For the moment it is not possible.

pfSense frontend doesn't have that option and the backend doesn't have it too.

I've been doing some testing with Kiffuser as you can see here…but so far no good. Have asked for some advice but no go too, it seems wireless development is for some reason in standby when it comes to authentication methods.

I think we already got somewhere but we haven't had much time to go anyfurther, maybe in the next weeks.

The easy part is making the frontend thing, which is creating the interface for the radius settings...our problem know is putting the correct values in the $config["wireless"]["…"] array…so it can pass the correct settings to hostapd_ath0.conf and save the configuration XML.

For now we're getting a pretty messed up hostapd_ath0.conf, as there are some settings needed that we can't get from $config[] var. In here, at the bottom you can see an example for what is needed in hostapd_ath0.conf, but so far we haven't been successful.

If you or someone else have something that could help, or if something that i said is wrong, please correct me.

I noticed the pfSense you are running is based on what is now a fairly old version of FreeBSD. It might be worth trying a recent 1.2.3 snapshot build.

Okay, fixed the problem. First thing was, the authentication setup was messed up (i think one can see that on the screenshot). basically i set it to WPA2/PSK/AES now. The phone will correctly connect to the wlan and authenticate.

however i found that i could not reach the phones ip adress (e.g. ping). i tried a lot of things, until i found out i had to bridge then LAN interface with the WLAN interface too (as seen on the screenshot, the WLAN interface was already configured to bridge with LAN). i didnt know this, so right now i need to bridge WLAN -> LAN and also LAN -> WLAN. Saving this configuration & applying the wlan now works, i can access the phone by ip and i can access my lan/interet on the phone via wlan.

now strange thing is that changing some unimportant setting in WLAN options breaks the wlan again, leaving the phone unable to connect. only if i go to LAN settings again and hit save followed by apply settings (without changing the configuration) solves this problem and the wlan works again.

anyway it seems to work now, thanks for your support.

@wallabybob:

This is a kernel problem generally caused by some code attempting to derefrence the NULL pointer. These are often quite difficult to debug without a crash dump. Sometimes they are difficult to debug with a crash dump. In this case its probably up to the FreeBSD developers to fix the problem and you would be doing the community a service by lodging a FreeBSD problem report at http://www.freebsd.org/support.html

I believe the problem is the same as http://www.freebsd.org/cgi/query-pr.cgi?pr=119945.  It has been fixed long time ago in OpenBSD-current (see the URL), but I suppose the patch didn't make it into FreeBSD.  Is there a hope to include it in pfSense, because FreeBSD developers don't seem too worried about this particular problem?

Did you try the modules from FreeBSD 7.2? The ones linked are for 7.0. Any messages logged on startup? You could try kldloading the modules from a shell and see what the result is.

This is normal behavior for Bonjour. Bonjour uses a multicast address for each connected interface, local to that interface. It won't be pass ed through the bridge. What you need is a reflector for bonjour to broadcast mDNS info. Avahi is just that reflector. I couldn't install it via the package manager as of 1.2.3rc2 on tinybsd but a manual install worked fine. I used the tutorial here
http://www.ucsecurity.com/article/2008/12/29/avahi-on-pfsense/

The added plus is now my pfsense box shows up as a device in bonjour for one click ssh and webgui, very cool.

As a final resort, you could just map the addresses in dns, but thats work.

I seemed to have figured it out.  Well, I should say I don't know why it wasn't working before but I found some settings that seem to work.

This card has a turbo mode and it seems to work best when set to turbo in pfsense.  Turbo mode requires channel 6 so it is set to channel 6.  I found some people using FreeBSD who had problems using WEP with this card so I am using WPA2.  You shouldn't use WEP anyway but whatever.  I had it off for several days but in the firewall.  I enabled it one night with these settings and it has worked ever since.  The range was pathetic so I bought a new 7db antenna which solved my range problems.  I spent some time testing with different angles and placements too to find the best position.

All in all it seems to work now.  I guess Atheros based cards can work.  I am keep hearing on the forums that they are simply plug and play.  Not the case in my experience.  Lots of online research and monkeying around to find what works.

Search for 3g or evdo. Here is a recent thread: http://forum.pfsense.org/index.php/topic,17756.0.html
Support for mini-pcie cards and usb modems is coming along, support for a phone as modem is unlikely.
IMO, this should go somewhere else (hardware?), as this board is primarily concerned with 802.11

what other, if any, info do i need to post to help me get this issue resolved? my router shows it trying to connect to the webpages, but nothing goes..

Okay, very nice. Just need to get OpenVPN filtering running now and PfSense does everything I need  :-*

I will be a struggle but I will try not to look at the errors  ;D

@GruensFroeschli:

Just type the IP of your wireless router in the webbrowser of your choice.
The pfsense in between should make no difference.

Ah, but it does.

I cant access it at all.
And if I install windows on the now pfsense box, and just enable ICS, I can.

Its as though there is a rule, or something,that needs to be adjusted in pfsense, to allow me that kind of access on the wan interface from the lan interface.

The pfsense box can ping 192.168.1.1 quite fine.
But the machines behind pfsense cant.

Any Idea?

EDIT

solved!
Accomplished by adjusting subnet of machine on LAN interface.
From 255.255.255.0, to 255.255.255.240 (as my ip is 243, the last digit could not be any higher than 243).

Its an atheros chipset man, thanks for the reply. The card is a Linksys, I would give you more detail on the card, but its the same card ive used for my pfsense firewall since day one, even the current version im using now :P Its always worked, no changes to version, just a new hdd, thats all.

You should really use optical for building-building runs. Since the buildings are distant, it's possible for them to be at fairly different ground potentials. This can damage equipment and be a major safety hazard if someone touches contacts on an Ethernet cable. Plus it will get you the distance you need. This might complicate things for installation in the parking lot though; what facilities are available there, or are you trying to mount a small AP on top of a light standard or something?

You can get 100baseFX (and even 1000baseSX) gear quite cheap on eBay these days. You'd need a couple fibre NICs or switch ports at your pfSense box, and then a media converter for your wireless APs, or again switch ports.

If you keep all the APs on the same SSID and in the same network segment, the clients should switch to any of them on their own (but usually only when they totally drop signal with the old AP, which could be a problem for you).

As far as guest access, proper commercial APs can do multiple SSIDs with different security settings, and then tag them with different VLANs. This might be a setup to look into, you could use no encryption with CP for guests and then WPA2-enterprise for your corporate clients. The problem is that you then need to buy enterprise grade APs, which aren't cheap. You might be able to use the Ubiquiti hardware (which I'd recommend anyway) with 3rd party firmware to do this, but I know their included firmware doesn't support it.

This device is not supported.

http://www.freebsd.org/releases/7.2R/hardware.html#WLAN

I do it manually, because I do not go to sleep at the same time everyday, but I tested with airodump-ng and that the AP card is down and it does not send any signal.
But for sure that in a cron job it will work well too.

You know , I do not want to put aluminium foil in my head to prevent the wifi burn my brain at night.. ;) hehehe.

Does anyone have a clue on this?

Manually editing hostapd.conf didn't work out, maybe we're missing some options on the file…i think that these settings should be enough (plz correct me if i'm wrong), obviously with custom settings:

##### RADIUS client configuration ############################################# # The own IP address of the access point (used as NAS-IP-Address) own_ip_addr=127.0.0.1 # Optional NAS-Identifier string for RADIUS messages. When used, this should be # a unique to the NAS within the scope of the RADIUS server. For example, a # fully qualified domain name can be used here. nas_identifier=ap.example.com # RADIUS authentication server auth_server_addr=127.0.0.1 auth_server_port=1812 auth_server_shared_secret=secret # RADIUS accounting server acct_server_addr=127.0.0.1 acct_server_port=1813 acct_server_shared_secret=secret

If these changes worked, they wouldn't be permanent…like said in the linked post, for that we should hardcode /etc/inc/interfaces.inc...what are the var $config["wireless"]["…"] settings to configure the ieee802.1x configs?

Some advice would be appreciated…Thanks in advance!