[Captive portal] Can't get to the login page.
-
Hello
I have a server with pfsense running on it. My captive portal works almost perfect. The only problem that i'm faceing is that I can't get to the login page when I type something in the search bar. If I type "test" and press enter, the page will load for ever until it says that: " It takes too long to get a answer". But when I type an url like www.google.com I get to my login page instantly… So I have no clue why it doesn't work.
Thank you
-
BUMP
-
Hi,
Try this :
Disable your connection to the portal - example : disable wifi or remove ethernet cable.
On pfSense : remove all logged in users on pfSense.Now, reconnect wifi or ethernet cable
First :
If windows device : what does this tells you :ipconfig /all
Next :
You should know that every "OS on the planet" will popup a browser. This is valid for most Android devices, all Apple devices, all Microsoft OS's etc. If this didn't happen, you somewhat "broke" your devices setup. What happens (without you seeing it) is this :
(I'm using an Apple device as example) : as soon as the NIC in the device comes up with a good connection and it received a reply on a DHCP request (IP, gateway, DNS, etc), it launches a "hidden" http request to " http://captive.apple.com/hotspot-detect.html " - if there is a connection to the Internet (and resolving works (very important) !! ) then the return will be "Success" - try for yourself : http://captive.apple.com/hotspot-detect.html.
Every major OS has this functionality on board these days.When you are connected to a network that operates with a captive portal, the reply will anything but "Success". In that case the OS decides to launch a browser, or proposes the user to launch a browser - and repeats the same request. This time human interaction is possible - and that's what the Captive portal is all about.
Now, the magic start to happen : our browser is started with http://captive.apple.com/hotspot-detect.html ones more, and our Captive portal send back …. => the pfSense Captive portal login page !
When posting back this page with the correct user credentials, your device (IP and MAC) will be loaded into the Captive portal firewall, so it becomes transparent for your device.
The browser gets redirected to the original URL, or a build in URL, and you're online.
Done.My first question is : why doesn't your device launch a browser for you that permits you to logging ? Fo me, this works every time - and the only thing I do is connecting myself to the Captive portal's network. This issue is not related to pfSense what so ever.
I'm using pfSense (Captive portal) in a hotel, so I have many, many clients who do not know anything about a captive portals, they bring along all possible device that exist on earth, and it is very rare that some one comes to see me downstairs to ask why the connection doesn't work. My clients find the login credentials (I indicated that on the login page) and they login. This works very well for nearly a decade now.Next : Read the first 3 points here : https://doc.pfsense.org/index.php/Captive_Portal_Troubleshooting (point 3 doesn't exist anymore ;) ) Most of the time admin really f*ck up their DNS - the captive portal isn't working anymore - and worse, pfSense can't even find it's own upgrades and packages anymore. When they have kept the default DNS Resolver, everything would have worked fine.
-
"Most of the time admin really f*ck up their DNS"
QFT ;) heheheeh… They are so worried about dnsleaks without even a basic understanding how dns works to start from...
-
Hi,
I use my captive portal with a switch for lan connections, Wifi is for later. I have read everything you put above and tried it.(Btw thanks for the clear explanation of everything). But I can't get it to work. I find it so weird that when I type an url like (www.google.com, samsung.com, etc.)
I instantly get to my login page, but when I type test or whatever it takes for ever and I'll never get to the login page. Is there something wrong with my DNS resolver? I just enabled it and left the default settings. In the attachments I placed a picture from DNS resolver with my only host overrider.Thanks already, It's for a school Project and you guys are saving me!!!
-
Again, run this :
ipconfig /all
on a device you connected to captive portal network.
Show me the results.ping to "test-domaine.fr" (and sure this domaine isn't in your local DNS cache) and show the results.
Of course, before authentication against the captive portal there will be no ping reply back, but resolving works.
Example :C:\Documents and Settings\Gertjan.BUREAU>ping test-domaine.fr
Envoi d'une requête 'ping' sur test-domaine.fr [[b]5.196.43.182] avec 32 octets de données :
…..Your image :
Is the domaine guest.com yours ????? If not, your in trouble.Do not use the LAN as a captive portal - use a dedicated interface for that. You might pull it of at home, not a school. LAN is for trusted devices,
And what about this strange IP ? 192.168.2.1 should be the IP of the gateway of your captive portal, not some "in de middle of the range IP == 100".
By default 192.168.1.0/24 is LAN, remember ?And when connected to the portal interface, can you resolve ?
Did you understand that you do not have to do anything, like typing "test" on any PC, portable, smartphone, pad, whatever - the device should open a browser automatically. This interaction isn't activated by pfSense - it's how things work. Read my explanation again. If your device doesn't do so, you should check your device first.
And why the host override ??
-
This is what I got from my guest pc with ipconfig /all:
Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. Alle rechten voorbehouden. C:\Users\Cédric>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : DESKTOP-BVILFUI Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : captiveportal.com Ethernet adapter VirtualBox Host-Only Network: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapter Physical Address. . . . . . . . . : 0A-00-27-00-00-0B DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::3c27:eb32:821d:fd1a%11(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.56.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : DHCPv6 IAID . . . . . . . . . . . : 403308583 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-5D-11-A5-80-C1-6E-F3-E0-C5 DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Ethernet: Connection-specific DNS Suffix . : captiveportal.com Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connection Physical Address. . . . . . . . . : 80-C1-6E-F3-E0-C5 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::242d:b758:ed7b:8946%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.102(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : woensdag 7 februari 2018 8:34:10 Lease Expires . . . . . . . . . . : woensdag 7 februari 2018 10:34:09 Default Gateway . . . . . . . . . : 192.168.1.100 DHCP Server . . . . . . . . . . . : 192.168.1.100 DHCPv6 IAID . . . . . . . . . . . : 58769774 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-5D-11-A5-80-C1-6E-F3-E0-C5 DNS Servers . . . . . . . . . . . : 192.168.1.100 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.captiveportal.com: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : captiveportal.com Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter isatap.{A790479C-BEFB-467D-829C-2399C5193B24}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Teredo Tunneling Pseudo-Interface: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6abd:453:f4f6:ab3b:cc2f(Preferred) Link-local IPv6 Address . . . . . : fe80::453:f4f6:ab3b:cc2f%15(Preferred) Default Gateway . . . . . . . . . : :: DHCPv6 IAID . . . . . . . . . . . : 520093696 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-5D-11-A5-80-C1-6E-F3-E0-C5 NetBIOS over Tcpip. . . . . . . . : Disabled
This is what I got when I pinged to test-domaine.fr.
C:\Users\Cédric>ping test-domaine.fr Pinging test-domaine.fr [5.196.43.182] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 5.196.43.182: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)
My image:
The domain Guest.com is not mine, But what can I use then? What do I need to use then because I have no domain?
And about the interface, I don't have extra network ports so I can't assign a new interface. Or Can I do it without?
The Ip that I filled in on the picture should be my default gateway? I thought it was the Ip of my pfsense server(LAN Ip).
Already Thanks for spending so much time to help with my problem. And I'm sorry if I make stupid mistakes but it's the first time that I do stuff like this. :)
-
C:\Users\Cédric>ping test-domaine.fr Pinging test-domaine.fr [5.196.43.182] with 32 bytes of data:
No replies, that's ok, but DNS works - test-domaine.fr resolved to 5.196.43.182 which is ok.
Not related, but I don't understand why you chose 192.168.1.100 as your IP LAN pfSense. Keep it on 192.168.1.1/24 and only remove it from there if you understand the impact.
What is this :
Ethernet adapter VirtualBox Host-Only Network
?
Ethernet adapter Ethernet: Connection-specific DNS Suffix . : captiveportal.com
I guess you do not own this domain neither : captiveportal.com
It belongs to some one on the Internet.
Visit System => General Setup and look for "domain" - ready carefully what has been said there. Name your LAN domain like "lan.mylocal" - only use domain name that you own - or one that does not exist on the net.What are your LAN firewall rules ?
WAN settings ?
(just copy this screen and/or mention everything you took from default:)Using username "admin". Authenticating with public key "rsa-key-20150201" Passphrase for key "rsa-key-20150201": pfSense - Netgate Device ID: 20cc46df89385827e0897 *** Welcome to pfSense 2.4.2-RELEASE-p1 (amd64) on pfsense *** WAN (wan) -> rl0 -> v4/DHCP4: 192.168.10.11/24 LAN (lan) -> fxp0 -> v4: 192.168.1.1/24 v6: 2001:470:1f13:5c4:2::1/64 PORTAL (opt1) -> sis0 -> v4: 192.168.2.1/24 HENETV6 (opt2) -> gif0 -> v6: 2001:470:1f12:5c4::2/128 OPT3 (opt3) -> ovpns1 -> v4: 192.168.3.1/24 v6: 2001:470:ccba:2::1/64 0) Logout (SSH only) 9) pfTop 1) Assign Interfaces 10) Filter Logs 2) Set interface(s) IP address 11) Restart webConfigurator 3) Reset webConfigurator password 12) PHP shell + pfSense tools 4) Reset to factory defaults 13) Update from console 5) Reboot system 14) Disable Secure Shell (sshd) 6) Halt system 15) Restore recent configuration 7) Ping host 16) Restart PHP-FPM 8) Shell Enter an option:
You are testing with de default, build in login portal pages, right ?
Btw : I really, really advise you to look for a old unused PC (billions exist) with an extension slot that works.
Slide in a dual - preference Intel double NIC card (a couple of $) - and use the third interface called OPT1 as the captive portal interface.
You are not working on a home setup, but for a school. -
Thanks for the fast reply
The ethernet adapter virtualbox thing is just a virtual network card from Virtualbox, it is from an virtual machine.
I changed my lan domain to lan.mylocal, do I need to change it in my DNS resolver settings too? Or is there no point of using the resolver.
here is the screenshot ( I don't know how top copy it)
![New Doc 2018-02-07 (1).jpg](/public/imported_attachments/1/New Doc 2018-02-07 (1).jpg)
![New Doc 2018-02-07 (1).jpg_thumb](/public/imported_attachments/1/New Doc 2018-02-07 (1).jpg_thumb) -
WAN settings ? ("Block private networks and loopback addresses" checked, or not ?)
Btw : how do you connect to the console ?
-
Block private networks and loopback addresses is checked.
The pfsense is installed on a server, on the server I connected a monitor and keyboard.
-
Block private networks and loopback addresses is checked.
You agree with me that your WAN IP (192.168.5.10/24, probably obtained by an upstream router) IS a "private network IP" ?
Better remove that check, your WAN is using a private network. -
Ok, I unchecked that. But now I don't know what's wrong… I'm still not getting redirected to the login page. I Can't make an other interface because I don't have an extra network port. So do I need the resolver or not?
-
Ok, I unchecked that. But now I don't know what's wrong… I'm still not getting redirected to the login page.
Neither do I.
What you should know :
Install a clean pfSEnse.
Accept the default for LAN.
Assign WAN and set it up. Check connectivity to the Internet. (and yes, by default pfSense expects a WAN IP on the WAN interface, a private IP form an upstream router could work,, but … see above)
Add a "captive portal user" in the Local pfSense user manager.
Activate the portal - on LAN should work (the default LAN firewall rule is ok).At this stadium, the captive portal works.
Your system : it isn't ok.The question is : what more did you change ?
I Can't make an other interface because I don't have an extra network port.
There is no rush, but keep in mind setting up and exploitation a captive portal (untrusted network) will be easier with a dedicated interface.
Its always advisable to start with easy things, and complicate live afterwards when the basic are understood ;)So do I need the resolver or not?
pfSEnse - and you network need a DNS that works.
The default Resolver is just fine.
For some (special ?) scenarios the Forwarder is needed - like - example - for those who want to communicate all DNS traffic to OpenDNS. -
Hello
After a Long time I started working on it again. But I found something strange… I took the server to my home and the captive portal worked perfect there. I got instantly the login page when I connect with the server just like you described. But when I'm doing it now at school it doesn't work. I have the exact same programs and browser... It is so weird. The only way I can get to the login page is with a URL like Google.com. At home it works perfect...
And idea where the problem could be? I thought it was maybe my dns resolver?
![DNS resolver.png](/public/imported_attachments/1/DNS resolver.png)
![DNS resolver.png_thumb](/public/imported_attachments/1/DNS resolver.png_thumb)
![captive portal.png](/public/imported_attachments/1/captive portal.png)
![captive portal.png_thumb](/public/imported_attachments/1/captive portal.png_thumb) -
Images/settings look fine.
Can you post your LAN firewall rules ?
When a router/firewall works fine at one place (home) and not good elsewhere (work, school) you have a 99 % that settings should be adapted for upstream routers, ISP awkward issues or other 'special' (read : not 'normal') issues.
Btw - not realted, but : why choosing 192.168.1.100 as a gateway IP - in the middle of the range ?
What's wrong with 192.168.1.1 or 192.168.1.254 if you have to. Leaving everything from start (.1) to end (.253) when /24 for the DHCP pool and static devices. -
I took a screenshot from the firewall Rules. I never changed something there so maybe that is the problem.
I took that as default gateway because 192.168.1.1 is the default gateway. But I'll change it to 192.168.1.254. Thanks for the note!
![Firewall Rules.png](/public/imported_attachments/1/Firewall Rules.png)
![Firewall Rules.png_thumb](/public/imported_attachments/1/Firewall Rules.png_thumb)
![Lan interface.png](/public/imported_attachments/1/Lan interface.png)
![Lan interface.png_thumb](/public/imported_attachments/1/Lan interface.png_thumb) -
I don't know that this is the porblem but I noticed it. Does the DNS field need to be empty? (Screenshot attached)
I did an Ipconfig /all in cmd and is the DNS normal? Shoudln't it be 192.168.1.100.?
C:\Users\Cédric>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : DESKTOP-BVILFUI Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : lan.mylocal Ethernet adapter Ethernet: Connection-specific DNS Suffix . : lan.mylocal Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connection Physical Address. . . . . . . . . : 80-C1-6E-F3-E0-C5 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::242d:b758:ed7b:8946%13(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.102(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : woensdag 21 maart 2018 9:27:36 Lease Expires . . . . . . . . . . : woensdag 21 maart 2018 11:22:19 Default Gateway . . . . . . . . . : 192.168.1.100 DHCP Server . . . . . . . . . . . : 192.168.1.100 DHCPv6 IAID . . . . . . . . . . . : 58769774 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-5D-11-A5-80-C1-6E-F3-E0-C5 DNS Servers . . . . . . . . . . . : 192.168.1.100 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter VirtualBox Host-Only Network: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapter Physical Address. . . . . . . . . : 0A-00-27-00-00-0C DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::ece7:22f2:9ed:e6c1%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.56.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : DHCPv6 IAID . . . . . . . . . . . : 403308583 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-5D-11-A5-80-C1-6E-F3-E0-C5 DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.{A790479C-BEFB-467D-829C-2399C5193B24}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter isatap.lan.mylocal: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : lan.mylocal Description . . . . . . . . . . . : Microsoft ISATAP Adapter #5 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Teredo Tunneling Pseudo-Interface: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes
![General Setup.png](/public/imported_attachments/1/General Setup.png)
![General Setup.png_thumb](/public/imported_attachments/1/General Setup.png_thumb) -
Exact, no need to fill that field.
Don't need to check the next field neither : "DNS Server Override". For a solid, secure DNS functionality you could use what Internet is offering since the day it was born : use the root DNS **.
pfSense uses a Resolver out of the box. Keep it that way.** except, of course, if your ISP wants you to use its DNS servers (and blocks all other "port 53 request" to other destination) then you are out of luck. Consider ditching the ISP.
-
Is this A problem?