Captive Portal together with DNS behind IPsec

[marcoafm]

Good morning,

My scenario:
I need to use captive portal
My AD/DNS is on AWS

The problem:
The captive portal only appears if pfSense itself is the DNS of client machines, right? Thus, if I set the IP of the AD (which is behind a VPN) for DHCP to deliver it to the clients as the DNS server, I will "see" the domain calmly, but the captive portal will not appear (it gives an error in navigation) ; and, if I set the pfSense IP for DHCP to deliver it to the clients as the DNS server, I will "see" the capitive portal but I cannot access the domain since the AD is behind a VPN (even registering the domain and respective IP in Services > DNS Resolver > Domain Overrides is not working).

I ask:
Is there a way to make the captive portal work even if pfSense is not the network DNS?

Even with the VPN fully functional, if I access the pfSense shell and try to ping a remote ip on the VPN it doesn't work. Is there a way to make pfSense itself see the hosts behind the VPN? If I get this, DNS registered in Domain Overrides will work.

I really appreciate any help.