[Solved] Captive Portal question

[Derelict]

Completely incorrect.

The captive portal intercepts attempts to access services on TCP port 80 (and maybe 443) that are coming IN the ethernet interface.

Anyone can connect, get DHCP, and access anything on that network segment that is available prior to CP login.

What you need is layer 2 isolation. pfSense is a layer 3 device and is not even aware of the traffic on the network segment until it receives traffic to forward on to somewhere else.  It might also be performing services such as DHCP and DNS, but those have to be allowed for the portal and subsequent access to function properly.

You might also look at an AP vendor that performs captive portal functions in the AP, such as Ruckus.  They will also do full isolation.

Your network is functioning as designed.  No bugs or malfunctions.

[thafener]

Thank you derelict

Ok thank you very much, thought so. I am using Unifi Ap's in combination with PFSense and in this case
a layer 2 isolation is a little tricky to realize.
However thank you for all your help

cheers Till

[Derelict]

How many APs are we talking and how many switches/wiring closets?

[thafener]

I have some 24 Unifi Ap's and one Switch (Linksys by Cisco 48 Port), switch is connected to one of the PFSense Interfaces

[Derelict]

Ok.  That's easy.  What model switch is it?  I'd be happy to look at the docs and see if it'll do something to isolate the APs from each other.  I'm sure you can keep the wireless clients on each AP from talking on the unifis.  You just need to stop inter-AP traffic.

[Derelict]

If your switch does this, turn on wireless isolation in the APs and make the switchports they're connected to "protected."


[jaspras]

… or

simply enable "Guest Policy" to your unifi access points and be done with it. ....

Make sure NOT to check guest portal.

[Derelict]

I don't think that will accomplish isolation between users on different APs.  That usually has to be done in the switch.

Note that this is why I tend to favor brocade.  The isolation is per-VLAN not per-port so you can have isolated SSIDs and regular SSIDs from your WAPs.  I haven't found anyone else that can do that without going way up the product sheet to something that does VACLs.

I know with Ruckus you can enforce full isolation at the APs per SSID but you have to be sure to carve out exceptions for anything on the local LANs that the users need access to, such as the captive portal IP:port.  Not sure about Ubiquiti unifi.

[dpa]

why not use pf as purely firewall/router and use unifi guest portal feature?

[thafener]

Thank you all  ;)

@jaspras : I have tried this but then I do nt get the CP login page of my PFsense Box

Well I am using PFSense for almost 5 years now, the CP was the reason why I have
implemented it here.
Chanknging to the Unifi portal feature would mean to manually migrate some 550
wireless accounts to the Unifi System.

Howevee I will have a look at the Switch too but I am not sure if he is capable of this

Kind regards

thafener

[thafener]

Hi @all

Thank you all for your helpful post. I could not solve the problem on the switch side but in the Unifi Controller tool
by adding the interface address of the PFSense box to the allowed subnets (sounds unlogical I know).

Since then client isolation works in a way that you can still see the ip addresses of logged in devices but you cannot
see any open ports and it is impossible to commnicate with these devices.

Kind regards

thafener

[Gertjan]

As said, this isn't a pfsense issues, but an error in the design of the network hooked up to the portal interface.
When using more then ONE AP - and these AP's works like switches, this kind of trouble pops up.

We are in 2014 now, so some OS's that clients use have this famous question:
Is this a private or Company network ? Or a public network ?
(I guess we all know now which OS this is  :) )
If the clients choses "public", then their PC can communicate ONLY with the gateway, and block ALL other incoming/outgoing connections.
Problems solved, the pfsense portal network engineer can go the bed again.

But, of course, there are clients that consider the portal Wifi network as their home network - and they share all their holiday photos on the network ("because then it works at home"). They just hit 'Home network' when their OS says "This is a new network, please chose …".
The same clients (our Wifi portal network clients) start to yell when they discover that pure strangers are 'surfing' their PC ... ad all their holiday photos are indexed by Google Images a couple of days later on.
(You better get a lawyer when you get home, your wife isn't gona like this one)

Anyway: I present https://forum.pfsense.org/index.php?topic=66368.msg365658#msg365658
It started here https://forum.pfsense.org/index.php?topic=1268.msg7542#msg7542 (even Sullrich was surprised  ;))

It all boils down to: activate AP isolation - and route all trafic from clients to gateway - and back. NO CLIENT TO CLIENT communication.
The rule to be enforced is "You, as an pfSense operator, do NOT OFFER A LAN PARTY, but Internet Access only".