Old topic, similar problem. After some of my guests complained about lack of internet access through the Portal, I found that they were trying through the Google app, which requires logging in to their Google account before anything else happens.
Either they didnt have a separate browser installed, or if they did, they didnt know how to use it.
If they had Chrome, that worked OK.

On this subject, I get a lot less problems reported using the username only for logging on. That is enough to keep out the casual leachers, which is all I care about.

Unifi already support dynamic vlan over radius.
I just need to make it work thru the captive portal.
Anyone has succed with this?

It works! Thanks.

And it also works if the pfsense LAN interface and the combo-router are on different subnets (10.0.0.x for pfsense and 192.168.1.x the combo-router). The smartphone gets a 10.0.0.x IP and 10.0.0.1 as the default gateway even though it cannot see the combo-router at 192.168.1.254. How can this be? Can the smartphone see all MACs?

@doktornotor:

You obviously are NOT supposed to delete certificates that are being in use. In fact, I filed a bug about thing being allowed, already fixed in 2.4.x - except for the WebGUI case.

https://redmine.pfsense.org/issues/6947

I did NOT delete the certificate while it was in use. I selected our certificate and deleted the default.

@jlorenz89:

2. They are redirected to the captive portal and have to accept the terms but pressing accept

Use
This means "Authentication method" must be set to "Local User Manager / Vouchers" or "Radius" so a login page (with hidden authorized user and password)  shows with your terms of use.
Using a login page means : no more MAC temporary usage.

What you want isn't possible.

Are these terms of usage that important ? What about printing them on a paper, so you can skip this part..

Ok, right.
This is the English support section, the other languages are here (below).

Just make sure they can't just "choose" to be elected your spanning tree root or something stupid like that.

Are your wired and wireless networks on the same layer 2? You might consider separating them else someone who connects wired and wireless at the same time with something like an Airport express in "join a wireless network" mode will create a bridging loop. probably many ways to accomplish that with two ports to the same layer 2 in the same location. (one wireless, one wired).

You ought to be able to just use the same CP on both networks.

No. Not until someone writes proper hooks for ipfw to be used in packages. Cf. https://redmine.pfsense.org/issues/5594

Thanks will look into it

@doktornotor:

CP and Squid in transparent mode will NOT work.

Thank you very much!

FreeRADIUS on pfSense? You can't. If you use it externally, there might be a GUI that lets you do that somewhere, but it's not a pfSense feature, it would be some other bit of software.

When trying to connect to WIFI with mobile devices it just hangs in "Connecting WiFi" page and not get redirected to captive portal. During this time shouldn't I be able to connect to captive portal by manually typing the captive portal URL. When I do so on mobile, it says connection refused.

Not possible. Anyone with access to page-system-usermanager is effectively root.

No it didn't.

It is simply not possible to get in the middle of an HTTPS connection and not generate a certificate error unless you can mint a certificate for the original destination signed by a CA trusted on the device. And even then you are hampered by certificate pinning, etc.

I would love to see the certificate generated by the captive portal that was presented when you tried to go to a regular, global HTTPS site and got the portal instead without a cert error being presented.

in sys file there is a method like below, in it I set.
That method produces nginx config file.

function system_generate_nginx_config(…)
....
events {
    worker_connections  1024;
  **  multi_accept on;**
}
….

When I set "multi_accept on;" will it cause any problem?

NOTE:
The web sites about nginx saying like below about "multi_accept on;":

We've enabled multi_accept which causes nginx to attempt to immediately accept as many connections as it can. The option multi_accept makes the worker process accept all new connections instead of serving on at a time. If multi_accept is disabled, a worker process will accept one new connection at a time. Otherwise, a worker process will accept all new connections at a time.