Captive portal shows blank page

vanlier

Sorry for yet another topic that is similar to 100+ topics already about this subject. I have read those and don't think my case is alike as I cannot get it to work.

Here is the techinfo:

PFSense comm edition 2.6.0-release on pc hardware
2 ethernet interfaces, 1 for WAN, 1 for LAN
multiple VLANs with on interface LAN
1 of the vlans is "guest" with vlan ID 50, subnet is 192.168.50.254/24 (pfs = .254)
DHCP active on interface "guest" with dns set to 192.168.50.254
Captive portal is enabled on interface "guest" with mostly default settings (authentication set to none for testing)
wifi AP also has vlan 50 configured for guest wifi
dns resolver enabled on all interfaces

Here is the situation before activating captive portal:

clients connect to wifi
they get a 192.168.50.x ip address from dhcp with dns 192.168.50.254
they can browse the internet (dns resolution and internet access are working)

Here is the situation after activating captive portal:

clients connect to wifi
they get a 192.168.50.x ip address from dhcp with dns 192.168.50.254
nothing happens

So no redirection. There are no other routers, only pfsense. VLAN config is correct als all vlan's are working as expected without captive portal.

This is what I have tested:

Disable mac filtering
Set various redirect urls
Add pfsense address in vlan "guest" to allowed ip
add firewall rule allow any any on interface "guest"

Strange thing:

I have another VLAN, let's say "office" with VLANID 10 and subnet 192.168.10.254/24. I have a firewall rule "allow office subnet to any so i shoud be able to access captive portal in "guest".

As soon as I enable the captive portal on interface "guest", I can manually open the captive portal on "http://192.168.10.254:8002 (pfsense ip in office vlan). It shows the login page and when I login I am redirect to the "post redirect" url.

However when opening the same page with the pfsense ip in the guest subnet (http://192.168.50.254:8002) I also get a blank page. Now when I change the interface on wich the captive portal is configured (from "guest" to another interface) I can open http://192.168.50.254:8002 and the loginpage shows.

So the interface the captive portal is activated on is outputting a blank page (html reponse 200 and nginx headers received, just no content at all) and all other interfaces output the correct captive portal page.

Is this a bug or am I doing something wrong??

Gertjan

@vanlier said in Captive portal shows blank page:

Here is the situation before activating captive portal:

clients connect to wifi
they get a 192.168.50.x ip address from dhcp with dns 192.168.50.254
they can browse the internet (dns resolution and internet access are working)

Important test ! Good to know.

@vanlier said in Captive portal shows blank page:

Here is the situation after activating captive portal:

clients connect to wifi
they get a 192.168.50.x ip address from dhcp with dns 192.168.50.254
nothing happens

Using the 'default' build in login page, right ?
You can't say that 'nothing happens' : you can't 'see it', but something happened.
Every OS on planet earth will throw out a http:// request as soon as it obtained a DHCP lease.

Check here : Status > System Logs > System > GUI Service
Every OS using it own http request.
For my iPhone it's :

This is the page that it want to download :
http%3A%2F%2Fcaptive.apple.com%2Fhotspot-detect.html
Better known as :
http://captive.apple.com/hotspot-detect.html
Click on it and you'll see what happens.
You should see this :

If the html page doesn't contain "Success" then the device start to presume a captive portal is might be present.
Now, the OS launches a stripped down web browser, bot the full fledged IE, Chrome, Edge, Firefox, but a small bare bone browser. It's launched with the same web destination : http://captive.apple.com/hotspot-detect.html
First, again, "captive.apple.com" will get resolved (was already found during the same test, some ms before).
Then the browser connects to the IP on port 80 (remember : http), and asks for the page /hotspot-detect.html

On the pfSense side, this "some destination IP : port 80 " request gets redirected to the internal login portal web page server on port 800x" with the help if a firewall rule (pfSense 2.6.0 : ipfw rules - the newer pfSense uses pf now).
The portal page web browser does just one thing : it redirect the requesting browser to
(your case) http://192.168.50.254/index.php?zone.....

It also adds a 'zone' parameter, and 'redirect' parameter.

The result will be of course : the captive portal login page shows up.

So : to make this work, one thing needs to work for sure : DNS.
The captive portal firewall rule works, that is for sure. If not, Netgate and FreeBSD will go out of business tomorrow.

[https://docs.netgate.com/pfsense/en/latest/troubleshooting/captiveportal.html](link url)

Btw : you already know that the 'default' pfSense 2.6.0 needs portal patches, right ?

@vanlier said in Captive portal shows blank page:

Disable mac filtering

That's of if you want to 'break' things.

@vanlier said in Captive portal shows blank page:

Set various redirect urls

https://www.google.com works fine.

@vanlier said in Captive portal shows blank page:

add firewall rule allow any any on interface "guest"

The GUI firewall rues ? None is needed (I guess ?), the authentication will still work.
But as soon as authenticated, yoy can go no where.
Use the default LAN pass all TCPv4* rule to begin with.

@vanlier said in Captive portal shows blank page:

However when opening the same page with the pfsense ip in the guest subnet (http://192.168.50.254:8002

Invalid request.
The ?zone=xxxx parameters needs to be present.

These :

don't work for you ?