Captive Portal acting weird in 2.4(2.4.2-RELEASE-p1)

Gertjan

This is a fresh latest pfSense installed, about 6h ago. For all that other information I need to give, could I get an email or some other form of communication, these posts here are hard to manage and may get some of my private info exposed?

pfSense installations can contain information that is considered private, like your login password, maybe some certificate details or even your email.
Nothing else.

Posts on the forum can be edited afterwards, with the edit button.

Real private support is here : https://www.netgate.com/support/

A typical bare-bone captive portal setup from scratch can be activated in less then 2 minutes :
If you are running the captive portal on an OPT1 interface (this is where it belongs) : activate it, assign it an IP like 192.168.2.1 (LAN bieng 192.168.1.1/24) - setup a DHCP pool on this interface.
Add a user the the local user manager, give it "access to portal services" only rights.
Add a "pass all (ICMP/UDP/TCP/IPv4 firewall rule" on the OPT1 interface
Activate the captive portal on the OPT1 interface, selecting " Authentication Method == Local User Manager / Vouchers" and …. Done.

If you are activating it on the LAN interface (can also work) :
No need to setup DHCP, it's already done.
Check firewall rules for this interface, if you didn't change anything upfront, it's already ok.
Add a user as usual.
Activate the captive portal on the LAN interface, selecting " Authentication Method == Local User Manager / Vouchers" and .... Done.

All we want to know is : what did you do after installation of pfSense ? What didn't you do ? What is your network setup ? Etc.
Please understand that we need this description so we can figure out what is wrong.

aleksasiriski

There's no specific config, as I reinstalled the OS I didn't change any settings from the default, just a bit so my internet works, and tried Captive Portal immediately to se if it's fixed. It was not. I'm going to test in a VM rn, will let you know how it goes and then I'll take some screenshots.

aleksasiriski

There, I installed the latest pfSense from the website in a VM and got the same issue, will take some evidence now. *It's the bare bones default config as it can be that's used

aleksasiriski

In the last picture, it just locks me of accessing the WebUI and blocks my internet, I must restart the pfSense box to make it work again, and all I did was enable CP and pressed on "Save" button. That happens with changing ANY of the settings in that CP zone…

1.PNG_thumb

2.PNG_thumb

3.png_thumb

4.PNG_thumb

5.PNG_thumb

6.PNG_thumb

7.png_thumb

8.png_thumb

9.PNG_thumb

10.PNG_thumb

aleksasiriski

Just tested the SAME config on 2.3.5 RELEASE and CP works normally, I can change settings and save, nothing breaks… I'll probably do another reinstall of pfsense to 2.3.5 on my machine then.. until this is fixed. Thanks!

Gertjan

Check "Allow users/groups …"
Set a hard time out - and/or soft time out (didn't know nothing was set on initial setup, although, as stated, one of them need to be set).
Also : Visit your pfSense, and do not used "admin" to login, but the user you created in the local user manager.

Did you saw : (see image) ?

@aleksasiriski:

reinstall of pfsense to 2.3.5 on my machine then.. until this is fixed. Thanks!

I'm using the latest version in a professional environment (hotel). Ik rocks. It works just great for me.

this.PNG_thumb

aleksasiriski

Tried what you said, same problem.
I installed pfSense 2.3.5 Release from the website, everything about captive works but, I can't install any packages? They all fail on install…

Gertjan

This
@aleksasiriski:

…. I can't install any packages? They all fail on install...

is another subecjet - another forum, but, in a way, good news.
It shows (to me) that something really isn't right - hardware maybe ?

On what hardware are you installing pfSense ?

aleksasiriski

How isn't hardware right? I use my old pc, but I have the same config in a virtual machine and it all has the same issues, it cam't be hardware related.

aleksasiriski

To ease up(same hardware on both configs):
pfSense 2.4: Captive Portal glitches
pfSense 2.3.5: Can't install packages
Please help X. X

Gertjan

When re-installing, do you use the saved config file ?
If so, don't - the stored settings probably break pfSense.
If not, …. strange.

aleksasiriski

I am not… Especially on vms, I just use the default config and change what I need for testing.
Now, I was trying to fix packages on pfSense 2.3.5 and somehow the OS broke and I don't have access to webui nor the internet. I am going to reinstall once again and after I may have to switch to OPNSense or smt I really don't know... I love pfSense and don't want to replace it :(

Gertjan

@aleksasiriski:

I am not… Especially on vms,....

VMS ? Some virtual machine ? Your problems are solved ! Just run pFsense on its own machine and it shines !!
I'm not saying that pfSense on a VM doesn't work, thousands are doing exactly that, but it needed a good setup for pfSense (the same as non-VM installs ;) ) but also good VM setup …. and that one ... well .... see dedicated forum for more info.

Example (just guessing) : 2.3.4 (old pfSense version btw) uses an old FreeBSD kernel. 2.4.2_1 uses a newer the Freebsd 11, which needs adapted VM settings.

aleksasiriski

I meant, I do run pfSense on a dedicated machines, my old pc, but today, as I was trying to figure out these problems, I used vms, because I can't do all of my NAT again, I just put it from the backed up file, but in the vms, I do everything from scratch to find out if the problem is with the main machine, and I still have the same problem, on the dedicated pfSense machine with restored some of the settings, and the virtual machine with a completely fresh and default config. So no, not problem solved.

aleksasiriski

I found out the problem for packages not being installed, it's because they are made for that newer kernel, freebsd 11, and so can't be installed on 2.3.5, both 2.3.5 and 2.4 use the same links to packages, which is a bummer, what would be the point of 2.3.5 then? Nonetheless, I'll try 2.4 again to see if it still has the same problem with captive portal and can only hope that if it does, it gets patched soon for me.

Derelict

System > Update, Update Settings

Switch to Legacy 2.3.X and you will hit the correct package repo for 2.3.5 / FreeBSD 10.3.

aleksasiriski

OK here we go, finally some kind of error(pfSense 2.4 latest stable):
Message from syslogd@pfSense
pfSense nginx: [ emerg ] 99236#100114: bind() to [0.0.0.0]:8002 failed (48: Address already in use)
Another same one, but instead of 0.0.0.0 it's ::
Help?

Gertjan

@aleksasiriski:

Message from syslogd@pfSense
pfSense nginx: [ emerg ] 99236#100114: bind() to [0.0.0.0]:8002 failed (48: Address already in use)

Ah, now we're getting somewhere ;D
Only one instance of nginx process will bound to port "8002" : normally the first instance, your first zone. More zones could be be defined.
8002 for http access (first zone)
8003 for https access (first zone)
8004 for http (second zone)
and so on.

But : one is already running on that very port. (NOT normal - a previous instance could not be stopped ?! … )

On my systems, when everything is running, I see this :

[2.4.2-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ps ax | grep 'nginx-'
 5611  -  Is       0:00.00 nginx: master process /usr/local/sbin/nginx -c /var/etc/nginx-webConfigurator.conf (nginx)
 6159  -  Is       0:00.00 nginx: master process /usr/local/sbin/nginx -c /var/etc/nginx-cpzone1-CaptivePortal.conf (nginx)
 7546  -  Is       0:00.01 nginx: master process /usr/local/sbin/nginx -c /var/etc/nginx-cpzone1-CaptivePortal-SSL.conf (nginx)

which shows on instance for the GUI (webConfigurator) and two for the captive portal (CaptivePortalxxxx) (one for http access and one for https access).

When I stop the captive portal, the latter two will (should !) disappear.

Btw :

sockstat -4l | grep 'nginx'

Check out the logs when everything start from boot or reboot and at least one captive portal is active. When changing settings, it should be stopped, and restarted.

@aleksasiriski:

Another same one, but instead of 0.0.0.0 it's ::

The IPv6 counterpart. Useless for the Captive portal, because its IPv4 only.

aleksasiriski

Ok, I tried both of those commands and they are the same for me(not the ids of the services ofcourse). I only have 1 CP zone, so for the first command, it's those 3 lines. Now, where should I check logs for starting up captive portal, or what do I even need to look for in logs? Thanks a lot, finally some advancement :D

mikeisfly

What I suspect your problem is your are running a captive portal on the same LAN that you are accessing the firewall through. So while you are connected to the pfSense you activate the portal but your state is not dropped. Your mac is not authorized so you are not forwarded to the redirect page and you get the error that you are getting. I bet if you connect another PC, phone or something that was not on the LAN at that time (so it didn't have any open states) that new device will be forwarded to the portal splash screen. The fix would be to clear all your states, but because you can't connect to the firewall you can't do it. That is why restarting pfsense allows you to work once again. Maybe a fix for you would be to create another interface where you can configure the firewall instead of trying to activate a CP on the same interface you are accessing it through.