Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Allowed IP Address does not work in captive portal

    Scheduled Pinned Locked Moved Captive Portal
    19 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nomanharoon @rcoleman-netgate
      last edited by

      @rcoleman-netgate U know this is one of the main feature of captive portal which is not working. A lot of community who are using this feature of captive portal speed limitation, when they will upgrade to 2.7 they will be disappointed. so this need to be fixed urgently.

      R 1 Reply Last reply Reply Quote 0
      • R
        rcoleman-netgate Netgate @nomanharoon
        last edited by

        @nomanharoon Include as much detail in the redmine as you can today as that will save the engineers time and help get any bug addressed more quickly.

        Ryan
        Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
        Requesting firmware for your Netgate device? https://go.netgate.com
        Switching: Mikrotik, Netgear, Extreme
        Wireless: Aruba, Ubiquiti

        N 1 Reply Last reply Reply Quote 0
        • N
          nomanharoon @rcoleman-netgate
          last edited by

          @rcoleman-netgate I have shared a video link, kindly check it. Also I am sharing with PF Sense engineering team.

          https://drive.google.com/drive/folders/1kVCGz0lYrItvGxy6muFJ05PSN0l2O5B4?usp=sharing

          GertjanG N 2 Replies Last reply Reply Quote 0
          • GertjanG
            Gertjan @nomanharoon
            last edited by Gertjan

            @nomanharoon

            I'm not using 2.7.0, I have 23.05.1, so I'm not sure if my observations are comparable.
            I do know I use the same 'pf' version (the firewall), and the captive portal pfSense script file are identical.

            I'm using FreeRadius, where I only assigned a user name and password.
            The advantage is : I can chose one user (one user account) to have, for example, a speed limit only for this user.

            I've set up my test user, and added :

            c180acdf-b43a-48b1-8c0c-0e2a19687a32-image.png

            Btw : these setting, on the captive portal settings page, isn't used :

            bdaf9d4f-02d1-4b1d-9cbd-795c3e0b6efb-image.png

            I've checked on the command line :

            pfSsh.php playback pfanchordrill
            ...
            
            cpzoneid_2_auth/192.168.2.6_32 rules/nat contents:
            ether pass in quick proto 0x0800 from e0:92:5c:d9:6c:fe l3 from 192.168.2.6 to any tag cpzoneid_2_auth dnpipe 2008
            ether pass out quick proto 0x0800 to e0:92:5c:d9:6c:fe l3 from any to 192.168.2.6 tag cpzoneid_2_auth dnpipe 2009
            ....
            

            192.168.2.6 is my 'Phone' device.

            192.168.2.6 is using the pipes 2008/2009 :

            00634996-06e1-4426-a89c-46335f4a05dd-image.png

            I've tested on my Phone test up download speed :

            It was close to 1 Mbits Up and Down :

            3b013722-aebe-48bc-9280-2a060882fdcc-image.png

            instead of the usual +100 Mbit up / down :

            ad89bb97-6755-4cea-ab66-489b7eac333a-image.png

            edit : well ... raw speed depends a lot on the number of actve portal users, and right now, there are a lot (tourists).

            My advise : if bandwidth limiting is important : use 23.05.1 (and FreeRadius for fine control) : it works.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            N 1 Reply Last reply Reply Quote 0
            • N
              nomanharoon @nomanharoon
              last edited by

              @nomanharoon The BUG is in 2.7.0 CE for real. you are using 23 plus which probably do not have this issue.
              Our concern is to solve captive portal allow ip problem. thanks

              Did you see my videos !!!

              1 Reply Last reply Reply Quote 0
              • N
                nomanharoon @Gertjan
                last edited by

                @Gertjan kindly watch these two videos. One identify the issue of 2.7.0 CE
                Second tells that in pfsense old edition 2.3 works perfectly fine.

                https://drive.google.com/drive/folders/1kVCGz0lYrItvGxy6muFJ05PSN0l2O5B4?usp=sharing

                1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @nomanharoon
                  last edited by

                  I reread the entire thread.

                  I'm still using

                  @nomanharoon said in Allowed IP Address does not work in captive portal:

                  captive portal not restricting incoming speed when i
                  try to restrict it throught Allow IP interface

                  but ...

                  I've added my iPhone IP 192.168.2.6 to the Allowed IP list :

                  93af74b9-6c7d-4328-8420-96c85b5e3c02-image.png

                  with a 1,5 Mbits sec band with limiter, up and down.

                  a13fc747-a52f-4176-9957-8083c878c381-image.png

                  I connected my phone - double checked the IP it received : 192.168.2.6

                  pfSsh.php playback pfanchordrill
                  .......
                  cpzoneid_2_allowedhosts/192.168.2.6_32 rules/nat contents:
                  ether pass in quick proto 0x0800 l3 from any to 192.168.2.6 tag cpzoneid_2_auth dnpipe 2008
                  ether pass in quick proto 0x0800 l3 from 192.168.2.6 to any tag cpzoneid_2_auth dnpipe 2009
                  

                  so pipes are 2008/2009 :

                  Limiters:

                  ....
                  02008:   1.500 Mbit/s    0 ms burst 0 
                  q133080 100 sl. 0 flows (1 buckets) sched 67544 weight 0 lmax 0 pri 0 droptail
                   sched 67544 type FIFO flags 0x0 16 buckets 0 active
                  02009:   1.500 Mbit/s    0 ms burst 0 
                  q133081 100 sl. 0 flows (1 buckets) sched 67545 weight 0 lmax 0 pri 0 droptail
                   sched 67545 type FIFO flags 0x0 16 buckets 0 active
                  ....
                  

                  Speedtest on the phone : 30 Mbits sec up and down ......
                  Yeah, something isn't good.

                  MAC based speed limiting works ...

                  (I removed the Allowed IP entry / 192.168.2.6)

                  Added the Phone MAC entry to MACs list :
                  Still using the same IP 192.168.2.6

                  cpzoneid_2_passthrumac rules/nat contents:

                  pfSsh.php playback pfanchordrill
                  ......
                  cpzoneid_2_passthrumac/e0925cd96cfe rules/nat contents:
                  ether pass in quick from e0:92:5c:d9:6c:fe l3 all tag cpzoneid_2_auth dnpipe 2014
                  ether pass out quick to e0:92:5c:d9:6c:fe l3 all tag cpzoneid_2_auth dnpipe 2015
                  

                  And I can see that these pipes 'do something' == are being used :

                  a3e22e72-bfd0-4c8a-a0c4-2cb078f29e34-image.png

                  edit :
                  IP : "tag"
                  MAC : "all tag"

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    nomanharoon @Gertjan
                    last edited by

                    @Gertjan Dear Gertjan I am not delusional :), Did you see the videos I uploaded. ? I am not making this up. It did'nt
                    control.

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @nomanharoon
                      last edited by

                      @nomanharoon

                      Me seeing you experiencing isn't that important ;)
                      I believe you.

                      IMHO, me - or some one else - being able to reproduce, is also important.

                      From what I saw, Allowed MACs placed in the "cpzoneid_2_passthrumac" anchor use the attached pipes, pipes that limit the flow speed.

                      Allowed IPs, placed in the cpzoneid_2_allowedhosts anchor do not seem to use the attached pipes, pipes that should limit the flow speed.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        nomanharoon @Gertjan
                        last edited by

                        @Gertjan By See this "Allowed IPs, placed in the cpzoneid_2_allowedhosts anchor do not seem to use the attached pipes, pipes that should limit the flow speed." I now knew that you know it does'nt work. Which needed to be fixed :) And I am waiting when the stable version will be released which have these problems corrected. THanks

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.