User based Firewall rules

swamiforlife

I am new to PFsense and coming from a Sophos UTM background.
In sophos and many other firewalls, there are ways to make firewall rules based on users, instead of MAC or IP addresses.

So, is there a way to do this in Pfsense.
I plan on creating the users locally inside Pfsense. and plan using the Pfsense captive portal.

So for example i would make rules that certain users are routed to a certain WAN link and other users through another.
or block certain applications or protocols for certain users and leave open for certain users.
Since the users in my environment dont have a dedicated desktop they are using different machines sometimes.

Also is there a way to add web filtering policies based on users so that i can give some users access to certain websites and not to other users.
same goes for applications.

If an extra package is needed for this functionality then i am open to that.

Thanks for the Help in advance.

Chrismallia

You cant create rules by username

moikerz

Sounds more like you need RADIUS authentication, pushing users onto different VLANs, and then applying filter rules to those VLANs.

gomorrahsend

Im having the same problem. I have 2 WAN and 1 LAN(wifi access point), Im thinking of segregating a group of user coming from a Radius server to use a specific gateway. Something like GUESTS should be forced to use WAN2 then all the other AUTHUSER use a default WAN1 as gateway. Anyone know if this is possible? Thanks!

Boyz

Iam also looking for this feature, is it possible now?

johnpoz

This is possible via switch that does vlans and support dynamic vlans, or wifi again that supports via radius or 802.1x etc..

This has always been possible - but really has zero to do with pfsense.. This is your switching/networking infrastructure to put your devices/users on different vlans… Once your devices are on different vlans then pfsense comes into play and can firewall that vlan from different vlan or allow network/vlan X to use wan 1 while vlan Y users wan 2.

You don't need to be on different vlans to control which wan a connection goes out of - you can do this with policy routing based upon the IP all in the same vlan.. So IP 192.168.1.100 could go out wan 1, while 192.168.1.101 goes out wan 2, etc.

Whatever method you want to use to make sure user X gets a specific IP works too - say radius auth handing user specific IP vs vlan ID, etc. But all of that is your network and not pfsense.