Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dynamic VLAN captive portal

    Captive Portal
    4
    12
    3.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      ilevac
      last edited by

      Hello everyone,
      I'm looking for a solution to have dynamic vlan (radius assigned) from the captive portal.
      Is there a way to do it?

      If not, maybe there a way to specify the vlan within the mac acl?

      Regards,
      iLevac

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        If they are already hitting a captive portal they are already on a VLAN. You probably want dot1x in your wifi or switching gear.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • I
          ilevac
          last edited by

          My switchs are already 802.1x.
          I am using dynamic vlan on my wpa2-ent wifi network.
          The captive portal with dynamic vlan is for client that
          doesn't support wpa2-ent such as appleTV, xbox, etc

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Like I said. If they are already hitting the CP they are already on a VLAN. Switching or wi-fi. It's a layer 2 thing.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • M
              myke
              last edited by

              Hello everyone,
              i'm interressed on this project.

              I don't know if it's possible that the pfsense radius with pfsense captive portal could assign a vlan and an IP to the user.

              I saw theses options on the radius but i don't know how to do…

              Best regards.
              Myke.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Just because the options are available on RADIUS doesn't mean they work in Captive Portal. Captive Portal is Layer 3. VLANs are layer 2. So that has to be done in your layer 2 gear (wireless and switching.)

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • I
                  ilevac
                  last edited by

                  I am sure there is a way.
                  I we can set a mac whitelist with a VLAN, so when to client connect, pfsense look in the table, find the mac adress and his assigned VLAN.
                  Then dhcp is able to give the good IP in the good VLAN.
                  Make sense?

                  1 Reply Last reply Reply Quote 0
                  • jahonixJ
                    jahonix
                    last edited by

                    Does not make sense, you're looking at the wrong end.

                    When a host hits pfSense's Captive Portal it is already sending traffic through a VLAN. Your router cannot change the host's VLAN anymore, your network in front of pfSense has to do that.
                    Derelict told you already.

                    @ilevac:

                    maybe there a way to specify the vlan within the mac acl?

                    That's a task for your switch.

                    1 Reply Last reply Reply Quote 0
                    • I
                      ilevac
                      last edited by

                      I know it's almost impossible to change the vlan when
                      the user has an ip, but how can I do to specify which vlan to use on l2?
                      Is there a way to put the vlan id for a specific mac adresse in the switch?

                      1 Reply Last reply Reply Quote 0
                      • I
                        ilevac
                        last edited by

                        Or, just make some custom l3 rule to allow the user one specific vlan but not everyone.

                        1 Reply Last reply Reply Quote 0
                        • jahonixJ
                          jahonix
                          last edited by

                          @ilevac:

                          Is there a way to put the vlan id for a specific mac adresse in the switch?

                          MAC based ACL and ACL Binding (VLAN) in Cisco terms.
                          Again: look into your switch config.

                          1 Reply Last reply Reply Quote 0
                          • I
                            ilevac
                            last edited by

                            I just purchase a Cisco SG-300-10PP.
                            There is a feature to do the radius authentification for a multi-host port like an AP.

                            I will keep you posted.

                            Regards,
                            Jonathan

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.