Have you set your pfSense to act as DNS proxy/forwarder and are your clients using the pfSense's LAN address as their primary DNS? Unless your clients can resolve external addresses you won't be redirected to the CP landing page.

Hi, do you have any experience about reaching the captive portal through ipsec vpn?

local - cyberoam –-----ipsec vpn----------------pfsense in cloud

when an unauthenticated user wants to go to the internet, we want to pfsense's captive portal comes to this user, is it possible, how can i do this?

i wrote a policy in cyberoam, which asked pfsense's radius the users credentials, in cyberoam's captive portal, which asked the credentials to the pfsense, the user can logon correctly, and internet opened, and than,  i tried to redirect pfsense's ghost's url instead of cyberoam's captive portal, but the user can not be authenticated with this way, the mechanism is not the same.

i need a solution to popup the pfsense's captive portal in front of the unauthenticated users through ipsec vpn.

Thanks
serhan

There are 6 separate APs, spread around the two buildings.  I would not expect to see more than 20 or so users per unit (I have logged into them when busy).  I am generally not onsite when it's busy which is difficult.  2 APs are on one interface and 4 on the other.

I am not fixated on the CP max users as such, I was just wondering what happens when several people try to connect at once, and the max is reached.  I understand it's not the amount of users that can pass through, just the amount that view the login screen, but at times, looking at the logs, several people do login in quick succession.

iPhones recently do not seem to throw up the captive portal login when you connect the AP any longer.  They used to.  I wonder if this could be causing users problems, as they assume they are connected when they're not?  Many these days don't even open browsers, it's straight to FB, email, twit etc.

Need to find some time to update to the latest version I guess, but will see how things go now squid is disabled.

Ubiquiti AP's are supposed to be very good in terms of number of users?  I have used a few of them poreviously, and thinking of replacing with these.  They also allow roaming between APs, although I think this is software based, and not too sure how it works.  Need to have a closer look.

Thanks.

Same problem on 2.2.2. Empty radacct table

@teekaypapa:

i am using LAN for the Portal

Good luck  ::)

(P.S. DNS servers must be allowed through the CP or nothing works.)

@new_in_pf:

pfsense 2.1-release  i386

Perhaps you could try with something uptodate…

yap you right…not a professional like you guys...but try to find short cut and learn something new!! Thanks for reply

Creating master master replication is way easier then creating some RADIUS monitoring script.

Got it, thanks for your input.

Squid and CP ?
Read me first : https://forum.pfsense.org/index.php?topic=91435.0

Conclusion : forget about squid for the moment.

Ah, IE10 is fine, so I'm a little less worried - there probably won't be too many IE8 users trying to use the system (they're mostly smartphone users anyway). I guess some security stuff changed in between IE8 & IE10, and the upgrade of pfsense from 2.1.5 to 2.2.1 has exposed that. I'll still see if I can figure out what's going on and update here later.

good afternoon first you must go to decargarte FreeRADIUS packages then you have it downloaded notify us and we will tell the next steps so you can create the user with the captive portal

Read the manual.

https://doc.pfsense.org/index.php/Captive_Portal_Pre-authentication_Redirect

Most information that transits the ISO layers is finally treated by ….... humans (our web pages, mails, etc).
So ....

@Gertjan:

The one with a free support phone number ? With all the Microsoft knowledge behind it ?
Of course,  "Windows 2008 Xx Xxxxx server" users do NOT share their knowledge because they all paid the get it. Microsoft forces you to do the same thing …

More serious : what about this idea : Windows 2008 R2 Radius server could replace FreeRadius - it your choice, so you adapt yourself.

Thank for your help! Gertjan!

IPsec is not really an interface, it is a VPN tunnel.
The gateway in DHCP is the OPT1 interface. Everything after this is already routed into the tunnel, so there is nothing else I could use as Gateway.

After doing all sorts of things, it would seem that all that I needed to do was make a rule allowing UDP port 53 on the OPT1 and everything became mellow. I am not sure why I would have to do a rule on the OPT1 but not on the LAN, but it is working.

I hope that one of the experts will explain what actually happened  ;)

@thuyle:

_if ($username = "unauthenticated") {  // In captiveportal.inc#L2071  has only one equal symbol

That was fixed in 2.2.1._