Captiv portal and vouchers integration with ssid on wlc 9800

Jozy

@Gertjan Thanks for the effort.

That's the problem since as I can see everything is enabled but I still don't get third entry for vouchers, only for username and password not vouchers. hm

you can see below fi something is wrong:

Is this ok for the local database?

I dont know what is wrong, is there some compability problem. PfSense version is 2.7.2 ?

Best regards,
Jozy

johnpoz

@Jozy looks to me you have it set to use custom, but don't actually have custom setup

Jozy

@johnpoz hm not sure what do you mean when you say that?

johnpoz

@Jozy your read @Gertjan posted write where you edit the template and add your voucher section..

edit: so what exactly is happening? You want to get rid of the username password prompt like @Gertjan was talking about? Because I just fired up captive portal on my guest network.. Connected with iphone, got the captive portal - and used a voucher to login.. It was pretty clicky clicky

And as I said before - this is not the captive portal, this is just the normal gui login

The default out of the box click,clicky captive portal is the image I posted above where I put in my voucher.

Your not running into a issue where your gui is listening on the captive portal port? I believe the captive portal is like 800x where x can change, etc. Are you using something like that for your web gui port? Example Just turned on the captive portal again to see what port its on, and its on 8002

[24.03-RELEASE][admin@sg4860.home.arpa]/root: netstat -anl 
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address                                 Foreign Address                               (state)    
tcp6       0      0 *.8002                                        *.*                                           LISTEN     
tcp4       0      0 *.8002                                        *.*                                           LISTEN

Jozy

@johnpoz Please if you can help me what exact lines I have to add in "captiveportal.inc" instead of
<input type="text" name="auth_user" placeholder="{$translated_text1}" id="auth_user">
<input type="password" name="auth_pass" placeholder="{$translated_text2}" id="auth_pass">

??

As well, what is URL for Captive Portal I should use and put to WLC if I want redirection to ?

Im using this - https://x.x.x.x/services_captiveportal_zones.php :)

I have downloaded and uploaded html from page to Captiv portal content but nothing -
https://docs.netgate.com/pfsense/en/latest/captiveportal/configuration.html#captiveportal-portal-page-contents-vouchers

Best regards,
Jozy

johnpoz

@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

As well, what is URL for Captive Portal I should use and put to WLC if I want redirection to ?

If your going to do the captive portal on pfsense, there is nothing to do on the wlc.. Its just the wireless connection - pfsense would handle the captive portal you enable in pfsense on the network your clients are connecting to via wireless.

I would suggest you get that working before you look into editing how the captive portal page looks.

If all your going to ever use is vouchers, you can edit the page to only show that as an option. But vouchers will work even if it presents the options of username/password.. But get your captive portal working before worry about how the page looks would be my suggestion.

You can always pretty up the page once you know its functioning ;) And I think there is even some 3rd party tools you could use to print out vouchers with qr codes on them, etc.

Jozy

@johnpoz maybe I didn't provide enough info.
First im using virtual open source pfSence version 2.7.2.
Second, I would like to have SSID guest configured on WLC which is only for guest connected to captive portal and providing vouchers if possible.
If I'm not asking to much I would like if we can have short call as I can share you my screen for 10-15 min just to go through this setup since you know it already and can see what is the problem :)

Best regards,
Jozy

johnpoz

@Jozy this is really just click click on pfsense. If your trying to do something with captive portal on wlc and forwarding it to pfsense captive portal that is where your problem is.

It took me all of like 3 minutes to get captive portal working on my wifi guest network.. I enable the captive portal on it, pretty much all default really and it was done. The longest part of it was having to remember where to download the csv of the vouchers I created so I could see a voucher number.

If you want to use the pfsense captive portal - until your ready to create a custom page.. Keep this unchecked

I really wouldn't even worry about users or vouchers until when your client connects he sees that login page.. If so then your captive portal is working.. Then you can create users or vouchers..

This is really click enable and pick the pfsense interface you want to run the captive portal on, and hit the save button on the bottom of the page.. There isn't much else to it.

On your wlc don't setup any sort of captive portal, normal in a captive portal there is no login to the wifi.. But you could use just a psk auth to connect the client to the wifi if you want to make sure your captive portal is working before you move to no auth.

Gertjan

@Jozy

When this is activated - vouchers :

and you use the default portal settings : this - NOT checked :

you see this as your portal login page :

If the user has a voucher code, then they should use the third text box marked Voucher code.

Jozy

@johnpoz @Gertjan I completely agree with you it is just straight forward with only few clicks but whatever I try it doesn't want to open third party for vouchers.
So, when connecting to SSID it redirects me to

so, you can see here I cant get third party for vouchers.
Maybe the problem is what you have mentioned at the beginning with about:
/etc/inc/captiveportal.inc - search the function get_default_captive_portal_html() to get the default captive portal htm

	<input type="text" name="auth_user" placeholder="{$translated_text1}" id="auth_user">
	<input type="password" name="auth_pass" placeholder="{$translated_text2}" id="auth_pass">

If yes this is something Im not sure how/what to add what lines are correct?

Best regards,
Jozy

johnpoz

@Jozy that is NOT the captive portal

The only way you would see that is if you have your wlc redirecting.. That page would be available on whatever your normal gui ports are? 80/443?

The captive portal is going to be on some 800x port..

Or your captive portal isn't even running and your just hitting the pfsense IP on whatever ports your normal web gui is listening on.

edit:
Here.. did a quick packet capture of what happens when client hits the captive portal.. See how the redirection sends it to the port the captive portal page is being hosted on.

Gertjan

@Jozy
Removing this :

will remove this :

But that's not the issue right now.
Let's keep it for later.

The device you use to connect to the captive portal, what IP does it huse ? What network mask ? What DNS does it use ? What is the gateway ?
Same question : what was the DHCP lease you received ?

On the pfSense side : what is the IP of your captive portal ?

Do you remember that I said above, two times already : to start a first captive portal, do not use your pfSense .....

Jozy

@Gertjan Yes, I know if we remove lines form /etc/inc/captiveportal.inc will remove user and password functions.

The device I'm using for this is android, with Ip address x.x103.48/24 and gateway 103.1 given from DHCP server configured on WIN server, actually I get it when try to connect to SSID which redirects me.
I'm using internal DNS x.x.112.10 and gateway x.x.112.1.

ip address of pfsense is x.x.110.155 and that one I'm using for pfsense and as well on WLC side for redirection.

https://x.x.110.155/services_captiveportal_vouchers.php?zone=captivportal?switch_url=https://192.0.2.1/login.html&redirect=<website-name>

you mentioned this" Do you remember that I said above, two times already : to start a first captive portal, do not use your pfSense ....."
Does it mean I have to have different ip address on different subnet configured for Captive Portal, not using ip address of the pfsense

Best regards,
Josip

johnpoz

@Jozy so your lan is only wifi devices? Or you have mac filtering in place to allow your wired devices to bypass the captive portal.. Putting a captive portal on your lan is an easy way to lock yourself out that is for sure.

So are you using public IP space.. Not sure why you would need to hide rfc1918 space?

ip address of pfsense is x.x.110.155 and that one I'm using for pfsense and as well on WLC side for redirection.

Again!! you should not be using any redirection in wlc!! you sending traffic to some IP on pfsense is just going to call up the webgui!! like your seeing..

Gertjan

@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

The device I'm using for this is android, with Ip address x.x103.48/24 and gateway 103.1 given from DHCP server configured on WIN server, actually I get it when try to connect to SSID which redirects me.
I'm using internal DNS x.x.112.10 and gateway x.x.112.1

That's ... strange.
( The gateway and DNS is outside of the network your portal clients get, so not reachable )
.
When your obtained a lease, but not logged in yet, your device can't reach anything outside of the 'portal network'.
Btw : hiding RFC1918 is meaningless. For example, your " x.x103.48" is RFC1918, right ?

Example : My captive portal interface uses :

And this is my Portal (OPT) DHCPv4 server :

@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

Yes, I know if we remove lines form /etc/inc/captiveportal.inc will remove user and password functions.

That's not the way of doing things.
You should make your own html login (and error) html page, and uploading it into pfSense here :

Jozy

@Gertjan hm
lets see something

10.223.110.155 is pfSense ip address while 192.168.15.1 is opt which I bind to CaptivPortal

My concerns is following: if I want to reach 192.168.15.1 which is Captiv Portal , how should I do it since this network is on virtual interface of my VMware.
Does it mean I have to configure new vlan and configure it through the network or I have to than configure rules on pfSense?

Should this network range being used by clients connecting to SSID even if I have already configred DHCp for that SSID on Win side? hm
Regarding HTML, I would like first focus on solving this.

Best regards,
Jozy

Jozy

@Gertjan @johnpoz Hi

I have following situation

[2.7.2-RELEASE][admin@pfSense.home.arpa]/root: netstat -anl
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 96 10.223.110.155.22 10.223.100.28.54426 ESTABLISHED
tcp4 0 0 10.223.100.180.8002 10.223.100.28.54421 TIME_WAIT
tcp6 0 0 *.8003 . LISTEN
tcp4 0 0 *.8003 . LISTEN
tcp6 0 0 *.8002 . LISTEN
tcp4 0 0 *.8002 . LISTEN
tcp4 0 0 10.223.100.180.22 10.223.100.77.53762 ESTABLISHED

When telnetting to ports 80,443,8002,8003 everything works fine but not working when try to open on browser?
Seems there is some problem on Nginx, you know what it could be?

Best regards,
Jozy

johnpoz

@Jozy

Well yeah that not going to work...

https captive portals can be problematic - cuz your browser isn't going to trust the cert, and where you got sent isn't going to match the name the client is trying to go to, etc.

But in your case you tried to use plain old http but went to a https port.

Are you still trying to redirect in wlc? I showed you what happens when a phone tries to detect if there is a captive portal, it doesn't use https.

Jozy

@johnpoz Im trying open in on PC over browser locally not over SSID configured on WLC. First i think I should have it running then can go to the second step and try to open it over SSID.

Is possible there is some bug?
If you can send we link to download proper version, since its possible that I have downloaded it from the wrong site :)

johnpoz

@Jozy proper version of what? Open the captive portal in your browser from where.. There is redirection that happens as well.. Not sure you can just the captive portal without the redirection

[24.03-RELEASE][admin@sg4860.home.arpa]/root: cat /tmp/rules.debug | grep cpzoneid
table <cpzoneid_2_cpips> { 192.168.200.1}
ether pass on { igb3.10  } tag "cpzoneid_2_rdr"
ether anchor "cpzoneid_2_auth/*" on { igb3.10  }
ether anchor "cpzoneid_2_passthrumac/*" on { igb3.10  }
ether anchor "cpzoneid_2_allowedhosts/*" on { igb3.10  }
rdr on igb3.10 inet proto tcp from any to ! <cpzoneid_2_cpips> port 80 tagged cpzoneid_2_rdr -> 192.168.200.1 port 8002
pass in quick on igb3.10 proto tcp from any to <cpzoneid_2_cpips> port 8002 ridentifier 13001 keep state(sloppy)
block in quick on igb3.10 from any to ! <cpzoneid_2_cpips> ! tagged cpzoneid_2_auth ridentifier 13003
[24.03-RELEASE][admin@sg4860.home.arpa]/root:

And there is some etherules as well that are going to happen.

If your on the network you have the captive portal on and you try and hit something on port 80, ie normal http you should be redirected to the captive portal.. I really don't feel like changing my network around to show some pictures of something that is so basic..

When I turn it on my guest network, its kicking my work laptop off the work vpn.. If I get a chance do some stuff so I can play with it without disrupting my normal flow. Could prob fire up another ssid and connect to that with my main pcs wifi card so not to mess with my normal access on my pc or my work laptop.