@laoistom:

I've tested the solution above and while it works for a success page redirection it doesn't work for allowing the likes of Facebook, Youtube or twitter apps on iOS devices. Looks like i'll have to wait for an apple "update" to hopefully do something that fixes this.

Cheers for the help guys
TQ

This solution is not intended to fix your Facebook problem. It is workaround for Apple's "CP improvements" as described on many other forums as well as here before. Maybe I hijacked your thread with this, sorry. I don't use/own Apple products, so I cannot test anything, but if you do some packet capture and post it here maybe we can come up with some solution.

if ($lastact && $lastact >= $cpentry[0] && (($pruning_time - $lastact) >= $uidletimeout)) {
$timedout = true;
$term_cause = 4; // Idle-Timeout
$stop_time = $lastact; // Entry added to comply with WISPr
}

ı have added the code piece in red, this checks if lastact is bigger than session start and if not does nothing, I mean no kick out

When you visit the login-page of your pfsense-router, what url do you get?

www.10.0.0.1:8000\….???....(What is here written?)
When here is something like "generate" in the url, then you should read my post here:
https://forum.pfsense.org/index.php?topic=75639.0

When it is not in the url, I hope any other can help you

greetings

Test this:

require("captiveportal.inc"); if (!is_array($config['captiveportal']))         $config['captiveportal'] = array(); $a_cp =& $config['captiveportal']; foreach ($a_cp as $cpkey => $cp) { $cpzone = $cpkey; if (!empty($cpzone))  { $allusers = captiveportal_read_db("WHERE sessionid <> '0'"); foreach ($allusers as $userid) { if (!empty($userid[5])) // echo "Removing sessionid = ".$userid[5]." "; captiveportal_disconnect_client($userid[5]); } } } ?>

This will stop all users on all interfaces (zones).

I didn't test it myself - to many users on my portal right now  ;)

Don't get me wrong, but have you tried to set up some sane values for the timeouts? I certainly fail to see how's forced logoff after two minutes useful for any purpose except for making your users extremely pissed off. The one minute idle timeout will even most likely be missed every other time by the minicron job.

FYI- On 2.2 (still in Alpha) we have made buttons in the GUI to remove a custom page which would revert it back to the default page instead.

Thank you for your help. Good tip on adding pass-through-MAC for WAP

My USB dongle AP was working in 2.1 but in 2.1.2 any client connection will crash pfsense. I have a virtualized environment so the simplest for me now would be to setup 2.1 just to run CP with a USB dongle and see how that goes.

@Gertjan:

Not a good idea.
These request will trigger the portal login page, which will not be shown to some one, as I understood it concerns background polling of cell phones etc.
But: finally, the user would open up his facebook account ….. and unable to login the portal interface because it blocked that user. The guy will look for you to unblock him (hummm, so you can tell him he is punished because his device is hammering your network  ;)).

I don't know of the 'log' daemon of pfSense supports discarding - if it does, think about throwing away multiple "mod_evasive.c" lines.

Good point. Clients needs to pay first before I 'unblock' them :-) (I implemented a online pay system above the captive portal)

When I look at the source of 'mod_evasive.c' the max_connections is actually a config property (can not see yet where it set) and if I like I can remove the log rule.

if (conns_by_ip > p->conf.max_conns) { log_error_write(srv, __FILE__, __LINE__, "ss", inet_ntop_cache_get_ip(srv, &(con->dst_addr)), "turned away. Too many connections."); con->http_status = 403; con->mode = DIRECT; return HANDLER_FINISHED; }

Thanks!

add it to your welcome page (= portal page contents )

also … i just copy/pasted the javascript from some random website. it's not guaranteed to work!

from 2.1-release it is possible to have multiple captive portals for different interfaces (i've not tested this myself).

that way you could have a free/open CP for your restaurant and a voucher-system for the rest of the campsite. This setup would require an additional interface.

This would involve an additional network card, or the use of vlan's with a vlan-capable-switch

enjoy

stop radius then check port 1812 if it is open. might be used by other services.

our planning of access to network don´t allow this configuration.

thanks

Yah@laoistom:

Once the network connection is made your going to get an IP address regardless of whether or not you have gone through the captive portal page.

Yeah, I cannot see exactly what's the bug here, plus what's been "fixed" on the other thread, the patch is completely unrelated.