Thank you ermal for the answer that I hoped to see :)

Okay, I figured out I have to configure RADIUS in my Windows 2008 R2 machine and attach AD to that RADIUS. Working fine now :)

Am having the same issue

Multiple VLANs

is i use a non captiveportal VLAN it gets the page fine, else it fails

Captive portal doesn't work on a per-port basis, it controls all access. It can't be changed to work only on port 80.

OK, I will answer my first question regarding the timeout. 8)

I forgot to clear the hard timeout setting - that was the cause of the TIMEOUT 60 minutes after previous login. The user didn't re-login and so it stayed like this.

So everyone, don't forget to blank the default "Hard timeout" when setting up voucher system.

Still this doesn't explaint those CONCURRENT LOGINs from the same IP/MAC.

Thanks for reply.

I was kind of hoping that the voucher would take precedence, but we will deal!

No, because those are hostnames that must resolve via DNS.

Is your network setup like:
Client PC > Portal/pfSense > Proxy > Internet?

Does it require authentication from users, or is your portal doing that (at least for the people who will be using it)?  I'm thinking the easiest way is just to add an exception to the proxy or router.  If I'm missing something, you'll have to forgive me.  It's been a few years since I've done anything with a proxy so "how a proxy works" isn't fresh in my mind.

I believe you could do this with a cron job.  You'd setup the job to copy that log file to an area on the drive every so often.  I don't see a way to setup cron through the WebGUI, so you'll probably need to SSH in or try the Diagnostics > Command Prompt (unsupported, release 2.0-RC1) method.

I've never setup a cron job myself, but I have run across plenty of tutorials online that tell you how.

Pre-authentication redirect URL = http://firewallIP:8000/

As far as I know, this isn't working "out of the box". I am not sure, but I think there was a similar question in this forum and a workaround.

Depending on your firewall rules there, you probably need to have a pass rule for tcp/udp port 53 to the firewall's IP on that network, and you probably need to add 8.8.8.8 to the captive portal IP bypass if that DNS server is being directly assigned to clients.

Nope.
It needs some effort nobody is willing or even thought to put towards this.
You can contact pfSense support and see if this goes somewhere through that channel.

I too would be interested in such a feature. Perhaps it could be done using RAIDUS as the authentication method for both Squid and CP? Then have a PHP page coded to auth on both? I have no experience in setting up auth in either case.