@cmb:

you do have to disable MAC filtering to view the page, otherwise it'll error out because it can't find your MAC address for an Internet source IP.

after disable Disable MAC filtering (under Status -> Captive Portal )
still ..i cannot view my captive portal page from the internet ..

appears to be an apple issue?

http://apple.stackexchange.com/questions/37829/why-wont-my-macbook-pro-connect-to-wi-fi-networks-that-use-a-sign-in-page-capt

http://blog.securestate.com/post/2011/10/07/OS-X-Lion-Captive-Portal-Hijacking-Attack.aspx

@tomdlgns:

there is a # button when you reply to a post and that can be used to enter code. :)

and there is a "globe" button (immediately under the "underlined U") that can be used o enter a URL.

Captive portal logins are strictly based on IP and MAC address. If a user logs in on a machine, and then someone else logs into the same machine, the second user will retain the first user's access unless/until the first user is logged off by an idle or hard timeout. Not possible to force users to certain IPs via CP, IP assignment isn't related to CP.

What site hostname are you trying? By its design, it doesn't work for hostnames like, say, google.com that resolve to a different IP every time they're queried.

Hi there,

Thank you for your help so far.

Today, I checked the performance of the pf using "top -S -H". For me, it is still not clear what's taking so much of the CPU.

@dhatz: the report you mentioned shows basically the problem that I'm facing. Although, there's not much information about the settings had been used in the box.

I'm going to leave the wireless vlan out of the captive portal at the moment, and I'll set up a new box, in test environment, to try to find out what is going on. I have a copy of the server running on my laptop, and it seems to run better than my box.

Regards
Iwashima

test.png
test.png_thumb

Hi Ermal,

did you have a look at the config file?
Do you have an idea what might the problem be?

Regards.

Rules are processed top down, first match wins. Therefore with those rules you would need the enable rule above the block rule.

Hey all !

I have noticed the same with my pfsense, and here's the bit of the CP that I'm using:

<captiveportal><page></page>
<timeout>120</timeout>
<interface>opt1</interface>
<idletimeout>30</idletimeout>
<freelogins_count><freelogins_resettimeout><auth_method>radius</auth_method>
<reauthenticateacct>stopstart</reauthenticateacct>
<httpsname><preauthurl><peruserbw>I read on the following post a report of a problem ( http://forum.pfsense.org/index.php?action=profile;u=113943;sa=showPosts ), and I realised I had set the CP to use "start/stop accounting", so I set it as "no accounting updates". And everything seems to be working now, but I'm not sure whether it is because a change the radius settings, or because I have rebooted the server.

Well, hope it helps identify where we could have a problem.

Regards
Iwashima</peruserbw></preauthurl></httpsname></freelogins_resettimeout></freelogins_count></captiveportal>

@powerguy42:

http://www.dmasoftlab.com/cont/home

I've tested this with pfsense and it works great, has anyone else used this software? pfSense is listed as a supported product on there site. Pretty cheap too.

Can this run directly on my pfsense box or does it require a separate server?

@ermal:

Can you show your system log?

Yes, of course, but there is nothing interesting in there as fas as I can tell:

Sep 3 23:06:19 kernel: arp: 10.100.79.13 moved from 00:26:4a:08:07:96 to 24🆎81:b9:56:c6 on rl0
Sep 3 21:06:08 check_reload_status: Reloading filter
Sep 3 23:06:01 kernel: ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based forwarding enabled, default to accept, logging disabled
Sep 3 21:06:00 check_reload_status: Syncing firewall
Sep 3 23:04:26 kernel: arp: 10.100.79.12 moved from 58:b0:35:b3:d0:8e to 00:16:cb:c3:60:99 on rl0
Sep 3 23:04:12 php[32837]: /index.php: Successful webConfigurator login for user 'admin' from 10.100.78.254
Sep 3 23:04:12 php[32837]: /index.php: Successful webConfigurator login for user 'admin' from 10.100.78.254
Sep 3 23:02:45 kernel: arp: 10.100.79.42 moved from 00:17:f2:c9:3b:f1 to 24🆎81:b7:b6:06 on rl0
Sep 3 22:52:09 kernel: arp: 10.100.79.149 moved from 00:26:08:0e:b6:00 to 24🆎81:b9:57:9f on rl0
Sep 3 22:51:03 kernel: arp: 10.100.79.155 moved from 00:26:08:0e:b6:66 to 24🆎81:b7:b6:06 on rl0
Sep 3 22:46:00 kernel: arp: 10.100.79.16 moved from 00:22:41:3b:e0:16 to 24🆎81:b9:58:15 on rl0
Sep 3 22:45:24 kernel: arp: 10.100.79.63 moved from 00:1b:63:a2:df:29 to 00:16:cb:c3:60:99 on rl0
Sep 3 22:44:51 kernel: arp: 10.100.79.63 moved from 24🆎81:b9:57:8c to 00:1b:63:a2:df:29 on rl0
Sep 3 22:43:23 kernel: arp: 10.100.79.23 moved from 00:26:4a:08:0c:fa to 00:16:cb:c3:60:99 on rl0
Sep 3 22:42:59 kernel: arp: 10.100.79.15 moved from 58:b0:35:b3:27:d2 to 00:16:cb:c3:60:99 on rl0

asura, have you tried the setting?

Will it sync back between portals when vouchers are used up or can one use each voucher on every CP?

ok ive figured it out, i had a couple of server ip addresses in "allowed ip addresses" which had the subnet /24 bits and it should have been 32 for one ip only- changing it to /32 and captive portal working again. :)

Thanks

CP and system logs.

as you say. I can do it with Sarg.

If you know where all those apps are, yes.  You allow the app server IP in captive portal.  I alwayse stick the popular update servers in mine…  (windows Update, Symantic and McAfee)  Problem is they keep moving them.