[Solved] Captive Portal question
-
How many APs are we talking and how many switches/wiring closets?
-
I have some 24 Unifi Ap's and one Switch (Linksys by Cisco 48 Port), switch is connected to one of the PFSense Interfaces
-
Ok. That's easy. What model switch is it? I'd be happy to look at the docs and see if it'll do something to isolate the APs from each other. I'm sure you can keep the wireless clients on each AP from talking on the unifis. You just need to stop inter-AP traffic.
-
If your switch does this, turn on wireless isolation in the APs and make the switchports they're connected to "protected."
 -
… or
simply enable "Guest Policy" to your unifi access points and be done with it. ....
Make sure NOT to check guest portal.
-
I don't think that will accomplish isolation between users on different APs. That usually has to be done in the switch.
Note that this is why I tend to favor brocade. The isolation is per-VLAN not per-port so you can have isolated SSIDs and regular SSIDs from your WAPs. I haven't found anyone else that can do that without going way up the product sheet to something that does VACLs.
I know with Ruckus you can enforce full isolation at the APs per SSID but you have to be sure to carve out exceptions for anything on the local LANs that the users need access to, such as the captive portal IP:port. Not sure about Ubiquiti unifi.
-
why not use pf as purely firewall/router and use unifi guest portal feature?
-
Thank you all ;)
@jaspras : I have tried this but then I do nt get the CP login page of my PFsense Box
Well I am using PFSense for almost 5 years now, the CP was the reason why I have
implemented it here.
Chanknging to the Unifi portal feature would mean to manually migrate some 550
wireless accounts to the Unifi System.Howevee I will have a look at the Switch too but I am not sure if he is capable of this
Kind regards
thafener
-
Hi @all
Thank you all for your helpful post. I could not solve the problem on the switch side but in the Unifi Controller tool
by adding the interface address of the PFSense box to the allowed subnets (sounds unlogical I know).Since then client isolation works in a way that you can still see the ip addresses of logged in devices but you cannot
see any open ports and it is impossible to commnicate with these devices.Kind regards
thafener
-
As said, this isn't a pfsense issues, but an error in the design of the network hooked up to the portal interface.
When using more then ONE AP - and these AP's works like switches, this kind of trouble pops up.We are in 2014 now, so some OS's that clients use have this famous question:
Is this a private or Company network ? Or a public network ?
(I guess we all know now which OS this is :) )
If the clients choses "public", then their PC can communicate ONLY with the gateway, and block ALL other incoming/outgoing connections.
Problems solved, the pfsense portal network engineer can go the bed again.But, of course, there are clients that consider the portal Wifi network as their home network - and they share all their holiday photos on the network ("because then it works at home"). They just hit 'Home network' when their OS says "This is a new network, please chose …".
The same clients (our Wifi portal network clients) start to yell when they discover that pure strangers are 'surfing' their PC ... ad all their holiday photos are indexed by Google Images a couple of days later on.
(You better get a lawyer when you get home, your wife isn't gona like this one)Anyway: I present https://forum.pfsense.org/index.php?topic=66368.msg365658#msg365658
It started here https://forum.pfsense.org/index.php?topic=1268.msg7542#msg7542 (even Sullrich was surprised ;))It all boils down to: activate AP isolation - and route all trafic from clients to gateway - and back. NO CLIENT TO CLIENT communication.
The rule to be enforced is "You, as an pfSense operator, do NOT OFFER A LAN PARTY, but Internet Access only".
