Forcing captive portal only once a week

DominikHoffmann

So, how do I make sure that users at my client’s work location don’t have to go through the captive portal with their BYODs every single day?

Do I extend the DHCP lease to six days, or would this be handled by the idle and hard timeouts of the captive portal configuration page alone?

patient0

@DominikHoffmann I'm new to captive portals but is it possible that the clients devices you randomized MAC addresses.

Or maybe in general, how do they authenticate? Vouchers, user/password (local DB, RADIUS)?

Gertjan

@DominikHoffmann said in Forcing captive portal only once a week:

Do I extend the DHCP lease to six days, or would this be handled by the idle and hard timeouts of the captive portal configuration page alone?

First, the basic rule is : DHCP IPv4 leases are typically a day or two max. That's the sweet spot.
If you need to change this, something isn't 'right'.

Very long leases might do the trick, but be ware, you have a limited pool size, for example (my portal) : 192.168.2.10 to 192.168.2.254. (the first 10 are reserved for pfSense portal IP itself, and several APs), so 244 devices can be logged into my portal.
If you only have a couple of devices simultaneously every week,
and
if the device connects back after one day (night) decides to give to the same device - connected yesterday - the same IP, as the lease is still valid,
then you'll be good.

If you have 'many' devices, and leases are "7 days" you might run out of free pool IPs.

Even if you use "7 days" vouchers : when the device comes back and the lease was 'recycled' the IP will change. They have to re enter the voucher code again - and as it is still valid, the connection resumes.

Or : use "auto MAC pass through" :

so when the user connects ones, his MAC will get add to the list - so no more login needed (that is, it still must receive the same IP / same lease all the time).
You, at the end of the week, you throw everybody out manually from the MAC list :

There is still one thing you need to be aware of : some users (devices) are totally paranoid, and regenerate their device Wifi MAC all the time. In that case they have to re logging all time - not your fault (I've seen this twice now ...).