@Gertjan Thanks for your reply. Your pointer to /tmp/rules.debug was a good hint for me. I found the relevant scripts as well.
I will first have to learn about pf and will then decide if I want to continue efforts to adjust the scripts.

It's just weird that there is no documentation. Even the scripts are very sparsely commented.

@DominikHoffmann said in Need pfSense captive portal tutorial—not sure, where to put HTML code:

The key for me was to check “Enable to use a custom captive portal login page.” Without that, I could not get a captive portal to appear.

This :

06b9ae74-b82e-4b53-b203-dcc6627e0783-image.png

option doesn't have to be check.
If it isn't, the default login, build-in, page will be sued.

@Fidelinho88

?

The first IP of a network is 'normally' the IP of the pfSense LAN = 192.168.0.1
The next IP could be 192.168.0.2 and that will be your "AP" (look again previous posts).
Btw : my opinion, but have the AP use a static IP setup, not DHCP.

@Fidelinho88 said in Configuration of captive portal and Router for use:

It has been shown as offline ...

Offline means here : not in the pfSEnse arp cache.
See here : Diagnostics > ARP Table

You can - should be able - to ping the 192.168.0.1, your AP, so it is online.
And as soon as you ping it from pfSense, pfSnse will have it in it's arp cache for several seconds, and by magic now it shows online. To be offline again afterwards .... or, the AP is still there, up and running.

@skveen said in Management for Vouchers:

Yes, but I don’t want to use psk

What is psk ?

@skveen said in Management for Vouchers:

It is a good idea to use one Voucher per day or per table

Look in the future.
For some reason, you've decide to use a version that is severally depreciated :

@skveen said in Management for Vouchers:

In the end I chose the version pfSense-CE-2.7.0-RELEASE

With the now declared "zero day OpenSSL ready" version 1 ?
You've missed : Netgate Will Migrate to OpenSSL 3 in pfSense Plus Software Version 23.09 to name just one.
Euh ... ok. Good luck.
Normally, a firewall is about security. "Confort" shouldn't come first.

@Gertjan Thank you for all of the info regarding the captive portal. The APs in the facility don't support LDAP authentication, hence the use of the captive portal. They do support Radius, but I don't have a Radius server running/integrated with AD at this time, so the captive portal was a quick way to get something working with LDAP. Management doesn't want all employees to have access to the WiFi, and since the password on the WiFi can be easily shared and is cumbersome to change, the captive portal is the current solution. We do use MAC address access control for company devices, but not for personal devices of employees who are authorized to use the WiFi. I'll probably look into adding a Radius server so we can just perform the authentication at the AP level instead of the captive portal.

@robsonvitorm
You dont need to obfuscate private addresses (RFC1918) or mac addresses generally.
If you don't see packets leaving then you have a problem on the host level. Either your network stack on the host is corrupted or you got something else going on.

@getcom said in captive portal: nginx 504 GW timeout & 'dnctl: need a pipe/flowset/sched number' => MAC addr cleanup job needed:

https://github.com/pfsense/pfsense/commit/8bfe17dae7ab15b7af802f69dbb7c421d098d38c

Looks like that related.
It's an easy edit, go ahead !

@getcom said in captive portal: nginx 504 GW timeout & 'dnctl: need a pipe/flowset/sched number' => MAC addr cleanup job needed:

You said "Easy to rebuild as "if voucher is expired, then ditch the auto added MAC"". Should we implement that and commit a fix?

The easiest solution would be : don't "auto add", as this is only a comfort option for your portal users. On the long run not for you !
They, the portal users, log in once using the voucher code, and from then on they stay logged in forever. Its up to you to remove the 'old' macs manually. Seems tedious to me.

Is there a comment add to the auto added MAC entry ? If so, and it contains the voucher ID, it's easy to parse over all the mac entries, isolate the voucher code, test for validity (still time left) and if not, delete the mac entry all together (does doing a auto clean up ^^).

I'm not using vouchers at all on my portal, but I'll have some spare time next week, and I'll see what I can come up with.

@gsrinivsn
Got the same behavior and ran into similar problems:
https://forum.netgate.com/post/1157259

This problem is from my perspective unrelated to the firmware version. If I`m not mistaken, it can happen after backup restore or reboot.
The reason for this are described in the linked thread: tons of MAC addresses in the config file & DBs.

That's why I couldn't find the message. It's part of the ipfw sub system.

@rennai said in need a pipe/flowset/sched number error:

But I wondering why

Stop wondering. It has been solved in 2.7.0 and 2.7.2.

@Gertjan Hello Gertjan. it's just anonymizing the Mac Addresses.

Looks like it may be related to pass-through MACs when "noconcurrentlogins" is set along with per-user limits.

"I disabled the 'Pass-through MAC Auto Entry' on the Captive Portal, and the error messages have stopped. However, now, to avoid these messages, I need to add these entries manually. It seems like a bug. Anyway, it's exhibiting some unusual behavior.

Thank you all for your answers to this issue. Truly more heads are better than one :)

@pfsenseISIP said in Captive portal slow down connection troughput:

there are no firewall rules

No rules on an interface means : no traffic enters that interface.
Example :

8dc5480d-c651-47ec-be79-1035f61500c3-image.png

@pfsenseISIP said in Captive portal slow down connection troughput:

via freeradius installed

And the basic, vanilla, just one "Portal on a OPT1", like shown on the official Netgate (Youtube channel) video's, that works ?

@pfsenseISIP said in Captive portal slow down connection troughput:

and the CP is on both

So you have two portal instances ?
Normally, LAN us for trusted devices, like the one you use for adming pfSense.
All non trusted devices should belong on other interfaces, like OPT1 (portal 1), OPT2 (portal 2) etc.
True, a captive portal can work on LAN ...

@AW-0
And you have a question ?

If so, don't forget to detail your settings.

Btw : my portal access isn't great neither.
And I know why.
When I plug myself into the switch that is connected to the pfSense portal, get get the full 'nearly' 1Gbit up and down, as that is the speed of my ISP.
So, you get it, my APs are the limiting factor.

When a portal user is connected, the user's IP and MAC are added to the 'pf' firewall table that contain the authorized users. This pf rule (tbale) is like any other firewall rule, and doesn't limit the connection.
For every connected user there is a also a 'limiter', you can see them here : Diagnostics > Limiter Info
and default they are :

Limiters: 02010: unlimited 0 ms burst 0 q133082 100 sl. 0 flows (1 buckets) sched 67546 weight 0 lmax 0 pri 0 droptail sched 67546 type FIFO flags 0x0 16 buckets 0 active 02011: unlimited 0 ms burst 0 q133083 100 sl. 0 flows (1 buckets) sched 67547 weight 0 lmax 0 pri 0 droptail sched 67547 type FIFO flags 0x0 16 buckets 0 active 02008: unlimited 0 ms burst 0 ......

== unlimited.

@michmoor @Gertjan

Thanks for the answers, it's clear.
However, while you still have squid in the PFSense 2.7.2 package, I would like to continue using squid, in the meantime I gain time to think about something or leave it without squid and follow the recommendations.
As there is still squid in the package, is there no rule I can apply to block 443 HTTPS access before authentication on the captive portal?
thank you all

@jenyabutakov said in Wireguard and Captive portal:

@Gertjan thanks!
It is definitely a shift to a positive direction. Now this error (noclientmac) has gone, but I still have no redirection to portal page.

PS: Tested the same with LAN interface - working like a charm

@yogendraaa it seems issue is related to FreeBSD (Maybe) not only Nginx but the queues from NIC also have issue. with 2.6 as i mentioned all okay. but same hardware switching to 2.7.2, got CPU0 @ 100% which slow down everthing & then 502 & 504 errors occur. I am specific to Captive Portal implementation. attached image for reference.
platinum issue.png

Thank you for your help.