After much digging into /usr/local/captiveportal/index.php and /etc/inc/captiveportal.inc, I was able to figure out logic behind Captive portal itself and successfully created custom PHP login page, now I can collects guests info (with their permissions of course) and store it in Google Spreadsheets. @Gertjan , thank you very much for help, now I just need to solve legal and design problems with this page :)

@Dmc said in Captive Portal & Radius Authentication: Could you guide me how to lookup redmine bug reports? Here : https://redmine.pfsense.org/

@Gertjan Yes, i am using interim and also tested it with stop/start I do not have the logs for the diagnostic mode but the outputs were as follows concurrent connection limit was set to 1 Radius was aware that user4 was connected 4 times as the radius itself would show me connections would always allow requests stop was only sent if the credentials were incorrect again, I am not sure if this helps but I was not using SQL. Instead the flatfile radutmp? i think is whats it called was being used. so perhaps that's why it wasn't being enforced properly [image: 1742486160688-7f3ea3d8-fccf-4d74-9205-129c61b22831-image.png] It says to read the documentation but where..? i went through it and only found this, the yellow box I think is referring to the captive portal configuration "first,last, multiple, disabled" so its implying it to be multiple [image: 1742486372492-ee7d1a63-2655-40b3-a426-681527e10bc9-image.png] Source: https://docs.netgate.com/pfsense/en/latest/usermanager/index.html

@Gertjan Agreed, perhaps ill change my approach and perspective. I shouldn't be punishing the 9 people for one bad player, I can just limit them abusers by IP if I must and have a talk with them for their abuse. I am really starting to learn that network administration is really simple to talk about "oh, ill do this and that" but implementation is just a whole another game. We've been too spoiled with the "one-click" culture

@EDaleH Installed "25.03-BETA (amd64)" ( 25.03.b.20250204.0023 ) - Updated the latest 'kea options' patch as mentioned in this thread : all is ok.

Hi @AYSMAN Did you happen to find the solution to this by anychance?? I am stumped as well after spending weeks on this... i know my accounting is working fine since its all logged but FreeRadius will not stop the connection after the limit is reached. Ive setup identical to the OP except my IP is on 127.0.0.1 and listening ports * Also added the Simultaneous-Connection := 1 to the user profile which didn't appear to do anything.

@scifoflux said in Captive portal with sponsorship approval: Is this possible? You are effectively looking for a "validating parking" application. If the employee has to give them their email address, why not have the employee at the same time also send an access code good for a fixed amount of time. That access code could be a voucher or you could create a multiuser account and use the employee email address (before the @) as the login. If you still want to send the email, you could look at something like the phpmailer application. I do agree with Gertjan though, keep it simple. Why can't the receptionist just hand them the "info". It could be the wifi password and you could use unauthenticated access, just an "accept the terms" button. For that matter, the employee could email them that password in advance. You could change the password every Monday if you need greater security. Depending upon the number of employees, you could even set up a portal (on a separate VLAN) for each employee if your WiFi router supports sufficient number of stationIDs/VLans. OpenWrt on the WiFi Router could get that done. Good Luck.

@GeorgeCZ58 said in PHP Fatal error: Uncaught TypeError in /etc/inc/captiveportal.inc: Can somebody explain why that happen? Are you sure ? A portal user entered (with the keyboard) the URL manually, and forgot to add a mandatory paramter. He/she was using an URL like https://your-portal.your-hostname.tld:8003/ which would work, as /index.php would be tried by the browser. Or https://your-portal.your-hostname.tld:8003/index.php Better, but it will fail as https://your-portal.your-hostname.tld:8003/index.php?zone=CPZONE1 The zone paramter has to be present, with a valid ID so 'pfSense' knows what portal instance is accessed. A valid ID is this : [image: 1738676919067-efdc8fa7-cefc-4e7b-a920-6d332d9ff8fd-image.png] without it, the PHP triggers. The thing is, the fact that it is wrong or absent is detected. The portal user will receives a html page telling that an error happened. But to make this html page, the zone paramter is used, ..... and it was not there. => bug. Again, normally, this can't happen. Nobody has to or should type in manually the rather cryptic login URL ......

@Gertjan said in Does FreeRadius allow voucher creation?: activate vouchers in pfSense, you can see a third line showing up on the captive portal login p Thank you @Gertjan, at first this went little over my head but your solution is genius. It is all about perspective, essentially hard-coding the password into the code and renaming the field name from user to voucher. This is great approach. I am going to think about this a little more to fine-tune it further. To give you some insight, I am essentially operating a coworking space with about 250 users. Ideally, I would like to give each user their unique credentials which i would like to expire and only renewed once i receive subsequent months payment. Users are restricted to two devices (hence Radius) but it seems like a hasttle having to manually update their exprations. I thought perhaps i can mass print my vouchers in advance and distribute them as soon as payment is received. However, vouchers are not expired by date, rather time and do not allow machine limitations. Back to the drawing board.... seems like ill have to take the bullet for this administration task.

@Neverstopdreaming too bad no one ever answered. I'm having the same problem, and it started after I configured carp HA. After entering CP settings and saving without doing any changes it starts working again, like your said. Logs after doing this show a check_reload_status activity followed by a minicron "(/etc/rc.prunecaptiveportal) terminated by signal 15 (Terminated)" message that is what actually gets it back to working.

@Gertjan I read the thread from @DanieleIT . I saw a new Version at bottom. Everything works properly now with voucher-template-printer-2.6.0. Thank you for your help

@Swicago said in Different rate limits based on login ?: I hope my voucher and radius mods will be able to help others as well. I am sure the working application will help numerous developers as the concept alone is powerful for freeRadius users that wish to "manage" Captive Portal Attributes that aren't exposed by the standard installation. iOS, i.e. Apple, created DHCP 114 and it is now mature enough that it is seeing wide spread use. See what you can do with the vendor URL in addition to just logging out.

@EDaleH said in FreeRadius: Something reduces the value in octet file (used): @jarlel said in FreeRadius: Something reduces the value in octet file (used): Once or twice every day/night something is randomly reducing the value I thought I would clarify one point even though implementing the reply above should have corrected it. I realized the explanation as to why I believe you see "reduced values" in the used-octets file may not have been clarified. Thank for the detailed explanation :-) We are and have been running "interim" for accounting updates. It seems that enabling "Idle timeout" solved it, then it will force an update that updates the octet-file and closes the session file. Maybe we also should change it to "Stop/Start (FreeRADIUS)" as you suggest above?

@Gertjan said in How to use the pfsense name instead of the IP address in http?: Well ok, not an issue for me, and it will their problem. Its fine that they block their device's incoming connections, I get that. But when they also start to limiting to port X and port Y, but not port Z, that has nothing to do with security, that's just an overdoses of Toctic. I don't agree that this is their problem. CP is running on a different port that is not designated for http(s) traffic. Port 8002/8003 are used for different purposes. eg. Port 8002 is used by Teradata ORDBMS and port 8003 by M'sft SCCM. Blocking these outgoing ports IS better for security. This way a user is not able to (accidentally) connect to a service on an unknown network Not blocking this traffic could potentially lead to an information leak (depending on the services). Especially services that can be configured through DHCP or other autoconfig services. I do get your point that this is somewhat ridiculous, as a device always needs to allocate high dynamic ports to connect to other servers anyway. But security wise it is (a little) better to block these requests by default. I have a brand new pc with a clean installation of Windows 11. It was not able to connect to port 8002/8003 as it was blocked by the WIndows Firewall by default! I think this block happened because i had chosen "untrusted network" when connected for the very first time (= do not share device on the network). In this instance I do have control over this local firewall. @Gertjan said in How to use the pfsense name instead of the IP address in http?: When visiting a site, any site, it will be a https site. As there are no more http sites left to visit. Browser will even warn if a site is http only. The https certificate only works for my CP domain (of course). I have disabled the interception of https traffic. Yes, you are correct that most browsers will not use http in favor of https. Especially on websites using HSTS, which enforces https for a certain period on that domain. This is not an issue. When a Windows, Android or iOS device connects to a network, the device will always start a normal http request in the background. A message or notification is shown to the user when it receives a redirect to a CP page. This is sufficient. There is no need to show invalid Https certificates when browsing other public domains. The renewal of LE certificates works. However, the CP process does needs a restart after the renewal in order to pick up the new certificate by nginx. No big deal. This can be configured on cert renewal. @Gertjan said in How to use the pfsense name instead of the IP address in http?: Be ware that the pfSense GUI nginx listens to ALL interfaces, and that includes even WAN. You've showed it yourself : My PF GUI is not exposed to my WAN interfaces. However, nginx does listen on all interfaces. This traffic is blocked on my WAN interfaces (main and failover WAN). @Gertjan said in How to use the pfsense name instead of the IP address in http?: It's not defined what happens when multiple instances of the same process are listening to the same interface, port and protocol. This is defined in the nginx doc. more specifically: nginx first tests the IP address and port of the request against the listen directives of the server blocks. It then tests the “Host” header field of the request against the server_name entries of the server blocks that matched the IP address and port. If the server name is not found, the request will be processed by the default server. The listen directive with an explicit IP will take precedence over the wildcard directive. So in this case the PF GUI will be shown when the CP process is stopped. However, The red PF page will be shown on the CP domain because the hostname is invalid. But you can access the PF gui when entering the right domain / hostname. As it will be listening on that interface. example: PF GUI domain: router.somedomain.com CP GUI domain: guests.somedomain.com When CP process active: browsing to router.somedomain.com will redirect and serve the CP GUI browsing to guests.somedomain.com will serve the CP GUI When CP process is inactive: browsing to router.somedomain.com will serve the PF GUI (with login option) browsing to guests.somedomain.com will serve the PF error page (invalid hostname) In other words: this setup could expose the PF GUI on the Guest interface when something bad happens with the CP process. This could result in a security issue. I just wanted to point this out that I'm aware of this.

@rt050 said in External Captive Portal. Is it actually possible?: but I'm almost sure it's because the symlinks are wrong. When you upload these files : [image: 1735552023999-1912b189-e60d-4477-9fb6-8feccf8517aa-image.png] 2style.css, custom.css mac-block.html etc you can use them with the names captiveportal- 2style.css etc [image: 1735552157725-67c4e090-d618-4249-9c4c-255861c32807-image.png] @rt050 said in External Captive Portal. Is it actually possible?: nor can I get a database connection what database ? MySQL ? in the good old days, the PHP MYSQL extension could be installed easily.* These days, when you install the FreeRadius pfSense package, you'll get the PHP MYSQL extension also. No need to actually use FreeRadius. @rt050 said in External Captive Portal. Is it actually possible?: the page where the user then clicks connect and lives happily ever after. Do they ? Already years ago, its was nearly "impossible" to ask for people's mail address so they would gain access to my hotel portal. They wouldn't fall for it back then and now even less. These days, here in Europe, collecting private info is 'not done' as you need to deal with all kind of administrative barriers to be able to store things like email addresses. It's just to much of a hassle.

@Gertjan said in Captive Portal not working on iOS devices only (DHCP 114): Anyway, I've edited services.inc : I assume you are now aware of the fact Kea's Affinity memfile does not survive a reboot and will loose expired leases that still have affinity "protection". Netgate has raised Redmine #15934 to attempt to address this and other lease expiry concerns but so has the Kea development team. See the link in the Redmine. The Kea development team have scheduled this for possible correction in V 3.0 which is slated for an April 2025 release. There is no certainty that they will include it. Until Kea supports Affinity surviving a reboot, using Kea with Captive Portal is very risky as a reboot will likely scramble the IP/MAC assignments unless the devices reconnect in the exact same order. We will have to use ISC until then, religiously have idle timeouts less than lease duration (and the frequent re-logins that implies), or incorporate a MAC Captive Portal authorization scheme like that proposed in Redmines 15854 or 15904 This suggests that we are unlikely to have a built in solution for Captive Portal ISC equivalent support under Kea at the next plus release (25.03?) or until Netgate incorporates Kea 3.0 into the pfSense plus and CE releases.

hello, sorry reply an old but interesting post. can i use this solution on premise inside my net without internet access , i meant in a local server with apache or nginx whatever.

@Jozy good luck with that mess.. I asked if you had messed with your outbound nat, I didn't say set it to manual.. Auto is the default - all of this would work with clicky, clicky with pfsense out of the box - the only reason it wouldn't is you messed with the defaults, etc.. Or you not even using pfsense as the gateway.. Which it seems your not.. ugggh..

@Gertjan said in Issues After Update from 24.03 to 24.11: @Cornel It took me a while, but the issue was hiding in plain sight. Thx - glad we now fully understand what was happening.