Gertjan said in How to use the pfsense name instead of the IP address in http?: Well ok, not an issue for me, and it will their problem. Its fine that they block their device's incoming connections, I get that. But when they also start to limiting to port X and port Y, but not port Z, that has nothing to do with security, that's just an overdoses of Toctic. I don't agree that this is their problem. CP is running on a different port that is not designated for http(s) traffic. Port 8002/8003 are used for different purposes. eg. Port 8002 is used by Teradata ORDBMS and port 8003 by M'sft SCCM. Blocking these outgoing ports IS better for security. This way a user is not able to (accidentally) connect to a service on an unknown network Not blocking this traffic could potentially lead to an information leak (depending on the services). Especially services that can be configured through DHCP or other autoconfig services. I do get your point that this is somewhat ridiculous, as a device always needs to allocate high dynamic ports to connect to other servers anyway. But security wise it is (a little) better to block these requests by default. I have a brand new pc with a clean installation of Windows 11. It was not able to connect to port 8002/8003 as it was blocked by the WIndows Firewall by default! I think this block happened because i had chosen "untrusted network" when connected for the very first time (= do not share device on the network). In this instance I do have control over this local firewall. @Gertjan said in How to use the pfsense name instead of the IP address in http?: When visiting a site, any site, it will be a https site. As there are no more http sites left to visit. Browser will even warn if a site is http only. The https certificate only works for my CP domain (of course). I have disabled the interception of https traffic. Yes, you are correct that most browsers will not use http in favor of https. Especially on websites using HSTS, which enforces https for a certain period on that domain. This is not an issue. When a Windows, Android or iOS device connects to a network, the device will always start a normal http request in the background. A message or notification is shown to the user when it receives a redirect to a CP page. This is sufficient. There is no need to show invalid Https certificates when browsing other public domains. The renewal of LE certificates works. However, the CP process does needs a restart after the renewal in order to pick up the new certificate by nginx. No big deal. This can be configured on cert renewal. @Gertjan said in How to use the pfsense name instead of the IP address in http?: Be ware that the pfSense GUI nginx listens to ALL interfaces, and that includes even WAN. You've showed it yourself : My PF GUI is not exposed to my WAN interfaces. However, nginx does listen on all interfaces. This traffic is blocked on my WAN interfaces (main and failover WAN). @Gertjan said in How to use the pfsense name instead of the IP address in http?: It's not defined what happens when multiple instances of the same process are listening to the same interface, port and protocol. This is defined in the nginx doc. more specifically: nginx first tests the IP address and port of the request against the listen directives of the server blocks. It then tests the “Host” header field of the request against the server_name entries of the server blocks that matched the IP address and port. If the server name is not found, the request will be processed by the default server. The listen directive with an explicit IP will take precedence over the wildcard directive. So in this case the PF GUI will be shown when the CP process is stopped. However, The red PF page will be shown on the CP domain because the hostname is invalid. But you can access the PF gui when entering the right domain / hostname. As it will be listening on that interface. example: PF GUI domain: router.somedomain.com CP GUI domain: guests.somedomain.com When CP process active: browsing to router.somedomain.com will redirect and serve the CP GUI browsing to guests.somedomain.com will serve the CP GUI When CP process is inactive: browsing to router.somedomain.com will serve the PF GUI (with login option) browsing to guests.somedomain.com will serve the PF error page (invalid hostname) In other words: this setup could expose the PF GUI on the Guest interface when something bad happens with the CP process. This could result in a security issue. I just wanted to point this out that I'm aware of this.

@rt050 said in External Captive Portal. Is it actually possible?: but I'm almost sure it's because the symlinks are wrong. When you upload these files : [image: 1735552023999-1912b189-e60d-4477-9fb6-8feccf8517aa-image.png] 2style.css, custom.css mac-block.html etc you can use them with the names captiveportal- 2style.css etc [image: 1735552157725-67c4e090-d618-4249-9c4c-255861c32807-image.png] @rt050 said in External Captive Portal. Is it actually possible?: nor can I get a database connection what database ? MySQL ? in the good old days, the PHP MYSQL extension could be installed easily.* These days, when you install the FreeRadius pfSense package, you'll get the PHP MYSQL extension also. No need to actually use FreeRadius. @rt050 said in External Captive Portal. Is it actually possible?: the page where the user then clicks connect and lives happily ever after. Do they ? Already years ago, its was nearly "impossible" to ask for people's mail address so they would gain access to my hotel portal. They wouldn't fall for it back then and now even less. These days, here in Europe, collecting private info is 'not done' as you need to deal with all kind of administrative barriers to be able to store things like email addresses. It's just to much of a hassle.

@Gertjan said in Captive Portal not working on iOS devices only (DHCP 114): Anyway, I've edited services.inc : I assume you are now aware of the fact Kea's Affinity memfile does not survive a reboot and will loose expired leases that still have affinity "protection". Netgate has raised Redmine #15934 to attempt to address this and other lease expiry concerns but so has the Kea development team. See the link in the Redmine. The Kea development team have scheduled this for possible correction in V 3.0 which is slated for an April 2025 release. There is no certainty that they will include it. Until Kea supports Affinity surviving a reboot, using Kea with Captive Portal is very risky as a reboot will likely scramble the IP/MAC assignments unless the devices reconnect in the exact same order. We will have to use ISC until then, religiously have idle timeouts less than lease duration (and the frequent re-logins that implies), or incorporate a MAC Captive Portal authorization scheme like that proposed in Redmines 15854 or 15904 This suggests that we are unlikely to have a built in solution for Captive Portal ISC equivalent support under Kea at the next plus release (25.03?) or until Netgate incorporates Kea 3.0 into the pfSense plus and CE releases.

hello, sorry reply an old but interesting post. can i use this solution on premise inside my net without internet access , i meant in a local server with apache or nginx whatever.

@Jozy good luck with that mess.. I asked if you had messed with your outbound nat, I didn't say set it to manual.. Auto is the default - all of this would work with clicky, clicky with pfsense out of the box - the only reason it wouldn't is you messed with the defaults, etc.. Or you not even using pfsense as the gateway.. Which it seems your not.. ugggh..

@Gertjan said in Issues After Update from 24.03 to 24.11: @Cornel It took me a while, but the issue was hiding in plain sight. Thx - glad we now fully understand what was happening.

@heper yeah, that's probably the one. It was solved. I was using 2.7.2 in the post for a while and had no issues what so ever.

I will dig it. Many thanks!

@carlosi7 Hover the mouse over the Stop button : [image: 1728994216628-1fc11747-ea64-46c2-b13d-3b8481586f5b-image.png] The "Services Status" status dash board widget is a file you can find here : /usr/local/www/widgets/widgets/smart_status.widget.php This file will bring you straight to /etc/inc/services-utils.inc, where services like the captive portal can be stopped and started. As cron task can be an executable (so you have to build your own^^) or, most often, look at all the pfSense cron tasks already present, a script file. Now you know where to find the examples that shows you how to do that.