Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captiv portal and vouchers integration with ssid on wlc 9800

    Scheduled Pinned Locked Moved Captive Portal
    69 Posts 3 Posters 4.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jozy @johnpoz
      last edited by Jozy

      @johnpoz
      Please can you check below output, U really dont know what the problem could be...
      [2.7.2-RELEASE][admin@pfSense.home.arpa]/root: netstat -anl
      Active Internet connections (including servers)
      Proto Recv-Q Send-Q Local Address Foreign Address (state)
      tcp4 0 96 10.223.110.155.22 10.223.100.28.51652 ESTABLISHED
      tcp6 0 0 *.8002 . LISTEN

      [2.7.2-RELEASE][admin@pfSense.home.arpa]/root: cat /tmp/rules.debug | grep cpzoneid
      table <cpzoneid_2_cpips> { 10.223.100.180}
      ether pass on { vmx2 } tag "cpzoneid_2_rdr"
      ether anchor "cpzoneid_2_auth/" on { vmx2 }
      ether anchor "cpzoneid_2_passthrumac/
      " on { vmx2 }
      ether anchor "cpzoneid_2_allowedhosts/*" on { vmx2 }
      rdr on vmx2 inet proto tcp from any to ! <cpzoneid_2_cpips> port 80 tagged cpzoneid_2_rdr -> 10.223.100.180 port 8002
      pass in quick on vmx2 proto tcp from any to <cpzoneid_2_cpips> port 8002 ridentifier 13001 keep state(sloppy)
      block in quick on vmx2 from any to ! <cpzoneid_2_cpips> ! tagged cpzoneid_2_auth ridentifier 13003

      e73c4f66-6ea9-4779-8683-a0bea688e116-image.png

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Jozy
        last edited by johnpoz

        @Jozy notice the port 8000, where is that coming from?

        redirect.jpg

        like I said I am not sure if you can just call up the IP on port 8002, without the redirection happening..

        Here I fired up my wifi on my pc, no I can not just access http://192.168.6.8002, but if I try and go to some site that http, www.cnn.com in my example get redirect to the captive portal.

        redirectnew.jpg

        pcap.jpg

        It currently isn't asking for voucher - because I currently don't have them turned on..

        So put a pc on your whatever network your wanting to use for captive portal, and go to http://www.cnn.com and you should get redirected to the captive portal page.. here is sniff showing

        I do a dns query for www.cnn.com, I then try and go to that IP.. 146.xx pfsense lets me think I am talking to that IP, but sends me a 302 saying hey go here 192.168.6.253:8002 with this specific url..

        Which then presents me with the login..

        This is really clicky clicky.. There is nothing really to do..vs trying to call up the portal page directly.. do what actually happens. I would suggest you duplicate the simple test I did.. I am showing you exactly what happens via the sniff I did.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @johnpoz
          last edited by Gertjan

          @johnpoz

          Nice.
          Your "cat /tmp/rules.debug | grep cpzoneid" shows how the portal works.

          This :

          ether pass on { igb3.10  } tag "cpzoneid_2_rdr"
          

          tags all the packets coming into your portal interface with "cpzoneid_2_rdr".

          This is the magic :

          rdr on igb3.10 inet proto tcp from any to ! <cpzoneid_2_cpips> port 80 tagged cpzoneid_2_rdr -> 192.168.200.1 port 8002
          

          I read this as follows:
          For the "tagged cpzoneid_2_rdr" tagged traffic do this :
          Redirect (rdr) TCP traffic from anybody (all the devices on the portal network) with a destination that is not <cpzoneid_2_cpips> (= the pfSense captive portal interface IP or 192.168.200.1) to the portal interface (= the pfSense captive portal interface IP or 192.168.200.1) port 8002 (where 8002 is the http - not https - captive portal web server) as seen here :

          @Jozy said in [Captiv portal and vouchers integration with ssid on wlc 9800](/post/1196793):
          > tcp6 0 0 *.8003 . LISTEN
          > tcp4 0 0 *.8003 . LISTEN
          > tcp6 0 0 *.8002 . LISTEN
          > tcp4 0 0 *.8002 . LISTEN
          

          where port 8002 is used for "http" and port 8003 is the "https" interface;

          Btw : https is used when
          c0ce49ab-8b19-4fdc-bcc6-625c3e16ab17-image.png
          is checked.

          Be ware, using https means you have to use a certificate that and portal user trusts ( !! ).
          It might still work, with the classic browser warning that tells you you use a self signed certificate (and not trusted).

          Extra info :
          See the nginx portal web server config file which is called something like :
          /var/etc/nginx-cpzone1-CaptivePortal.conf

          In the "server" block, you see how redirecting is applied.

          This works because :
          When an Ethernet connection is created, first, the DHCP client does it's work.
          When done, the network client has an IP, a gateway, a DNS and a network (mask).
          If I take the example of @johnpoz this would be :
          IP : 192.168.200.1
          DNS 192.168.100.1 ( !! so pfSense is the 'DNS' for the assigned captive portal network clients)
          Gateway : 192.168.200.1 ( !! )
          Network : 255.255.255.0 or /24

          And now the real magic kicksz in : every device, actuall : every OS, as soon as a ethernet connection comues up, fires up a https request.

          For an Apple device, this http (not / never https !) will be :

          http://captive.apple.com/hotspot-detect.html

          Click on it to see what is happens.
          It should return a 6 letter "html page" showing just "Success".
          If this is not the case, the presence of a captive portal is suspected.
          The device will open up a web browser (or show a notification to the user somewhere) and it will visit the same link again http://captive.apple.com/hotspot-detect.html and time, as this is a browser request : a classic http = port 80 request, it will get redirected to the 192.168.200.1 IP - port 8002, and you'll be able see what happens.

          And what will show up ? Our login portal !

          Another info page : See here : Status > System Logs > System GUI Service
          where you can see the https requests from the captive portal web server.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          johnpozJ 1 Reply Last reply Reply Quote 1
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Gertjan
            last edited by johnpoz

            @Gertjan nice write up..

            @Jozy you could always just have the wlc do the captive portal as well, the one reason I could see having pfsense doing it is if you also had wired devices on this same network that you wanted to have to use the captive portal as well.

            Personally I have little use for captive portal.. For my guests that want to use my guest wifi network I just hand them a card with a qr code on it to get them on the network.. They would hate how long and complex the psk is to type in ;) hehehe

            They really only make sense when you need to time limit someones access, or have them pay for access, or can not in anyway just let them know the psk, etc. There are plenty of use cases where it makes sense, but in a home or smb sort of setup not really.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @johnpoz
              last edited by

              @johnpoz said in Captiv portal and vouchers integration with ssid on wlc 9800:

              I could see having pfsense doing it is if you also had wired devices on this same network that you wanted to have to use the captive portal as well.

              Actually, wireless or wired devices, it's all the same.
              After all, captive portal support is mostly handled by the connecting device, not the router/firewall, like pfSense.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Gertjan
                last edited by

                @Gertjan my point was if all he has was wireless devices he wanted on it he could just use the wlc.. Not sure how the wlc would work for wired device on the same vlan as the wifi?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jozy @johnpoz
                  last edited by

                  @johnpoz
                  I really dont know what the exact issue is here.
                  Customer is looking for voucher on Guest SSID and it should be setup but now this is not working. :(

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @Jozy
                    last edited by Gertjan

                    @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                    Customer is looking for voucher on Guest SSID

                    What do you man by that ? The customer doesn't have a voucher ? He lost it ?
                    Or do you mean : he doesn't know what to do with it ?
                    Or does the login screen not show up ?

                    Normally, when installing a captive portal, set up one without any "users" or "vouchers", just this :

                    8dba5e52-8e9d-4482-ada9-13f2c35ce243-image.png

                    and make sure everything works first.
                    This 'everything' is actually a lot already.

                    See also here for help : Troubleshooting Captive Portal

                    @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                    but now this is not working.

                    It worked before ?

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jozy @Gertjan
                      last edited by Jozy

                      @Gertjan No, Im trying to configure it first locally at my company environment, then provide it to the customer, since they are looking for that solution.

                      Anyway, after configuring CaptivPortal, what URL should I use to get CaptivPortal, since port 80 should redirect me to CP but not working.

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Jozy
                        last edited by

                        @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                        Anyway, after configuring CaptivPortal, what URL

                        Initially, None.
                        When set up correctly, a confection device is redirected to the captive portal login page. This user will never know - and doesn't need to know the port (8002, or up) used.

                        Later on, you will want to use https login, as it look 'better' ( and nothing is really http based anymore ).
                        Then you will have to deal with a domain name, certificates and so on. That is the moment a host name (URL) is mandatory, like "portal.your-domain.tld".
                        The portal user doesn't have to know this host name (URL) is he will get redirected to it automatically.

                        There are a couple of captive portal videos here https://www.youtube.com/@NetgateOfficial/videos - they are old but still very valid.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          Jozy @Gertjan
                          last edited by

                          @Gertjan Something which is very interesting i that I can access to pfsense as you can see bellow
                          1ea21a71-33c2-49de-9312-bfa6097908df-image.png d8a9fa62-eaad-422d-9b8b-1f5e30bb2622-image.png
                          but I should be redirected to captive portal not pfsense page.
                          After page appear I can easily type username and password of the pfsense and get in which is not something I want.

                          You can see bellow picture taken from wlc/ssid which redirect me to 10.223.100.180
                          a844c43a-0c12-46e6-926f-73b9b7420e15-image.png

                          Why redirection to captive portal not working it is weird or should I use some other "redirect URL for login" on wlc?
                          Anyway I have enable captiv portal and voucher and not working. Can it be some bug on software since Im using it on VMware or?

                          d6db8971-ca2c-4e89-abdf-68c134d0645c-image.png

                          c527b2fc-5966-4252-a444-b6504116b8ed-image.png

                          30d3c8aa-6eb6-40ac-bb72-022dd7b4ab8c-image.png

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Jozy
                            last edited by

                            @Jozy

                            What is thsi :

                            c155b137-4392-4ad3-9c54-b275b04860c3-image.png

                            Are you using some sort of captive portal behind another captive portal ?

                            Just use 'simple' access points, and it will work ?!

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            J 1 Reply Last reply Reply Quote 0
                            • J
                              Jozy @Gertjan
                              last edited by Jozy

                              @Gertjan its virtual ip address configured on wlc, with or without that address it is the same end.
                              What do you mean saying "simple" access point?
                              What would be that simple access point? 😀

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @Jozy
                                last edited by

                                @Jozy

                                These, I guess.
                                I mention these as they work fine for me, I use them.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  Jozy @Gertjan
                                  last edited by

                                  @Gertjan Unfortunately I have Cisco wlc and have to try setup it with that one :)

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @Jozy
                                    last edited by

                                    @Jozy

                                    TO set up the captive portal, do as the doc and videos tell you.
                                    You don't need any access point or whatever. A captive portal with wired device will also work just fine.
                                    Hook up a dumb switch into the captive portal interface, and hook up a laptop or a desktop PC into the switch.
                                    Now you have everything you need to make it work.

                                    When then pfSEnse captive portal works, only then you start to use the "wlc 9800".
                                    If at that moment the captive portal stops working, call Cisco ;

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    J 1 Reply Last reply Reply Quote 0
                                    • J
                                      Jozy @Gertjan
                                      last edited by

                                      @Gertjan Captiv Portal is working now. Problem was with WAN interface and DNS forwarder.

                                      Best regards,
                                      Jozy

                                      J 1 Reply Last reply Reply Quote 1
                                      • J
                                        Jozy @Jozy
                                        last edited by

                                        @Gertjan @johnpoz Hi guys, here I am again.
                                        So, if you know or had the similar situation.

                                        As I mentioned above Captive Portal is working fine, but only working when Im connected to the same network not when enable wifi adapter.

                                        When I try to reach CP while trying to connect to wifi it isnt reachable.
                                        I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone=CaptivPortal& which is Captiv Portal it isnt working.
                                        Whan I try to paste http://10.223.103.230:8002/index.php?zone=CaptivPortal&?switch_url=https://192.0.2.1/login.html&redirect=<website-name> while using the same network (10.223.103.58) it is working fine.
                                        c95c7848-e04a-4999-b390-f8ef2b6b20a3-image.png
                                        I have to monition that 10.223.103.x is wifi subnet.

                                        Problem starts when I try to reach Captiv portal while trying to enable wifi adapter and test SSID on both cell phone or PC not working, it doesnt redirects me to nowhere, I just get ip adress over DHCP which is configure on win server and other setup but CP not opening.

                                        Do you know what could be the problem?

                                        Best regards,
                                        Jozy

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Jozy
                                          last edited by

                                          @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                                          I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone

                                          You shouldn't be doing anything with captive portal on your wlc if you want pfsense to handle it - if your wifi devices are on a different network then on that network in pfsense setup the captive portal.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            Jozy @johnpoz
                                            last edited by

                                            @johnpoz How should I reach Captiv portal over wifi if I dont put on SSID on WLC redirects me to http://10.223.103.230:8002/index.php?zone=CaptivPortal& ?

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.