Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captive portal

    Scheduled Pinned Locked Moved Captive Portal
    20 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      Hin

      VLAN's, or classic interfaces, there is no difference.
      Every portal is completely independent : is has its own GUI firewall rules - it's own settings.

      You're talking about a Default deny rule.
      Normal, that rule will apply if any of your preceding rule(s) didn't apply - rule(s) that you didn't mention.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 0
      • V
        vukomir
        last edited by

        I agree with you @Gertjan the rule applies only to the traffic did not match any other rules.
        I usually see this problem when enabling Captive Portal.

        for ex: when I enable CP on Work Network I will see packages dropped from my Home network and Netfilx is not able to access the internet. when I Disable CP on Work Network everything goes back to normal.

        i'm running Pfsense 2.4.4-RELEASE

        Vuko.

        1 Reply Last reply Reply Quote 0
        • V
          vukomir
          last edited by vukomir

          please see bellow firewall logs
          0_1542545498935_418156b4-2e75-4d7d-9c4b-ae7f39dfb721-image.png

          this is my firewall rules from Home Network
          0_1542545592932_beae0120-f3b1-4c9d-8488-5ea5055fb288-image.png

          my captive portal
          0_1542545721859_45a33939-cac2-4262-a451-289fec65bfd2-image.png

          if my CP are configured and i do a reboot CP will work normally and other networks that are not part of CP will also work until I edit one CP config(if i only click on edit and save the same configs problem will appear )

          1 Reply Last reply Reply Quote 0
          • F
            free4 Rebel Alliance
            last edited by

            if my CP are configured and i do a reboot CP will work normally and other networks that are not part of CP will also work until I edit one CP config(if i only click on edit and save the same configs problem will appear )

            Does the problem only rise after updating a captive portal config ?

            I ask, because there is currently a bug on the captive portal : reconfigure a captive portal while some users are connected to it cause trouble for these users.

            This issue is known since a while and has already been reported : https://redmine.pfsense.org/issues/8616

            Temporary workaround :

            • Don't update captive portal settings when users are connected
            • If you ever have to update settings, go to the status -> Captive portal page and click "Disconnect all users" (even if you don't see any connected users) after updating.
            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan
              last edited by Gertjan

              @free4 said in Captive portal:

              reconfigure a captive portal while some users are connected to it cause trouble for these users.

              Very true.
              To make a long story sort, for now (2.4.4) : when reconfiguring portal setting, flush all users.
              If not, you'll be in for a hard time.

              To see why :
              Enter console, option 8 and type

              ipfw table all list
              

              Note the list of IP's (users) who are connected.
              Now, configure your captive portal zone, validate and retype

              ipfw table all list
              

              See that the 2 tables that contains the connected user is empty now.

              But, the Status page in the GUI of the captive portals will show that these very same users are still "connected".

              Result : these users won't be able to reconnect.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • V
                vukomir
                last edited by vukomir

                @free4 @Gertjan

                thanks for the info, if I Disconnect all users after a CP reconfiguration all users will be able to reconnect on the CP.

                now I still have one more problem, when I enable a CP on WORK_NETWORK i get blocked traffic on HOME_Network blocked by a default rule until I disable all CP or do a reboot.

                0_1542610869943_a40b8f7a-6f14-42c7-8427-f5858e64c6e8-image.png

                i don't see why CP and traffic on my Home network are related.

                Br,
                Vuko

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @vukomir
                  last edited by

                  @vukomir said in Captive portal:

                  when I enable a CP traffic on HOME_NETWORK

                  How do you enable traffic ?

                  @vukomir said in Captive portal:

                  when I enable a CP traffic on HOME_NETWORK that is not part of any CP

                  CP traffic that is not part of the CP ?

                  Also :
                  0_1542611309212_f978c5d5-28b7-4bd8-9028-433f132988e2-image.png

                  Why the Gateway here ?

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    vukomir @Gertjan
                    last edited by

                    @gertjan
                    i update my last post. my problem is:

                    When I enable a CP on WORK_NETWORK i get blocked traffic on HOME_Network blocked by a default rule until I disable all CP or do a reboot. i don't have CP on HOME_NETWORK

                    the gateway is specified to allow internet connection from HOME_Network

                    Vuko.

                    1 Reply Last reply Reply Quote 1
                    • GertjanG
                      Gertjan
                      last edited by

                      Ok.

                      What is your LAN side setup ?
                      You have a (one ?!) LAN interface, activated 2 VLAN's on it - you have a VLAN managed switch that separates the two VLAN's for you, and several LAN connectors on that switch that represent your HOME network and WOK network - right ?

                      Slowly but surely, I guess the VLAN setup is "done" yet.

                      I never used VLANs, and prefer using separated NIC's for my LAN (which is my "work" or company" LAN and a second LAN (OPT1 interface) for my Wifi resevered "hostile" (== clients of the company).
                      Both interfaces have their own GUI firewall rules - separated, non overlapping networks.
                      This works out of the box for a decade or so.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • V
                        vukomir
                        last edited by vukomir

                        I have a lagg0 on 3 NIC's and 6 VLAN's over that VLAN

                        0_1542613078688_4999619f-d92b-446c-b124-dcd8592caace-image.png

                        I also have a VLAN managed switch that separates all my VLAN.
                        my setups are working as it is now, the only problem I have is when I enable CP.

                        on VLAN you also have a separated GUI interface per VLAN.

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan
                          last edited by

                          Ok, I was just checking.
                          CP works perfectly well on a VLAN.

                          About the "1000000103" rule ( see /tmp/rules.debug )is the default "back-off rule" rule that kicks in if there are no other, more permissive rules on a used interface.
                          So, IPv4 traffic comes in on an interface without ( any ? ) GUI firewall rules.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • V
                            vukomir
                            last edited by

                            I found the rules in the file

                            Outbound NAT rules (automatic)

                            #---------------------------------------------------------------------------

                            default deny rules

                            #---------------------------------------------------------------------------
                            block in log inet all tracker 1000000103 label "Default deny rule IPv4"
                            block out log inet all tracker 1000000104 label "Default deny rule IPv4"

                            don't understand why this rule kick's in only when I enable CP(CP is not enabled on the same VLAN where the rule is applied)

                            Vuko

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan
                              last edited by

                              About you image https://forum.netgate.com/assets/uploads/files/1542545594673-beae0120-f3b1-4c9d-8488-5ea5055fb288-image.png

                              Is this this the HOME network ? WORK network ? the CP network ?
                              The first rule : the anti lockout rule. Port 81 ?

                              Rule 2 :I don't see the use oof the second "HOME_NETWORK to HOME_NEWORK " rule. pfSense can't block or even "see" traffic on the same network segment.

                              Rule 3 : No one one the HOME_NETWORK connects to the SERVER_NETWORK.

                              Rule 4 : WIFI_NETOWRK ?

                              Rule 5 : same as 3.

                              Rule 6 : The gateway issue .... dono why you should use a gateway here.

                              Rule 7 : this is not the 1000000103 rule, so packets that are blocked are not using this Interface / these rules.

                              So, it's something else you didn't showed yet.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • V
                                vukomir
                                last edited by

                                it's the HOME network
                                0_1542619421943_a732d7f6-2df2-45ee-9baa-c48005573a9f-image.png

                                this my my Work Network
                                0_1542619528997_1690829e-0ab8-4595-a326-af2e93c9e3a0-image.png

                                regarding the rules
                                if i disable rule 2 i was not able to communicate in the same subnet at least in the past ~ 2year ago
                                rule4: WIFI and LAN are 2 separated network but able to communicate between each other
                                Rule 3 and Rule 5 are with 0 traffic because they are not used very often and I rebooted my firewall
                                rule 6 allows internet access from the HOME VLAN

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @vukomir
                                  last edited by

                                  Not related to the current issue :

                                  regarding the rules
                                  if i disable rule 2 i was not able to communicate in the same subnet at least in the past ~ 2year ago

                                  I can even shut down pfSense, and all devices on my "LAN" can still communicate with each other.
                                  This is not some pfSense thing in the present or the past, it's more "this is how IP works".

                                  The main issue : I'm running out of suggestions .....

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    vukomir
                                    last edited by

                                    Hi,

                                    so I removed all rules from my home network

                                    0_1542632979715_bfb4b24e-4898-409b-87e9-4854c1d4d5d0-image.png

                                    and I still get the same error, also doing telent to google.com on port 80 I will not work.

                                    1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan
                                      last edited by Gertjan

                                      These are my LAN firewall rules :
                                      0_1542636765448_ba63c578-c6d5-4fba-ac7e-c75a727a3793-image.png

                                      Only minor differences.
                                      The lockout includes "443" (need to prepare for the e dying 80)
                                      Second rule : same as yours, but I added IPv6 because IPv4 is as "Games of Throwns : maybe one more season, and that's it""
                                      So, your issue is not related to the firewall rules.
                                      It's probably some Interface thing or one hop further along : the switch.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        vukomir
                                        last edited by

                                        so, I tried connecting directly to the PFSENSE via cable and head the same problem :(, it's not related the switch.

                                        I did a risky update to 2.4.5-DEVELOPMENT and now the problem is gone :), don't know why yet.

                                        and to answer one of your previous question why I specify Gateway for internet access, because if want that role to apply only to internet traffic and not allow access to other VLAN's/Networks

                                        Vuko

                                        GertjanG 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan @vukomir
                                          last edited by Gertjan

                                          @vukomir said in Captive portal:

                                          and to answer one of your previous question why I specify Gateway for internet access, because if want that role to apply only to internet traffic and not allow access to other VLAN's/Networks

                                          I understand.
                                          My ... dono what, says that an alias to all other neworks, and negate that alias in the destination, is 'better".

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.