CE and Plus wierdness
-
Yeah check the cert checksums on each page (assuming both are https) and make sure they really are different.
You could have something cached on one of the client machines. If it ever connected to a Plus device on the standard LAN address.
-
@stephenw10
So, here are the arp-a logs from both machines.
Different PC's hitting the same MAC with two different login screens.
-
@rbwillis your hitting port 8008 on one and just normal 443 on the other.. 8008 is the captive portal login I do believe. I know the captive portal is 800 something might be 2 or 3 depending if http or https, but I think if you fire up more than one that can change, etc.
But clearly that is not the normal web gui port on 8008. So yeah your normal admin login might not work on whatever your hitting there on that odd port.
-
Yup it adds two new ports for each instance I believe.
-
@stephenw10 yeah I just enabled a couple and 2 different ports got added, so like 8002,3 and then 8004,5
If you track down per pid on what is listening, you can track it to the command that is running, etc
And then here is my 2nd one running
So 8008 to me would be like the 3rd captive portal running. Or something like that, maybe 4th.. Not sure how exactly chooses those ports or how it cycles through them when you add more instances - or if you check to run a https one as well, etc.
but yeah seems like he is hitting a captive portal gui vs just the normal web gui.
-
@johnpoz - Is there a simple way to point my requests back to a "normal" web gui or do I need to mod something?
Where does that captive portal login reside? Can I just delete it? -
Do you actually have captive portal enabled at all? It's in Services > Captive Portal.
If you are not entering port 8008 directly then you're being redirected to it by the captive portal. On something.
-
@stephenw10
Captive portal is not set up.
I have HP Wolf security on my machine...could that be redirecting me?
I tried disabling all the services, but still landed on the same page. -
Hmm, well it sure looks like that one client is behind some other pfSense Plus device that is running CP.
Try running on the pfSense you can access:
sockstat -l4
See if it's actually listening on port 8008. -
@stephenw10 well from his mac address he posted its the same machine.
Like to see what is listening on the captive portal port.. When I disable my test captive portals it stops listening on the 8000 ports.. But maybe something didn't get killed and its still listening, and somehow that machine keeps going back to there because of cache, etc.
but something is odd because my test captive portals don't show the pfsense+ logo. they just show pfsense
This other machine maybe at one time connected to a captive portal, or just normal gui where they had changed the port to 8008 vs 443, or some other port.. For example my pfsense uses 8443 because I set that.
The one that is working without the + looks to just be on https (443) but guess it didn't trust the cert is why it shows not secure. And the one that shows + is connecting to port 8008, which yeah would assume is captive portal..
I would look to see what is listening with on 8008, you can track down the command that was used via ps -awx once you know the pid(s) there are prob a few being shown for what is listening on 8008.
-
Yeah the MAC address being the same is odd...
