Captive portal ignoring MACs in latest version and allowing all machines access
-
@h2professor said in Captive portal ignoring MACs in latest version and allowing all machines access:
We had to conclude that the problem is in version 2.4.4-p3 despite people insisting that "no changes were made to the captive portal section" bla bla bla. Hence, it's not a believable problem.
People don't "insist" anything. My post also wasn't meant as an insult or attack, I was simply wondering why you wrote that. The devs simply said in another thread, that they did check the portal code and there was no commit or anything else belonging to the portal code in between -p1 and -3. So it either has to be a dependency like e.g. radius or some other thing that links into the portal like IP lists etc. what @theworkingcentre wrote.
I also am not "ironic" but I find it quite a bit "unfair" to write sth like "nobody believes me" after page-long tries to help you debug the problem Also your list in "things we did do" lists "importing the configuration" EVERY time. So like I wrote above, how about simply debugging the thing with a fresh installation and configuring step by step the way it is now in your clients environment? Why do you insist of always importing the config.xml when it could very well be some thing that doesn't get imported the right way or perhaps was a problem with importing and updating this installation every time? I had small problems like that a few times. Rarely but they do exist. Changes in config format and old configs that have some duplicate lines or sth along those lines.
So why not trying one of this things instead of being sarcastic yourself and accuse us for doing "nothing"? At the end of the day we are simply other users and/or private persons here. This is not the official Netgate pfSense bug tracking support system.
And as much as I would like to see you/us succeed in tackling that problem: If your client is that sensitive and you have that narrow a margin in errors, wouldn't it be a better job to buy support for that device and ask the devs to have a look / fix it in your client's setup instead of getting angry with us for trying to help you? Or at least before going the support route submit that case with all details as a an official bug in the bugtracker? Sorry, I'm just trying to help here. And I'm not related or employed by Netgate after all. :)
Best wishes!
-
I"m still reading here .... trying to figure out.
Last couple of weeks I loaded a Hyper-VM on my 2012 Win server, it has 3 NIC's, so I can simulate and test without disturbing my companie network. Also : I'm using a second PC @home loaded with pfSense (using VM also).
Detail these 2 phrases :
@h2professor said in Captive portal ignoring MACs in latest version and allowing all machines access:
After, with 28:c6:8e:0f:95:9b set to Block
after.txt
I note that the MAC is not found in the second output.As soon as the captive portal is activated on an interface, everybody (MAC, IP, whatever) is blocked.
Even when you have this :
on the LAN interface.ipfw takes precedence of the ip firewall. ip being the firewall you set up with the GUI.
When you add a MAC on the MAC tab as a "pass" , this MAC will be part of your table "default_pipe_mac":
02100 145763334 141217081935 pipe tablearg ip from any to any MAC table(default_pipe_mac)This is a snaphot of your "default_pipe_mac" :
dc:ef:09:9b:a8:c0 any 2671 1155484 1699152753 1560263421 any dc:ef:09:9b:a8:c0 2670 11 0 1560262129You can see the MAC, the pipe rule numbers 2670 (down) and 2671 (up) and the number of bytes received and send.
These are the related pipe rules 2670 and 2671 :
..... 02670: unlimited 0 ms burst 0 q133742 100 sl. 0 flows (1 buckets) sched 68206 weight 0 lmax 0 pri 0 droptail sched 68206 type FIFO flags 0x0 16 buckets 0 active ..... 02671: unlimited 0 ms burst 0 q133743 100 sl. 0 flows (1 buckets) sched 68207 weight 0 lmax 0 pri 0 droptail sched 68207 type FIFO flags 0x0 16 buckets 0 active ...Both are unlimited pipes.
Btw :
I found one (just 1) speed limiting (half a mega / s )pipe :02223: 500.000 Kbit/s 0 ms burst 0 q133295 100 sl. 0 flows (1 buckets) sched 67759 weight 0 lmax 0 pri 0 droptail sched 67759 type FIFO flags 0x0 16 buckets 0 activePipe 2223 : so this is device
28:c6:8e:0f:95:9b any 2223 11722 14806366 1560263421 any 28:c6:8e:0f:95:9b 2222 2 0 1560262183is speed limited - this is the only device I found that was limited speed.
The blocked MAC list : as you might have understand, MAC's that are blocked are not present in the ipfw tables and rules.
When you add a MAC as blocked, it's been put in a list handled by the GUI.
The Captive portal web server, when intercepting a (in your case : http) visitor web browser http requests, are redirected to this page page :
(some conditions have to be met, like this page must is on the same LAN segment as the captive portal - there must be a http web server that can serve the page, etc - it might, it might not. For me, using an iphone, it didn't redirect well )
If no URL, the device is blocked, for any IP, for any port, for any protocol.
But : when a MAC isn't present on the MAC tab, or it's set as a red block, it won't pass.
I advice you to use and old PC to test - make sure there is a second NIC, and setup pfSense for yourself. Although I strongly advise you to use a captive portal on a dedicated - OPT1 - NIC, and leave the LAN for administrative purposes.
When applied the minimal setup as per Netgate's video (there are 3 videos on Youtube, the Netgate channel, take a recent one that handles basic operations) no device can connect, and they will show the default Login when you use a web browser on a visiting device. https restrictions might apply.
Now, when you add ONE MAC as a pass, this device can pass to the net. Right ?
Still, no other device can pass. Right ?
Add another MAC as a pass. It passes right ?
An still, no other devices can pass.
For the fun, add a MAC of a device that you own, as a BLOCK. It can not pass, right ?
And again, other, non listed MAC's still can't pass.
Etc etc.You could even import your entire "300 MAC" list.
I would do this by exporting the config.xml - then use notepad++ to insert the block of.... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>7c:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> .....in the correct section, and import that file back in again.
Still, unlisted device you own can't pass as they are not part of the list.
I ended up listing all my devices (9) as blocked : they didn't pass.
I removed them from the MAC tab, so not listed as a pass or block : they still didn't pass.Btw : do not hesitate to reset firewall states. I don't know if it is really needed, but it would harm to reset they all the time, after changes.
My main question is : can you replicate your issue on a barebone system, after a manual minimal setup.
And if so, after which change your issue happens ?Also : export your
.... <passthrumac> <action>pass</action> <mac>xx:8d:79:91:ec:52</mac> <bw_up></bw_up> <bw_down></bw_down> <descr><![CDATA[Sophie]]></descr> </passthrumac> <passthrumac> <action>pass</action> <mac>bb:bb:35:f2:a9:0e</mac> <descr><![CDATA[Serge Nouveau portable]]></descr> </passthrumac> .....section, and drop it in here.
Mistify all MAC's be replacing the first byte by placing 'bb', as I did above.I'll import your list.
I wonder if I see the issue then ...
