Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captive portal not redirecting on https requests. problem on every browser

    Scheduled Pinned Locked Moved Captive Portal
    32 Posts 3 Posters 10.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fahad77678
      last edited by

      U mean to say that normally captive portal cannot redirect the https request if user not logged in? mean this is not possible?

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @fahad77678
        last edited by

        @fahad77678 said in Captive portal not redirecting on https requests. problem on every browser:

        mean this is not possible?

        You know the ansswer already.

        https == SSL traffic can NOT be intercepted. If that would be possible, that https:// sites are identical to http:// visits.

        You do know what https:// is, right ? What it stands for - what it means ?

        Example : if you type in https:/:www.google.com, your browser ill first resolve google.com. As soon as it gets an IP, it will do https://172.217.22.142/ (on port 443).
        In the reply there will be a certificate that states that it is connected to "*.google.com" .
        If the captive portal intercepts this request, it will not return the certificate of Google, but it own certificate - which will be anything but not "google.com". Your browser, being smart, knows that you want to connect to google.com, but some other site replied. The browser knows it's request is redirected- or their is some other MITM.
        It will bail out with the famous certificate error message.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • F
          fahad77678
          last edited by

          In simple words my captive portal not redirecting. please help me on this

          1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan
            last edited by

            On a device that you connect to the portal network - but not logged in yet, show what these commands show to you :

            ipconfig  /all
            
            nslookup google.com
            

            or better

            nslookup onisep.fr
            

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • F
              fahad77678
              last edited by

              C:\Users\fahad>nslookup onisep.fr
              Server: pfsense.localdomain
              Address: 192.168.1.1

              Non-authoritative answer:
              Name: onisep.fr
              Address: 213.162.50.177

              1 Reply Last reply Reply Quote 0
              • F
                fahad77678
                last edited by

                @gertjan said in Captive portal not redirecting on https requests. problem on every browser:

                nslookup google.com

                C:\Users\fahad>nslookup google.com
                Server: pfsense.localdomain
                Address: 192.168.1.1

                Non-authoritative answer:
                Name: google.com
                Addresses: 2404:6800:4003:806::200e
                74.125.130.113
                74.125.130.102
                74.125.130.139
                74.125.130.138
                74.125.130.101
                74.125.130.100

                1 Reply Last reply Reply Quote 0
                • F
                  fahad77678
                  last edited by

                  C:\Users\fahad>ipconfig/all

                  Windows IP Configuration

                  Host Name . . . . . . . . . . . . : Muhammad-Fahad
                  Primary Dns Suffix . . . . . . . :
                  Node Type . . . . . . . . . . . . : Hybrid
                  IP Routing Enabled. . . . . . . . : No
                  WINS Proxy Enabled. . . . . . . . : No
                  DNS Suffix Search List. . . . . . : localdomain

                  Ethernet adapter Ethernet:

                  Connection-specific DNS Suffix . : localdomain
                  Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connection
                  Physical Address. . . . . . . . . : D4-C9-EF-E5-F4-27
                  DHCP Enabled. . . . . . . . . . . : Yes
                  Autoconfiguration Enabled . . . . : Yes
                  Link-local IPv6 Address . . . . . : fe80::1998:6eb8:b089:d1a6%24(Preferred)
                  IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred)
                  Subnet Mask . . . . . . . . . . . : 255.255.255.0
                  Lease Obtained. . . . . . . . . . : Monday, January 7, 2019 4:05:06 PM
                  Lease Expires . . . . . . . . . . : Monday, January 7, 2019 5:50:52 PM
                  Default Gateway . . . . . . . . . : fe80::1:1%24
                  192.168.1.1
                  DHCP Server . . . . . . . . . . . : 192.168.1.1
                  DHCPv6 IAID . . . . . . . . . . . : 164940271
                  DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-ED-F6-29-D4-C9-EF-E5-F4-27
                  DNS Servers . . . . . . . . . . . : 192.168.1.1
                  NetBIOS over Tcpip. . . . . . . . : Enabled
                  Connection-specific DNS Suffix Search List :
                  localdomain

                  Wireless LAN adapter Local Area Connection* 4:

                  Media State . . . . . . . . . . . : Media disconnected
                  Connection-specific DNS Suffix . :
                  Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #3
                  Physical Address. . . . . . . . . : 3C-A9-F4-2E-A0-41
                  DHCP Enabled. . . . . . . . . . . : Yes
                  Autoconfiguration Enabled . . . . : Yes

                  Wireless LAN adapter Local Area Connection* 5:

                  Media State . . . . . . . . . . . : Media disconnected
                  Connection-specific DNS Suffix . :
                  Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #4
                  Physical Address. . . . . . . . . : 3E-A9-F4-2E-A0-40
                  DHCP Enabled. . . . . . . . . . . : Yes
                  Autoconfiguration Enabled . . . . : Yes

                  Wireless LAN adapter Wi-Fi:

                  Media State . . . . . . . . . . . : Media disconnected
                  Connection-specific DNS Suffix . : Home
                  Description . . . . . . . . . . . : Intel(R) Centrino(R) Ultimate-N 6300 AGN
                  Physical Address. . . . . . . . . : 3C-A9-F4-2E-A0-40
                  DHCP Enabled. . . . . . . . . . . : Yes
                  Autoconfiguration Enabled . . . . : Yes

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan
                    last edited by

                    @fahad77678 said in Captive portal not redirecting on https requests. problem on every browser:

                    92.168.1.1

                    Ok, looks all good.
                    DNS works - pfSense is the DNS resolver for your clients.

                    You use the default login page ?

                    What GUI firewall rules on your captive portal interface ?

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • F
                      fahad77678
                      last edited by

                      All is on default settings. Gui Login all is on default settings. Yoy can say that firewall is on default settings i had just configure captive portal

                      1 Reply Last reply Reply Quote 0
                      • F
                        free4 Rebel Alliance @fahad77678
                        last edited by

                        @fahad77678 said in Captive portal not redirecting on https requests. problem on every browser:

                        Its only works when i delete the browser history. Then when i entered the google.com and every dns with .com when i use the it redirects to login page. but when the session expire the its does not redirecting to me on login page. i want that if i entered only a single word in google it should redirect to me into login page if i am not logged in

                        Again : that is an expected behaviour.

                        It is not possible to redirect HTTPS connections. Not only with pfSense, but also with any other router. HTTPS connections just can't be redirected, that's by design. You can learn more here : https://stackoverflow.com/questions/51562003/captive-portal-and-https-redirect

                        That shoudn't be an issue because modern web browsers do handle captive portals pretty well, using HTTP test requests (cf my picture above)

                        F 1 Reply Last reply Reply Quote 0
                        • F
                          fahad77678 @free4
                          last edited by

                          @free4
                          yeah i have checked your picture but its only works in firefox not on another browsers. how would it be possible on google chrome?

                          F 1 Reply Last reply Reply Quote 0
                          • F
                            free4 Rebel Alliance @fahad77678
                            last edited by

                            @fahad77678 chrome also implement captive portal tests

                            alt text

                            Android and apple devices also implement this feature

                            F 2 Replies Last reply Reply Quote 0
                            • F
                              fahad77678 @free4
                              last edited by

                              @free4
                              But in my case chrome not doing like this.
                              can you come on teamviwer ?

                              1 Reply Last reply Reply Quote 0
                              • F
                                fahad77678 @free4
                                last edited by

                                @free4
                                Did you enable https login enable in captive portal or not?
                                in my case if i disable https login then it cant reach the login page. chrome says site cant be reach if i search some sites.
                                same case in firefox. firefox only promt for login netwrok but not redirecting to catptive page.

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan
                                  last edited by

                                  The browser indicates that a user action is needed.
                                  It's probably not directing you right away some where else, which seems rather logic to me: the user wants to browse site a.b.c. - the browser won't take him to d.e.f (our captive portal login page) but suggests the a user action is needed.

                                  These are my observations :
                                  Use http (default) and the https portal login. Things will go very smooth.
                                  Chrome might be "portal aware" these days. I'm using the captive portal in a hotel - do not explain clients how to connect - and they connect (mostly not being IT experts, they all manage to connect using whatever device).

                                  As said here - and in the doc : https you should obtain a certificate signed by an authority.
                                  This implies that you should use an existing domain name on your portal LAN, like
                                  portal.your-domaine.tld
                                  You can buy such a corticate - or use the acme package.
                                  True : the acme package works for you if you know what to do and how to do it

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  F 2 Replies Last reply Reply Quote 0
                                  • F
                                    fahad77678 @Gertjan
                                    last edited by

                                    @gertjan
                                    Use http (default) and the https portal login. Things will go very smooth.
                                    what do you mean by this how can i do this in pfsense. actually i m new in pfsesne

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      fahad77678 @Gertjan
                                      last edited by

                                      @gertjan
                                      can you give me the step step configuration of captive portal with dns resolver?

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @fahad77678
                                        last edited by

                                        @fahad77678 said in Captive portal not redirecting on https requests. problem on every browser:

                                        @gertjan
                                        can you give me the step step configuration of captive portal with dns resolver?

                                        https://www.youtube.com/watch?v=qb5TDpihnq4&t=111s
                                        https://www.netgate.com/docs/pfsense/captiveportal/index.html

                                        The Resolver : nothing to do. The default settings - as set on installation, are just perfect.

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        F 1 Reply Last reply Reply Quote 0
                                        • F
                                          fahad77678 @Gertjan
                                          last edited by

                                          @gertjan
                                          is it necessary to add captive portal ports add in firewall's wan and lan rules ?
                                          it it is? the which ports should i add to the rules ?

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @fahad77678
                                            last edited by Gertjan

                                            @fahad77678 said in Captive portal not redirecting on https requests. problem on every browser:

                                            @gertjan
                                            is it necessary to add captive portal ports add in firewall's wan and lan rules ?
                                            it it is? the which ports should i add to the rules ?

                                            Two cases :
                                            If you activate the portal on the LAN you have nothing to do : the default firewall rule is a pass-all, the portal will work right away.
                                            If you activate the captive portal on an extra interface (the best choice !), like OPT1, you have to, initially, add one firewall rule : the same one as you can find on the LAN interface.
                                            Like this :

                                            0_1547200712194_bf62f6c6-807f-413d-8f57-a02fd9357a26-image.png

                                            Never ever add firewall rules to the WAN interface. Rules for that interface belong to the experts.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.