Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captive portal in 2.0 Release not working?

    Scheduled Pinned Locked Moved Captive Portal
    47 Posts 10 Posters 22.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cmb
      last edited by

      @luke240778:

      Hey sorry, not really understanding this..  my AP's i don't have in the Captive Portal MAC passthrough list…  they are ust basically super bridges.

      They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.

      1 Reply Last reply Reply Quote 0
      • H
        hadi57
        last edited by

        hi

        i have same probolem, to solve this just dont use the pass through mac, let them go through the captive portal.

        there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.

        hadi57

        1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan
          last edited by

          @cmb:

          They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.

          I'm using a couple of Linksys WRT54GS AP's, running the Talisman firmware with some ebtables for "client isolation".
          When switching to another, more recent DD-WRT firmware version with the same ebtables setup, I saw that the MAC addresses of my clients became: the MAC op the AP  ???  >:(
          Because my AP's CAN communicate freely with the net to time sync etc, dis was NO good.
          I threw out the inter-AP-client-isolation from my AP's.

          Btw: this is not really a pfSense issue.

          @hadi57:

          there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.

          Can you detail this a bit more ?
          I have a Opt1 (192.168.2.0/24 - with Captive portal, a DHCP server) running for my clients.
          My LAN is 192.168.1.0/24.
          The Opt1 interface has the firewall rules that do not permit to touch anything but the Net.
          You say that I would be able to toy with the IP settings of a client PC (Wifi or wire), so it can pass right though the Captive Portal (ipfw) firewall …
          What about explaining how to do it ?
          Do I need to install squid on pfSEnse (which I haven't, I don't think I need squid) so clients could take 'advantage' of that ?

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • H
            hadi57
            last edited by

            i am using squid in transparent mode, because that box have only 4mb and 45 concurrent users sometimes, so clients who are updating windoze, antivirus etc. will not eat the bandwidth. i am not saying the connection i perfect this way, but clients can still chatt, browse facebook. i tried once configuring my browser to use the gateway in the proxy setting, and i was shocked to access the internet without even passing to the captive portal, also one of my clients had his access point using dhcp, "i dont remember the detail, it is posted here long ago, so my client was able to use the internet for free and his complaint to me was that internet is slow only.

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan
              last edited by

              Well, I lost you while reading "… that box have only 4mb and ...".
              Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?

              When you are using APs on a Captive Portal interface, best thing to do is:
              Captive Portal IP: x.x.x.1
              AP1: x.x.x.1
              AP2: x.x.x.2
              .... etc
              APy: x.x.x.y
              DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
              (or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
              This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.

              The AP's should be put in bridged mode, which means that pfSense's Captive Portal SEES the MAC of the clients.

              This setup still has possibilities for forging: hi-jacking the IP and MAC of an authenticated client will gain access for you.
              It will also create network conflicts ...

              Note that my AP's do NOT allow any x.x.x.a to x.x.x.b communication, except where the destination MAC is the MAC of the Captive Portal interface card. This is done with some 'ebtables firewall rules' in each AP.
              All this means that without hard-core hacking (Wifi sniffing, etc) you can NOT fall throughout the Captive Portal access. It is programmed to block all, and lists exceptions for those who are authenticated.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • H
                hadi57
                last edited by

                4 mb is my bandwidth, but i have others with 10, 16 and 20mb bandwidth, waiting for fiber optic to be available any where i have a box, ram on all boxes is 4 gig, using 64 amd version of pfsense, all of them have 64 intell 2 or 4 cpus, they are all doing fine with no issues.

                1 Reply Last reply Reply Quote 0
                • D
                  dhatz
                  last edited by

                  Ideally use different VLANs to segregate traffic:

                  One VLAN to manage the the APs
                  Another VLAN to carry client traffic.

                  1 Reply Last reply Reply Quote 0
                  • L
                    luke240778
                    last edited by

                    @cmb:

                    @luke240778:

                    Hey sorry, not really understanding this..  my AP's i don't have in the Captive Portal MAC passthrough list…  they are ust basically super bridges.

                    They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.

                    Umm. still beyond my understanding here. But looking at the ARP Table as you mentioned, it all looks right to me.. i see all correct CPE MAC's and only see the AP mac for the correct IP that is the AP.. Am i following?

                    1 Reply Last reply Reply Quote 0
                    • L
                      luke240778
                      last edited by

                      @hadi57:

                      hi

                      i have same probolem, to solve this just dont use the pass through mac, let them go through the captive portal.

                      there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.

                      hadi57

                      But that is what i am saying all along is my problem. I have been putting all MAC's in the Passthrough list for clients, as at install they were getting the Captive Portal login, so i added them to the Passthrough MAC.. but lately, all new installs are just bypassing CP completely and straight onto the web.. they are not yet in the MAC passthrough list, and they bypass the CP somehow

                      1 Reply Last reply Reply Quote 0
                      • L
                        luke240778
                        last edited by

                        @Gertjan:

                        Well, I lost you while reading "… that box have only 4mb and ...".
                        Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?

                        When you are using APs on a Captive Portal interface, best thing to do is:
                        Captive Portal IP: x.x.x.1
                        AP1: x.x.x.1
                        AP2: x.x.x.2
                        .... etc
                        APy: x.x.x.y
                        DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
                        (or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
                        This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.

                        Sorry you are saying to have the AP1 the same IP as the  CP IP? (x.x.x.1)

                        1 Reply Last reply Reply Quote 0
                        • H
                          hbc
                          last edited by

                          Is there a known bug?

                          I use vouchers which should expire, but authenticated users aren't disconnected or redirected again to login page after expiration time. They can keep on surfing and are listed in "Status: Captive portal: Vouchers –> active users", but the voucher is deleted in 'active vouchers'. I can even manually disconnect them in 'active users' page but no effect. I have to disable and enable CP to end sessions.

                          Any hint what went wrong? I don't use pass-through-mac, but it is behaving like this feature.

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan
                            last edited by

                            @hbc:

                            Is there a known bug?

                            What pfSense version ?
                            @hbc:

                            Any hint what went wrong? I don't use pass-through-mac, but it is behaving like this feature.

                            When the issue arrives, use these commands:
                            ipfw list
                            ipfw table all list

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • H
                              hbc
                              last edited by

                              What pfSense version ?

                              It is 2.0-RELEASE (amd64)

                              When the issue arrives, use these commands:
                              ipfw list
                              ipfw table all list

                              This does just show, not fix anything. Right?

                              My test vouchers are only 5 minutes valid. Is this too short? Curiously yesterday when just one AP was configured with guest ssid, it worked.

                              Well, I'll check the tables when issue occures next time.

                              1 Reply Last reply Reply Quote 0
                              • L
                                luke240778
                                last edited by

                                @luke240778:

                                @Gertjan:

                                Well, I lost you while reading "… that box have only 4mb and ...".
                                Are you aware that pfSense can only run with 128 Mbytes of RAM, or more ?

                                When you are using APs on a Captive Portal interface, best thing to do is:
                                Captive Portal IP: x.x.x.1
                                AP1: x.x.x.1
                                AP2: x.x.x.2
                                .... etc
                                APy: x.x.x.y
                                DHCP server range on Cative Portal Interface: x.x.x.y+1 - x.x.x.254
                                (or: give AP's an IP that's outside the Captive Portal DHCP IP mask)
                                This means that AP's should not have an IP that clients can obtain. Clients that starts to toy with a fixed IP, the same as an AP will gain a "MAC conflict" on the network.

                                Sorry you are saying to have the AP1 the same IP as the  CP IP? (x.x.x.1)

                                Gertjan can you clarify please?

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan
                                  last edited by

                                  @luke240778:

                                  Sorry you are saying to have the AP1 the same IP as the  CP IP? (x.x.x.1)

                                  Captive Portal IP: x.x.x.1
                                  AP1: x.x.x.2
                                  AP2: x.x.x.3
                                  etc.

                                  Sorry, my fault.
                                  AP1 can't have the same IP as the Captive portal IP interface …..

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    luke240778
                                    last edited by

                                    @Gertjan:

                                    @luke240778:

                                    Sorry you are saying to have the AP1 the same IP as the  CP IP? (x.x.x.1)

                                    Captive Portal IP: x.x.x.1
                                    AP1: x.x.x.2
                                    AP2: x.x.x.3
                                    etc.

                                    Sorry, my fault.
                                    AP1 can't have the same IP as the Captive portal IP interface …..

                                    Ok yes, thats basically what i have..

                                    CP IP: 192.168.10.1
                                    AP1:  192.168.10.50
                                    AP2:  192.168.10.51

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      luke240778
                                      last edited by

                                      Ok, so there is definately some bug in Captive Portal on 2.0. I am wondering if its best i start a new thread regarding this? And see if we ca all get it solved?

                                      I have basically 2 exact same NIC's, LAN and OPT1. Both setup exactly the same, just differente IP's obviously.

                                      Captive Portal enabled on both interfaces,on the LAN and connection goes straight passed the CP login screen, tried various AP's to make sure it wasnt one of them not working.  The exact same setup on the OPT1 interface works perfectly.

                                      I have tried by only activating CP on 1 at a time but get the same results.  This must be a bug…

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        eri--
                                        last edited by

                                        Can you post your config here with private information cleared to verify it?

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          luke240778
                                          last edited by

                                          Sure i can. To be clear, are you asking for like screenshots of both interfaces settings?  or is here an actual  config file i can somehow get?

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            eri--
                                            last edited by

                                            config.xml file it is located under /conf/config.xml.

                                            You can retrieve it from the web interface Diagnostics->Edit File.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.