Captive portal in 2.0 Release not working?
-
Hey sorry, not really understanding this.. my AP's i don't have in the Captive Portal MAC passthrough list… they are ust basically super bridges.
They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.
-
hi
i have same probolem, to solve this just dont use the pass through mac, let them go through the captive portal.
there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.
hadi57
-
@cmb:
They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.
I'm using a couple of Linksys WRT54GS AP's, running the Talisman firmware with some ebtables for "client isolation".
When switching to another, more recent DD-WRT firmware version with the same ebtables setup, I saw that the MAC addresses of my clients became: the MAC op the AP ??? >:(
Because my AP's CAN communicate freely with the net to time sync etc, dis was NO good.
I threw out the inter-AP-client-isolation from my AP's.Btw: this is not really a pfSense issue.
there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.
Can you detail this a bit more ?
I have a Opt1 (192.168.2.0/24 - with Captive portal, a DHCP server) running for my clients.
My LAN is 192.168.1.0/24.
The Opt1 interface has the firewall rules that do not permit to touch anything but the Net.
You say that I would be able to toy with the IP settings of a client PC (Wifi or wire), so it can pass right though the Captive Portal (ipfw) firewall …
What about explaining how to do it ?
Do I need to install squid on pfSEnse (which I haven't, I don't think I need squid) so clients could take 'advantage' of that ? -
i am using squid in transparent mode, because that box have only 4mb and 45 concurrent users sometimes, so clients who are updating windoze, antivirus etc. will not eat the bandwidth. i am not saying the connection i perfect this way, but clients can still chatt, browse facebook. i tried once configuring my browser to use the gateway in the proxy setting, and i was shocked to access the internet without even passing to the captive portal, also one of my clients had his access point using dhcp, "i dont remember the detail, it is posted here long ago, so my client was able to use the internet for free and his complaint to me was that internet is slow only.
-
Well, I lost you while reading "… that box have only 4mb and ...".
Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?When you are using APs on a Captive Portal interface, best thing to do is:
Captive Portal IP: x.x.x.1
AP1: x.x.x.1
AP2: x.x.x.2
.... etc
APy: x.x.x.y
DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
(or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.The AP's should be put in bridged mode, which means that pfSense's Captive Portal SEES the MAC of the clients.
This setup still has possibilities for forging: hi-jacking the IP and MAC of an authenticated client will gain access for you.
It will also create network conflicts ...Note that my AP's do NOT allow any x.x.x.a to x.x.x.b communication, except where the destination MAC is the MAC of the Captive Portal interface card. This is done with some 'ebtables firewall rules' in each AP.
All this means that without hard-core hacking (Wifi sniffing, etc) you can NOT fall throughout the Captive Portal access. It is programmed to block all, and lists exceptions for those who are authenticated. -
4 mb is my bandwidth, but i have others with 10, 16 and 20mb bandwidth, waiting for fiber optic to be available any where i have a box, ram on all boxes is 4 gig, using 64 amd version of pfsense, all of them have 64 intell 2 or 4 cpus, they are all doing fine with no issues.
-
Ideally use different VLANs to segregate traffic:
One VLAN to manage the the APs
Another VLAN to carry client traffic. -
@cmb:
Hey sorry, not really understanding this.. my AP's i don't have in the Captive Portal MAC passthrough list… they are ust basically super bridges.
They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.
Umm. still beyond my understanding here. But looking at the ARP Table as you mentioned, it all looks right to me.. i see all correct CPE MAC's and only see the AP mac for the correct IP that is the AP.. Am i following?
-
hi
i have same probolem, to solve this just dont use the pass through mac, let them go through the captive portal.
there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.
hadi57
But that is what i am saying all along is my problem. I have been putting all MAC's in the Passthrough list for clients, as at install they were getting the Captive Portal login, so i added them to the Passthrough MAC.. but lately, all new installs are just bypassing CP completely and straight onto the web.. they are not yet in the MAC passthrough list, and they bypass the CP somehow
-
Well, I lost you while reading "… that box have only 4mb and ...".
Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?When you are using APs on a Captive Portal interface, best thing to do is:
Captive Portal IP: x.x.x.1
AP1: x.x.x.1
AP2: x.x.x.2
.... etc
APy: x.x.x.y
DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
(or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.Sorry you are saying to have the AP1 the same IP as the CP IP? (x.x.x.1)
-
Is there a known bug?
I use vouchers which should expire, but authenticated users aren't disconnected or redirected again to login page after expiration time. They can keep on surfing and are listed in "Status: Captive portal: Vouchers –> active users", but the voucher is deleted in 'active vouchers'. I can even manually disconnect them in 'active users' page but no effect. I have to disable and enable CP to end sessions.
Any hint what went wrong? I don't use pass-through-mac, but it is behaving like this feature.
-
-
What pfSense version ?
It is 2.0-RELEASE (amd64)
When the issue arrives, use these commands:
ipfw list
ipfw table all listThis does just show, not fix anything. Right?
My test vouchers are only 5 minutes valid. Is this too short? Curiously yesterday when just one AP was configured with guest ssid, it worked.
Well, I'll check the tables when issue occures next time.
-
Well, I lost you while reading "… that box have only 4mb and ...".
Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?When you are using APs on a Captive Portal interface, best thing to do is:
Captive Portal IP: x.x.x.1
AP1: x.x.x.1
AP2: x.x.x.2
.... etc
APy: x.x.x.y
DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
(or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.Sorry you are saying to have the AP1 the same IP as the CP IP? (x.x.x.1)
Gertjan can you clarify please?
-
Sorry you are saying to have the AP1 the same IP as the CP IP? (x.x.x.1)
Captive Portal IP: x.x.x.1
AP1: x.x.x.2
AP2: x.x.x.3
etc.Sorry, my fault.
AP1 can't have the same IP as the Captive portal IP interface ….. -
Sorry you are saying to have the AP1 the same IP as the CP IP? (x.x.x.1)
Captive Portal IP: x.x.x.1
AP1: x.x.x.2
AP2: x.x.x.3
etc.Sorry, my fault.
AP1 can't have the same IP as the Captive portal IP interface …..Ok yes, thats basically what i have..
CP IP: 192.168.10.1
AP1: 192.168.10.50
AP2: 192.168.10.51 -
Ok, so there is definately some bug in Captive Portal on 2.0. I am wondering if its best i start a new thread regarding this? And see if we ca all get it solved?
I have basically 2 exact same NIC's, LAN and OPT1. Both setup exactly the same, just differente IP's obviously.
Captive Portal enabled on both interfaces,on the LAN and connection goes straight passed the CP login screen, tried various AP's to make sure it wasnt one of them not working. The exact same setup on the OPT1 interface works perfectly.
I have tried by only activating CP on 1 at a time but get the same results. This must be a bug…
-
Can you post your config here with private information cleared to verify it?
-
Sure i can. To be clear, are you asking for like screenshots of both interfaces settings? or is here an actual config file i can somehow get?
-
config.xml file it is located under /conf/config.xml.
You can retrieve it from the web interface Diagnostics->Edit File.
