Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captive Portal bypass issue

    Scheduled Pinned Locked Moved General pfSense Questions
    49 Posts 5 Posters 9.7k Views 5 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Offline
      stephenw10 Netgate Administrator
      last edited by

      That is IPv6 traffic hitting the IPv4 Limiters

      It's fixed in 23.01: https://redmine.pfsense.org/issues/13290

      M 1 Reply Last reply Reply Quote 1
      • M Offline
        michmoor LAYER 8 Rebel Alliance @stephenw10
        last edited by

        @stephenw10 Confirmed. Kicked off a iPhone client on the captive portal and those messages are gone.

        Firewall: NetGate,Palo Alto-VM,Juniper SRX
        Routing: Juniper, Arista, Cisco
        Switching: Juniper, Arista, Cisco
        Wireless: Unifi, Aruba IAP
        JNCIP,CCNP Enterprise

        1 Reply Last reply Reply Quote 0
        • the otherT Offline
          the other
          last edited by

          sorry for being kinda offtopic:
          just wanted to say thanks for you guys/girls(?)...
          ...a) pointing out this "problem"
          ...b) having a discussion about it
          ...c) trying to reproduce the issue
          ...d) helping me getting my peace of mind back

          :)
          Seriously: thanx for your ongoing support and (my personal opinion) the good work with pfsense so far...hope Santa has you on his list.

          the other

          pure amateur home user, no business or professional background
          please excuse poor english skills and typpoz :)

          1 Reply Last reply Reply Quote 2
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            The MAC address block entries now work as expected with the newly added patch.
            https://redmine.pfsense.org/issues/13747#note-11
            Please test and let us know.

            Steve

            M 1 Reply Last reply Reply Quote 1
            • M Offline
              michmoor LAYER 8 Rebel Alliance @stephenw10
              last edited by

              @stephenw10 How do i apply the patch?

              https://github.com/pfsense/pfsense/blob/483512b3a3226132b7b249f7ea3e2146d3829c23/src/usr/local/captiveportal/index.php#L181

              Firewall: NetGate,Palo Alto-VM,Juniper SRX
              Routing: Juniper, Arista, Cisco
              Switching: Juniper, Arista, Cisco
              Wireless: Unifi, Aruba IAP
              JNCIP,CCNP Enterprise

              M 1 Reply Last reply Reply Quote 0
              • M Offline
                marcosm Netgate @michmoor
                last edited by

                You may use the commit ID 7e5dbbfca68179fd29a685363625c810d4da6417 in the System Patches package - see here: https://docs.netgate.com/pfsense/en/latest/development/system-patches.html

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Just add the commit ID in the patches package:

                  Screenshot from 2022-12-20 21-11-47.png

                  7e5dbbfca68179fd29a685363625c810d4da6417

                  M 1 Reply Last reply Reply Quote 0
                  • M Offline
                    michmoor LAYER 8 Rebel Alliance @stephenw10
                    last edited by

                    @stephenw10 @marcosm
                    Thanks gents. I couldnt find the commitID.
                    I can confirm that this is fixed. The mac addresses not only cannot get on the network but there is a message indicating to the client that they are blocked.

                    Also syslogs confirms block

                    72010920-704e-4323-96b6-ce71a77e6985-image.png

                    I really dont know what to say but this has been a journey in troubleshooting and talking to the netgate team. Truly appreciate it.

                    Time to whip out the old wallet for that TAC sub ๐Ÿ˜‰

                    Firewall: NetGate,Palo Alto-VM,Juniper SRX
                    Routing: Juniper, Arista, Cisco
                    Switching: Juniper, Arista, Cisco
                    Wireless: Unifi, Aruba IAP
                    JNCIP,CCNP Enterprise

                    GertjanG 1 Reply Last reply Reply Quote 1
                    • GertjanG Offline
                      Gertjan @michmoor
                      last edited by

                      @michmoor said in Captive Portal bypass issue:

                      talking to the netgate team

                      Euh .... the solution was already on the forum.
                      13747 went from Not a bug, to Duplicate, to Bug again to get solved. I guess it's a question of finding the right words when writing feedback.

                      The official patch, as always, is much nicer : why adding a line if removing something does the job ๐Ÿ˜Š

                      And be careful : https://redmine.pfsense.org/issues/13784 was added on the fly : A MAC can (23.01) be blocked the soft way, the user will see the message that his MAC is blocked. You can chose bewteen an error message, or a MAC block portal page to be uploaded. See here for info and example how to implement that.
                      Or : new, see 13784 : totally rejected : the MAC becomes part of the pf rules that block any interaction with the captive portal interface. I guess the user would be able to get a DHCP lease sorted out, and that's it, nothing more.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 1
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.