Captive portal on OPT1 to restrict access to LAN

[macman64]

I want to setup up a captive portal so that those on my opt1 have access to the internet but not the LAN. If they want access to the LAN they must login to the captive portal. How would I accomplish this? I wish you could set up "allowed interfaces" so I could make it default to allow access to the WAN port. any thoughts?

[macman64]

anyone? I know bumping is bad….

Any chancing of adding this down the road? It just requires you to be able to select an interface for access to be aloud on vs just IP addresses.

[GruensFroeschli]

Afaik this is not possible.
Well it's theoretically possible, but you cannot use IP-ranges in the passthrough list, so i dont think you want to add a couple millions of IPs ;)

[XIII]

you could do it with 2 pf boxes.
one after the other, might have to do it with vpn/ppoe.