I can't get Captive Portal login page in any browser else Firefox

computerz_man

Why I can't get Captive Portal login page in any browser else Firefox…
When client try to use the internet throw Chrome or Internet Explorer browsers he can't get the Captive Portal login page, but if he try to use firefox, it works fine and get the login page ...?
What is the problem?

Gertjan

Hi,

Browser are all the same. Their settings, not.
pfSense works with all browsers.

Did you flushed the browser's cache ? No Proxy activated ?

More help is possible as soon as you start to give more info. From 'here', I can't see what's up.

computerz_man

Thank you 'Gertjan' for replying, what's is the information which can help in that?
There is not proxy and also I flushed the broweser's cache…
only firefox show the login page but chrome and internet explorer not
I take a look on internet options in the client side all settings are default .....

Gertjan

Check your default home page in your browsers.
If it's a hpps:// make it http://…. example : http://www.google.com

Kriogen

The auto-redirect in captive portal doesn't work if the default page that the browser tries to open is a https one.

jetberrocal

I have similar problem. IE does redirect to the CP Login page.

I have a http site as default home page but still does not work.

I am testing with IE 8.0 on Windows 2003 Server DC. I even did a Reset to Factory and selected recommended default settings.

Gertjan

@jetberrocal:

….
I am testing with IE 8.0 on Windows 2003 Server DC. I even did a Reset to Factory and selected recommended default settings.

A browser on a server edition doesn't "eat" a captive portal like that (mine, on a 2008 R2 did finally, but had to fiddle my OS somewhat - don't recall very wel).
Use a vanilla OS like … well, any OS with their navigators except "servers".

Derelict

Eliminate DNS and HTTPS as the problem by trying to open http://10.10.10.10/ in the browsers that will not connect.

This could be something like STS making http connections nearly impossible to originate from those browsers to those sites.

jetberrocal

@Derelict:

Eliminate DNS and HTTPS as the problem by trying to open http://10.10.10.10/ in the browsers that will not connect.

This could be something like STS making http connections nearly impossible to originate from those browsers to those sites.

I do not know what is STS, but tried that address on the Server but still did not got the CP Login redirection.

jetberrocal

@Gertjan:

@jetberrocal:

….
I am testing with IE 8.0 on Windows 2003 Server DC. I even did a Reset to Factory and selected recommended default settings.

A browser on a server edition doesn't "eat" a captive portal like that (mine, on a 2008 R2 did finally, but had to fiddle my OS somewhat - don't recall very wel).
Use a vanilla OS like … well, any OS with their navigators except "servers".

Tried with a Win 7. I get the CP Login redirection but is not displayed, instead gives me a "Diagnose Connection Problems" error page. The address bar clearly shows the CP Login address.

Gertjan

@jetberrocal:

Tried with a Win 7. I get the CP Login redirection but is not displayed, instead gives me a "Diagnose Connection Problems" error page. The address bar clearly shows the CP Login address.

At that moment, was was your IP address of the Win 7 PC ? Who gave it to you (was it pfSEnse who gave it - check wth the pfSense DHCP Lease list and log)
What is the gateway IP ? (THis IP should be the one that pfSene uses as the Captive portal).
What is / are your DNS ?

jetberrocal

The WEin 7 PC is a Domain attached computer. The Domain Controller is DC/DNS/DHCP Server. The PC IP is given by the DC. The gateway IP is the pfsense server IP.
Pfsense DNS is on default configuration. When CP is off the PC gets the DNS resolution from the DC succesfully. The DC gets the DNS resolution from pfsense also. I made the IP and the name of the pfsense server an Allowed IP/Host in CP.

Some times Chrome does not redirect either when openned. I have to write in the address bar the http address manually to trigger the CP redirection. I guess that is because chrome tries to get the home page from its cache.

Some time IE redirects to CP Login, but after login it fails with a no connection error.

Gertjan

@jetberrocal:

The WEin 7 PC is a Domain attached computer. The Domain Controller is DC/DNS/DHCP Server. The PC IP is given by the DC. …...

Domain what where ???

From what I made of it when pfSEnse + Captive portal was made :
An interface (NIC) on which the captive portal is running.
A wire from this NIC to a switch.
This switch goes to wall-mounted RJ45 plugs (back then, some devices didn't have Wifi build in !) and a bunch of Access Points (wire to radio devices).
My visitors bring allong there PC / Pad / Phone / whatever (a basic BJOD).

Example : by a NEW Dell portable - Phone or whatever. Unwrap it. Connect to the Wifi network. pfSense portal kick in - and it works.

Now, back to your 'domain' (from Microsoft ?) PC. This isn't a typical BJODevice …...

Do de test yourself : Your smartphone - the AP and your pfSense portal => That works ....

jetberrocal

I am currently in testing. I have a Virtual network of DC and PC in LAN side and pfsense VM with fixed IP on LAN side and WAN DHCP assigned IP. CP listens in LAN interface. DC (Windows 2003 server) has Firefox, Chrome, and IE 8.0 browsers, PC (Win 7) has Chrome and IE 8.0 browsers. There are no wifi clients.

jetberrocal

Notice that now, when CP Login is shown successfully, after doing the Login the PC fails to ping external sites (www.google.com) like being blocked. I checked the CP status and the MAC address of the PC is registered successfully and active. So it should not be blocked.

Gertjan

@jetberrocal:

Notice that now, when CP Login is shown successfully, after doing the Login the PC fails to ping external sites (www.google.com) like being blocked. I checked the CP status and the MAC address of the PC is registered successfully and active. So it should not be blocked.

Your portal interface is on an interface - probably named initially OPTx.

Please list the firewall rules (see GUI this time !) and gives us YOUR rules for this interface.
Remember : by default, LAN has ONE rule : let all pass. By default, all other interfacse have ONE hidden rule (the list will be empty) : BLOCK ALL.
Do you let in ICMP ? ("in" because it's from the point of view of the interface).

jetberrocal

I do not have OPT interfaces, only LAN and WAN. I think ICMP is allowed. When I have CP off I can ping from inside to outside successfully. With CP on I can ping the pfsense LAN IP.

LANFWRules.jpg_thumb

WANFWRules.jpg_thumb

jetberrocal

I notice that I can ping the site which triggered the CP Login not other.

Example.
I Open browser (Chrome). The home page fails to load and does not trigger the CP Login.
I write in the address bar a http address (http://www.jetsystemservices.com). The CP Login is triggered.
I login successfully and the site is shown. (External links in the site fails, youtube links)
I go the command prompt in the browser computer and I can ping the www.jetsystemservices.com site. But I cannot ping other address.

It is like CP only allows one address at a time instead of opening all internet.

Gertjan

@jetberrocal:

….
I Open browser (Chrome). The home page fails to load and does not trigger the CP Login.

Is this the locally build page that doesn't need any 'internet' access -
or
is this a page like http://www.google.com (and NOT https://www.google.com !!! ) that comes from the net ?

@jetberrocal:

….
I write in the address bar a http address (http://www.jetsystemservices.com). The CP Login is triggered.

Great !

@jetberrocal:

….I login successfully and the site is shown. (External links in the site fails, youtube links)

at that moment, go here https://doc.pfsense.org/index.php/Captive_Portal_Troubleshooting
and list us your ipfw rules and tables (what IN these tables)

also, at that moment:
open command prompt
and
ping www.yutoube.com

The URL is resolved ?
The ping replies ? (youtube.com might decide not to reply, that's ok)

jetberrocal

The home page is http://www.google.com

Ping to www.youtube.com does not resolve.

ipfw execution:

ipfw zone list
Currently defined contexts and their members:
2: em1,

ipfw -x 2 table all list
–-table(1)---
192.168.56.100/32 mac 08:00:27:e8:c0:b4 2090
---table(2)---
192.168.56.100/32 mac 08:00:27:e8:c0:b4 2091
---table(3)---
192.168.56.1/32 2032
---table(4)---
192.168.56.1/32 2033
---table(100)---
192.168.56.1/32 0

ipfw -x 2 show
65291 0 0 allow pfsync from any to any
65292 0 0 allow carp from any to any
65301 99 3978 allow ip from any to any layer2 mac-type 0x0806,0x8035
65302 0 0 allow ip from any to any layer2 mac-type 0x888e,0x88c7
65303 0 0 allow ip from any to any layer2 mac-type 0x8863,0x8864
65307 0 0 deny ip from any to any layer2 not mac-type 0x0800,0x86dd
65310 2320 166643 allow ip from any to table(100) in
65311 2242 298979 allow ip from table(100) to any out
65312 4 1312 allow ip from any to 255.255.255.255 in
65313 0 0 allow ip from 255.255.255.255 to any out
65314 0 0 pipe tablearg ip from table(3) to any in
65315 0 0 pipe tablearg ip from any to table(4) in
65316 0 0 pipe tablearg ip from table(3) to any out
65317 0 0 pipe tablearg ip from any to table(4) out
65318 671 180692 pipe tablearg ip from table(1) to any in
65319 86 16287 pipe tablearg ip from any to table(2) out
65531 1696 82569 fwd 127.0.0.1,8003 tcp from any to any dst-port 443 in
65532 1927 136541 fwd 127.0.0.1,8002 tcp from any to any dst-port 80 in
65533 2939 379068 allow tcp from any to any out
65534 3112 348052 deny ip from any to any
65535 2 955 allow ip from any to any