Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Why does Captive Portal not work with IPv6?

    Captive Portal
    4
    10
    1.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mdes
      last edited by

      I've checked two different major firewall vendors and they claim their Captive Portal works with IPv6.
      The must do something differently or it's just FreeBSD network stack limitation on Pfsense's side?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        pfSense uses ipfw on FreeBSD for Captive Portal. There are some features of ipfw which are required for Captive Portal, such as fwd, that do not function on IPv6. I'm not certain if that is still the case on FreeBSD 12.1 but limitations like that are what have held it back in the past.

        https://redmine.pfsense.org/issues/1831

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • M
          mdes
          last edited by mdes

          Cannot find it in FreeBSD's bug tracker.
          So the requirement for Captive Portal on IPv6 seems to be low for Pfsense or OPNSense community users.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            There is a FreeBSD PR linked in the redmine entry I linked above, and from what it looks like, it was closed without being implemented.

            If the features required to support it were added to FreeBSD, we'd be a lot more likely to add the feature. Otherwise we're taking on a lot of technical debt maintaining that code for every new release in addition to all of the up-front development time. If it really isn't implemented in FreeBSD yet, as that report implies, then it needs to be brought up there.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            M 1 Reply Last reply Reply Quote 0
            • M
              mdes @jimp
              last edited by

              @jimp said in Why does Captive Portal not work with IPv6?:

              If it really isn't implemented in FreeBSD yet, as that report implies, then it needs to be brought up there.

              Can you do that?

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @mdes
                last edited by Gertjan

                @mdes said in Why does Captive Portal not work with IPv6?:

                @jimp said in Why does Captive Portal not work with IPv6?:

                If it really isn't implemented in FreeBSD yet, as that report implies, then it needs to be brought up there.

                Can you do that?

                jimp works for Netgate (pfSense), not the group that 'builds' the FreeBSD kernel and its direct dependencies.
                Even if "FreeBSD and needed firewall tools/programs" is 100 % IPv6 ready (I guess, for version 12.x it is by now - ) the Captive portal "code" becomes 3 times more work : for the IPv6 only devices, the IPv4 only devices and devices that use both.

                The day jimp gets punished badly, they will beat him, or say to him : Go implement IPv6 into the portal code....
                and we won't hear from him for months, because the thing is : most code / script has to be rewritten from he ground up.
                PHP might not even be the right language to do so.

                Btw : a captive portal is a network to offer a temporary internet connection for people dropping by at some spot.
                They just need an access. As long as there are not really "IPv6 devices only", the question isn't urgent.

                All other interfaces that do not use 'ipfw' - just 'pf', works very well with IPv6 for years now.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • M
                  mdes
                  last edited by

                  I was talking about bumping it up in FreeBSD bug tracker.

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @mdes
                    last edited by

                    @mdes said in Why does Captive Portal not work with IPv6?:

                    I was talking about bumping it up in FreeBSD bug tracker.

                    One exists ?
                    I'm pretty sure it can not exist.
                    As said, FreeBSD is already 100 % IPv6 compliant.

                    A "captive portal' is a 'trick' build into the client OS - pretty close the same thing as it should have a DHCP client running to obtain network connection info upon a network link establishment.

                    On the pfSense side, the captive portal is nothing more a some firewall rules and tables lined up in some intelligent way. Someone that knows something about a firewall (the pfSesne admin ^^)and how it's set up, can see for himself how it works.

                    What pfSense does, other then loading the ipfw up with rules and tables, exactly like the "pf" firewall, is handling some tasks like running a web server, so initial requests gets intercepted by this web server because a last firewall is redirecting http traffic to it.
                    Upon user identification, tables are expended with the IP / MAC of that user = the ipfw firewall becomes transparent for this user. The "pass rules" also count user traffic, so this info can be used later on enforce quotas.
                    Several types of identification are possible : the build in user database, or by using FreeRadius (the package) etc.

                    The problem with IPv6 : it's another protocol that needs dedicated firewall rule / table entries. And up to the captive portal logistics - the actual pfSense, mostly scripts, to link the (one) IPv4 and (more then one ?) IPv6 to one device.

                    With IPv6 - think about the the SLAAC issues used by Samsung devices : this isn't the case yet. Even major ISPs do not not propose IPv6 as they should (not RFC compliant etc).
                    Let's face it : who uses these days pfSense with 'simple' LAN's that handle correctly IPv4 and IPv6 without any issues ?

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      mdes @Gertjan
                      last edited by

                      @Gertjan said in Why does Captive Portal not work with IPv6?:

                      One exists ?
                      I'm pretty sure it can not exist.

                      What are you talking about?
                      jimp said in his two posts: There are some features of ipfw which are required for Captive Portal, such as fwd, that do not function on IPv6. There is a FreeBSD PR linked in the redmine entry I linked above, and from what it looks like, it was closed without being implemented.

                      1 Reply Last reply Reply Quote 1
                      • A
                        abdulkader.alrezej
                        last edited by

                        After two years of work, I was able to create a captive portal system on IPv6.

                        • installation guide on YouTube:

                        https://youtu.be/iNjzQ0beCaA?si=6PNOC3vEFhUfPJe4

                        • Download link for the trial version:

                        https://drive.google.com/file/d/1cbmzbUVbu6Wg_kWNLfXjOb7QZB8LlZFS/view

                        Best regards

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.