DNS forwarder, resolver or both
-
Why do you need something from startssl.. Pfsense has a CA built right in, create a cert there and have your machine trust this CA. Are you needing this for machines that are not under your control? So a public CA that everyone trusts?
-
I thought the build in CA gave errors and wanted soemthing that did not gave any errors.. users or guest do not always click yes to something they don't know..
thats the reason i wanted guest to directly go to the login page in https without any error.. even in the build in one i cant get that to work with no error.
I am building this for a hotel and wanted to have it working properly and not half wayDo you know a guide or can you guide me through this?
-
Guide on trusting pfsense cert signed by pfsense.. Hmm I just went over this not so long ago in a thread..
https://forum.pfsense.org/index.php?topic=114712.0
Again this is for machines that you set to trust your CA that creates your cert. If these are like guests machines and you want them to trust your cert without them trusting your CA then yeah you need to get a cert from a public CA that everyone's machine will trust automatic.
How is it your using something your new to for building out a system for a hotel? So you have no SSL experience, no captive portal experience with working https and your building a captive portal system using something your new to pfsense.. And they are paying you for this?? Or is this some hotel that your uncle owns with like 3 rooms? And your computer guy in the family??
-
We have a pfsense system in the hotel that was made by the son of a technician that is working there.. He seperated the office and wifi, the only problem is that non guest around the hotel are using the wifi and like to have it guests only, from the 75Mbps I never reach higher then 10Mbps in the night.
Its needed to block this.. And his son doesn't work on the old machine anymore, so if this machine dies nobody knows anything..I also haven't found another solution for this and again an upgrade could be help full and also if I could make a proxy later on.
I know my knowledge is minimum, but asking and searching I mostly get things working..
I don't give up that easy, and I always like to learn new stuff.Your help is much appreciated :)
EDIT: from my LAN i can ping to domainname.com still when using http it redirects to https site.. https gives me an error that i cant go on..
DNS forward is set (it should) as decribed in the link earlier.. I am just not sure what i am missing.your link i followed it, it gave me an error that i need to execpt the cert first..
-
Is there a password that's only given to guests? If the WiFi is open, you can't stop others from using it. You might also want to change the password frequently.
-
the situation now is that everyone can use the wifi, guests and non guests.. the idea is to give the guests a username and pass when they check in that rotates every week/month so it block others out.. this way the internet speed is faster and more "protected" from non guests.
I know there are other ways like having guest accept the error, just i like to have things work properly then half work, till now I am almost there from working good, just when guests use https:// i get the error "ssl_error_bad_cert_domain" this because i visit a site other then what the domain is.. when this is solved everything work with the right ssl cert.. -
I could be wrong, but I don't see this as being a pfSense issue.
-
I believe I have it working, I was working the wrong way on to this, and tried most things though a wired connection while they only can connect through WIFI.
When connecting with a laptop and opening a page it sometimes takes a few moments before the inlog page shows up.The only thing I have now is that when i connect it gives me the wrong DNS any idea how to solve that?
system give me (example) 192.168.3.100 while it should be 192.168.3.254 -
"your link i followed it, it gave me an error that i need to execpt the cert first.."
You mean the link to a pfsense forum thread? Then you got something messed up with your CA's on your machine that is for sure.. As to your clients getting the wrong dns, well then you have something else handing out dhcp or your dhcp is not correct plain and simple. Or you set the dns on the client directly?
-
I fixed it.. it was the router that was giving the wrong DNS.. I did not have anything else to work with then this router. adding the right DNS IP solved the issue.
Thank you for your help john :)
Now I have everything working, even on win10 it will automatic gives you the inlog page when you connect to the WIFI like on mobile devices with the proper SSL cert and without asking people to import ANY cert.
I think I will make a topic on how I did this so others can use it as well..
next on the list squid proxy :)
-
"I did not have anything else to work with then this router. adding the right DNS IP solved the issue."
What router??
-
I do not have a wireless accesspoint to test the wireless devices like laptops and phones, for this I uses a router with WIFI (WNRT-627) I know pfsense has DHCP I just had nothing else lying around. with this Captive Portal is working as it should.. I still need to ask a friend to share a mac to see if this works as well. had a topic mac devices could not connect
-
If your using a old wifi router, then you should use it just as AP. Any wifi router can be just an access point.
Give its lan an IP on your network, turn off its dhcp server and connect it to your network via one of its lan port = AP..
-
I did at the end, seems everything is working properly now.. proxy is working, CP.. not sure what else i need on this :)
-
so you want to use the proxy and the cp at the same time? Are you wanting to use transparent proxy or explicit?
-
Transparent proxy, what I read and heard to save at least some bandwitdh, it sounds like it's not the best idea to do this..
-
No its not really. To be honest if the reason you want to use proxy is save some bandwidth.. Prob not going to get much bang for your buck.. Pretty much most of the net these days is dynamic and doesn't bode well for cached copy on your proxy. While clients cache themselves anyway so most of the stuff that can be cached and use is already done on the client.
If what your wanting to use if for is filtering of bad stuff, ok – but if this is a guest wifi for a hotel, why would it be your place to say what porn they can or can not watch, etc..
Captive portal sure ok, you don't want the homeless guy outside sucking up all your bandwidth which is for your guest to use, etc. And you can use the portal page to remind your guests of stuff going on in the hotel, how to get info etc. So that sort of thing I don't think any one that is using free hotel wifi would complain about.
But if what you want to do is just limit the non guest from using your wifi, its much easier to just set a PSK and change it everyday or few days and just make it easy for your guest to get without the homeless guy outside just looking at it on your bulletin board. I have been to hotels where the psk is on the little envelope they put your key in, etc.
-
I understand you, disabling the proxy is done in seconds.. it was more because the non guest are taking all the bandwidth away…
if you have 75Mbps and you cant get over 10Mbps and sometimes 2Mbps it's an issue, thats why I wanted to have a proxy ready because of the slow bandwidth.. and there 60 rooms not the biggest hotel but everything that can be faster is something..
now that users need a voucher or pass it should be much better.. this I have to try out, if the speed is fast enough I disable the proxy and use it only for CP..thanks for the advice..
What would be your advice to improve the pfsense even better?
-
60 rooms? how many AP do you only provide wifi in the lobby or something? So lets say 120 guests. Lets count 1 phone each your looking at 120 devices if your full could be more. I would say this would be min number of devices, etc.
Are you limiting each connection. Or you could have 1 guest using up most of the bandwidth.. So lets say a few guests are streaming movies in HD from netflix.. Are they on the same AP?
You need to be able to spread your connections over multiple AP and to be honest 75mbps seems like a pretty low amount of bandwidth for 120 users to share, etc. At even 60 sharing its not very much.. People be so frustrated with it they would just use their phones data.
-
I know 75Mbps (I see 100Mbps is available) isn't much but not possible to get more unless you have a 2nd wan connection to double the bandwidth I am limited to what I have got.
We have around 7 AP's around the hotel, how it is connected I do not know I havent installed it.
At this moment people rate us with a 7.2 for internet and this is with guests and non guest together.. after the CP it should be better..I was also calculating how many rooms and guests that can use internet, and an option would be a 2nd WAN or limiting the bandwitdh to say 10Mbps for each user (i know it isnt much) or is there a package that calcuates the users and devide it with the current users connected?