Captive Portal Screen Not Loading

stevencavanagh

Hi,

I have set up C.P on Pfsense but when I connected to the guest network (VLAN) for C.P the screen is not displayed. I get the correct IP address.

I read that DNS needs to be blank on the interface, which is done but no difference.

Believe it is likely to be the DNS not resolved issue but despite this and messing with DNS forwarder I cannot get it to work.

I'm running 2.7.2

Any help appreciated!
Steve

Gertjan

@stevencavanagh said in Captive Portal Screen Not Loading:

Believe it is likely to be the DNS not resolved issue but despite this and messing with DNS forwarder I cannot get it to work.

If "messing" means "breaking", then yes, the portal needs a working DNS.
I can advise you use the pfSense default DNS setup - so no modification or addition from you side are needed.
The default setup was present when you installed pfSense, before you logged in the first time.
At that moment, DNS was working.

This is the image of a perfect setup :

and this (which is default - but Ive added some interfaces myself - one of them is the portal interface) :

although, this might be better :

so the resolver 'listens' on all internal interfaces.

edit : let's check that :

[23.09.1-RELEASE][root@pfSense.bhf.net]/root: sockstat | grep 'unbound'
unbound  unbound    32766 3   udp6   *:53                  *:*
unbound  unbound    32766 4   tcp6   *:53                  *:*
unbound  unbound    32766 5   udp4   *:53                  *:*
unbound  unbound    32766 6   tcp4   *:53                  *:*
unbound  unbound    32766 9   tcp4   127.0.0.1:953         *:*
.....

This command, and the answer, tells me that the unbound process (the resolver) listens an "ALL" xisting interfaces ( yep, even on WAN ;) ), using both IPv4 and IPv6, using protocol UDP and TCP.
And also on 127.0.0.1:953, which is the 'control' port (not important for the portal).

Troubleshooting Captive Portal the most common reason of the captive portal not working is : "DNS resolution not functioning".

Check that there are firewall rules on the captive portal's interface that permit incoming DNS traffic (TCP and UDP, to port 53).
I did this by using these two pass rules :

Now, when you connect a device to the portal, before logging in, DNS should work.
You could use, for example, "nslookup" (windows PC) to test.

Btw : If you have to forward to some other, remote resolver, for whatever your reasons are, then that's not problem, but assure yourself that DNS on every 'LAN' interface keeps working.

stevencavanagh

@Gertjan Thanks for the detailed info, I will give it a go.

Much appreciated
Steve