Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Clients can't reconnect after pfsense reboot

    Scheduled Pinned Locked Moved Captive Portal
    51 Posts 9 Posters 14.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      darkblack
      last edited by

      Thanks @prophet @Gertjan , will try the shellcmd fix today. Wondering, why this buy isn't fixed yet (officially) if it affects wide scale of users..

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        @darkblack I'm using the captive portal for years, but yesterday, during testing, I saw for the first time that connected users during a Diagnostics => Reboot are still listed as connected, but the related ipfw firewall rules were gone.
        My pfSense never reboots by itself - it has an UPS. I never saw the issue before.
        So, for myself, I can't call it an urgent matter. This issue exists only in the latest version or two.

        I guess the pfSense authors should wipe the sqlite file during reboot, as @prophet proposed.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • D
          darkblack
          last edited by

          I understand. But our case is where, the entire office powers down at EOD (UPS, lighting, et al) and powers up the next morning. . So a major headache for us. Eager to try the solution today.

          1 Reply Last reply Reply Quote 0
          • P
            prophet @Gertjan
            last edited by

            @gertjan said in Clients can't reconnect after pfsense reboot:

            What you're asking for is the other way around : if a database exists with logged in user(s), why not rebuilding the ipfw rules for them ?!
            Right ?

            Yes sir.
            But which firewall rules are created for a succesfully authenticated client?
            I notice ipfw creates these rules, output filtered with relevant tables:

            --- table(captive_auth_up), set(0) ---
            172.17.17.11/32 18:65:90:82:81:c3 2004 181565 12852760 1542305056
            --- table(captive_auth_down), set(0) ---
            172.17.17.11/32 2005 418527 595361621 1542306032
            
            1. I tried to manually recreate these but i couldn't figure out how to make mac address based rules in ipfw.
            2. Aren't these rules just doing some traffic shaping? How are they critical to the system?

            Thank you

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @prophet
              last edited by

              @prophet said in Clients can't reconnect after pfsense reboot:

              I tried to manually recreate these but i couldn't figure out how to make mac address based rules in ipfw.

              ipfw : you have 2 possibilities : the easy one : the manual. https://www.freebsd.org/cgi/man.cgi?ipfw(8)
              How pfSense makes rules is not hard to find : it all in /etc/inc/captiveportal.inc ^^

              @prophet said in Clients can't reconnect after pfsense reboot:

              I notice ipfw creates these rules, output filtered with relevant tables:
              --- table(captive_auth_up), set(0) ---
              172.17.17.11/32 18:65:90:82:81:c3 2004 181565 12852760 1542305056
              --- table(captive_auth_down), set(0) ---
              172.17.17.11/32 2005 418527 595361621 1542306032

              Exact.
              Here are the details https://www.netgate.com/docs/pfsense/captiveportal/captive-portal-troubleshooting.html

              @prophet said in Clients can't reconnect after pfsense reboot:

              Aren't these rules just doing some traffic shaping? How are they critical to the system?

              Exact. Pipes, (queues ?) are build for every connection.
              Because this option exists :
              0_1542367388504_884d9813-3b41-4ebc-8e92-d358b5f74fcc-image.png

              Pipes exists, wether you use them, or not.
              These pipes have to be created when entering the IP's of the client into the two tables myzone_auth_down and myzone_auth_up.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • G
                ghinthsh
                last edited by

                @prophet said in Clients can't reconnect after pfsense reboot:

                Configured everything (I'll use pfsense as captive portal) and everything worked perfectly as captive portal without user authentication (a simple splash screen with login button and no auth is enough for me).

                I had PFBox 2.3 and clean installed 2.4.4 and have the same problem i resolved it somehow by setting Idle timeout to 3 to 4 hours and it work like charm.

                @Gertjan said in Clients can't reconnect after pfsense reboot:

                Instead of deleting files - and editing pfSense core fils, I prefer to use the API.

                Consider this :
                Install the Shellcmd package which permit us to execute 'commands' at startup.

                Place a file called "captiveportal_disconnect_all.php" in the directory /root

                #!/usr/local/bin/php -q
                <?php
                	/* Disconnect all clients on all captive portal instances */
                
                	require_once("/etc/inc/util.inc");
                	require_once("/etc/inc/functions.inc");
                	require_once("/etc/inc/captiveportal.inc");
                
                	global $g, $config, $cpzone, $cpzoneid;
                
                	/* Are there any portals  ? */
                	if (is_array($config['captiveportal'])) {
                		/* For every portal (cpzone), do */
                		foreach ($config['captiveportal'] as $cpkey => $cp)
                			/* Sanity check */
                			if (is_array($config['captiveportal'][$cpkey])) 
                				/* Is zone enabled ? */
                				if (array_key_exists('enable', $config['captiveportal'][$cpkey])) {
                					$cpzone = $cpkey;
                					$cpzoneid = $cp['zoneid'];
                					captiveportal_disconnect_all();
                				}
                		log_error("All users disconnected after system start-up");
                	}
                ?>
                

                Add a command in the Shellcmd package :

                0_1542297148892_9003a358-315a-4155-805f-139923138a46-image.png
                Done.

                I wanna try @Gertjan API :)

                1 Reply Last reply Reply Quote 0
                • 1
                  1ntr0v3rt3ch @Gertjan
                  last edited by

                  @gertjan

                  do we still need this also for pfsense 2.5 sir? I'm using this also for my captive portal in 2.4.4 p3 before with the system patches fix for "You are connected". just recently upgraded to 2.5.

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @1ntr0v3rt3ch
                    last edited by

                    @1ntr0v3rt3ch Why asking the same question again ?

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 1 Reply Last reply Reply Quote 0
                    • 1
                      1ntr0v3rt3ch @Gertjan
                      last edited by 1ntr0v3rt3ch

                      @gertjan said in Clients can't reconnect after pfsense reboot:

                      @1ntr0v3rt3ch Why asking the same question again ?

                      oh! sorry sir! I thought this is different from the patches. my mistake.

                      1 Reply Last reply Reply Quote 0
                      • D
                        didiosn
                        last edited by

                        I thought the same like @1ntr0v3rt3ch , I hoped that 2.5 version, will have all those fixes, but I was wrong, and it was messing with my hardware, so I came back to 2.4.4 p3, with patches ...

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @didiosn
                          last edited by

                          @didiosn said in Clients can't reconnect after pfsense reboot:

                          I hoped that 2.5 version, will have all those fixes

                          Hoping ?

                          I'll present you the uther simplicity of open source code.
                          You can checks things out yourself.
                          The 2.4.4-p3 (2.4.5) code base is here : https://github.com/pfsense/pfsense/tree/RELENG_2_4_5
                          The current 2.5.0 is here (I used the Switch branches/tags button) : https://github.com/pfsense/pfsense/tree/RELENG_2_5_0

                          Based of the "RELENG_2_4_5" version, you will be able to find the patch. The patch that works if it 'finds' 2.4.5 code
                          This patch, and all the others, are what makes up '2.5.0'.
                          So, 2.5.0 == 2.4.5 + "all the patches = "2417 commits behind master. " Master = 2.5.0 plus newer patches, what make up the current version, to be released in the future.

                          If "2.4.5 + patch to resolve "Clients can't reconnect after pfsense reboot" which is actually 2.5.0 does not resolve your issue, your actual issue is something different.

                          The silly thing is : I can't not easily test if your wrong or right : my pfSense rarely restarts. I do not have to, I do not want to shut it down or reboot : it serves as a company router with connected users, our own systems and out clients. The power stays up, it has even its own UPS ..... so, no issues for me. I advise you to do the same.
                          I will reboot the system this mornin, with some connected users (myself with some devices) to test if the issue still exist with vanilla "2.5.0".
                          It shouldn't - as it has the patch.

                          The test is easy :
                          This "connected users list" visible in the GUI, after reboot :

                          6d9f7e0d-0bb2-4529-aa05-1a90d97d5d5e-image.png

                          6 clients connected.

                          should look like this list :

                          [2.5.0-RELEASE][admin@pfsense.local.net]/root:  ipfw table all list
                          .........
                          --- table(cpzone1_auth_up), set(0) ---
                          192.168.2.38/32 74:e5:f9:76:xx:08 0 416726 35157523 1616656367
                          192.168.2.41/32 00:b5:d0:c6:xx:bb 0 21666 3376893 1616655996
                          192.168.2.44/32 08:cc:27:fa:xx:e2 0 24971 3309541 1616656369
                          192.168.2.131/32 6c:96:cf:dc:xx:93 0 165657 13800625 1616656371
                          192.168.2.178/32 62:7e:05:73:xx:04 0 3235 788929 1616656317
                          192.168.2.215/32 46:0b:2d:xx:ee:b0 0 391648 31807701 1616656371
                          .......
                          --- table(cpzone1_auth_down), set(0) ---
                          192.168.2.38/32 0 803791 1085868854 1616656367
                          192.168.2.41/32 0 30903 30311706 1616655996
                          192.168.2.44/32 0 39878 52533628 1616656354
                          192.168.2.131/32 0 362751 508494209 1616656371
                          192.168.2.178/32 0 3342 2165841 1616656317
                          192.168.2.215/32 0 819045 1150064899 1616656371
                          .....
                          

                          == 6 clients connected -> 6 entries for the down traffic and 6 for the up traffic.

                          The two tables xxxxx_auth_up and xxxxx_auth_down should contain the same IP's as the GUI shows.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • D
                            didiosn
                            last edited by

                            OK. You're right. I'll try to reinstall 2.5 again, on VirtualBox and i'll be right back. Do not restart your system for that.

                            Thank You.

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @didiosn
                              last edited by

                              @didiosn said in Clients can't reconnect after pfsense reboot:

                              Do not restart your system for that

                              To late ;)
                              It's a good test anyway, rebooting ones in a while. It can expose other, hidden issues.

                              The list with users :

                              911ad6e1-f69c-4d20-bca4-39d47cdf8dcd-image.png

                              --- table(cpzone1_auth_up), set(0) ---
                              192.168.2.39/32 48:2c:a0:fb:3f:25 2020 3169 354192 1616663674
                              192.168.2.41/32 00:b5:d0:c6:87:bb 2018 18094 1053099 1616663673
                              192.168.2.178/32 62:7e:05:73:f3:04 2022 35 11549 1616663663
                              192.168.2.215/32 46:0b:2d:dc:ee:b0 2016 3086 757624 1616663674
                              --- table(cpzone1_host_ips), set(0) ---
                              
                              ........
                              --- table(cpzone1_auth_down), set(0) ---
                              192.168.2.39/32 2021 0 0 0
                              192.168.2.41/32 2019 14242 20162232 1616663438
                              192.168.2.178/32 2023 26 10703 1616663347
                              192.168.2.215/32 2017 1392 943978 1616663437
                              ......
                              

                              which corresponds with what the GUI tells me.
                              Traffic was generated as I swa the counter rise.
                              For me, it works.

                              Btw : my pfSense runs native, it's not a VM, although that detail shouldn't matter.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • D
                                didiosn
                                last edited by

                                Alright. I'll try it this night.

                                Please hide MAC adress in your screenshot... There are bad people out there.

                                Thanks

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @didiosn
                                  last edited by Gertjan

                                  @didiosn said in Clients can't reconnect after pfsense reboot:

                                  There are bad people out there

                                  3 of the 4 MAC listed are already bad.
                                  Bad always like to meet bad, and I've nothing against bringing them together so they can exchange. I ought to charge them actually for the favor ..... thanks for the pointing that out.

                                  The fourth one is a real Snowden fan, sees conspirators everywhere since the men-on-the-moon-1969 series - but has a Samsung device with all the Google telemetry activated in mode 'open-bar'. So, its also time for him to meet the "creator" of things.

                                  edit : probably also a flat-earther. We all should find any possible method to help these guys. No restrictions.

                                  sorry for the out-of-subject.

                                  edit2 : Two ( ? ) out of 4 devices are iPhones/Pads, so the MACs are quasi random.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    SuporteATECH
                                    last edited by

                                    Hello! In version 2.5.1, Captive portal zone settings have an option "Preserve users database": "Preserve connected users across reboot". When set, users won't be disconnected during a pfsense reboot.

                                    This solves the "You're connected" bug after reboot.

                                    GertjanG 1 Reply Last reply Reply Quote 1
                                    • GertjanG
                                      Gertjan @SuporteATECH
                                      last edited by

                                      @suporteatech said in Clients can't reconnect after pfsense reboot:

                                      have an option "Preserve users database": "Preserve connected users across reboot".

                                      This is a new option, not related to the "You are connected" bug.

                                      Normally, on reboot, the connected users database is ( should be) wiped. It wasn't (some pfSense version ago - but no one used these old versions anymore)
                                      It wasn't wiped, s, after reboot, users were considered connected right from the start, but there were no firewall rules to let the user pass (the firewall was restarted / reset). This created the "You are connected" bug.
                                      This bug was corrected several version ago.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @Gertjan
                                        last edited by Gertjan

                                        SupporteATECH asked :

                                        c6dfb0bc-f2f7-4683-badd-17470fa3c326-image.png

                                        Older version had old bugs. This issue, "You are connected" doesn't exist any more.

                                        I just tried it myself :

                                        This is my captive portal zone name :

                                        bd467ce7-b111-4982-9613-966fde1eadf8-image.png

                                        So this is the SQL3 database file that contains all the users that are connected :

                                        81ecd1fb-4825-4062-bf6b-9871f40f41cc-image.png

                                        This file is wiped and created on restart.

                                        If this option is set :

                                        8a7dd18b-32b1-44bd-a6d7-55c145b52dd9-image.png

                                        then the file is not reset.
                                        Upon reboot, the file is read, and for all captive portal users that were connected upon reboot - listed in this file, 'ipfw' firewall rules and tables are re created.
                                        See the ipfw rules for yourself.

                                        It works for me ©™

                                        I'm using 2.5.1 CE.

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.