Captive Portal using domain name not working

richardsago

Good day. Please let me know where my mistakes are. When I setup captive portal to use domain name of pfsense it's not working but if I deactivate domain name in captive portal it works.

A. This is when captive portal is set to use domain name of pfsense and will not work:

Services > Captive Portal > Configuration > Login [enable]. I think "HTTPS server name" is one of the mistakes but I don't know what value to replace it. Its current value is the "hostname" + "domain" that is found in System > "General Setup" and with working acme certificate. And opening pfsense in a browser using this hostname and domain is working

Connect the computer to the captive portal WFi, then open a browser and then click "Open network login page"

It will not go to the captive portal webpage:

B. This is when captive portal is set to use IP address of pfsense and will work:

Services > Captive Portal > Configuration > Login [disable]

Connect the computer to the captive portal WFi, then open a browser and then click "Open network login page"

The captive portal will be displayed

After a correct voucher code is entered then the device will be connected to the internet

C. These are screenshots of other settings that may be helpful in diagnosing:

System > "General Setup" > hostname + domain is the value used in Services > Captive Portal > Configuration > "HTTPS server name"

System > Advanced > "Admin Access" > "SSL/TLS Certificate" is the value used in Services > Captive Portal > Configuration > "SSL/TLS Certificate"

The acme certificate is working:

Did not add "hostname" + "domain" of System > "General Setup" to System > Advanced > "Admin Access" > "Alternate Hostnames" because opening pfsense using hostname + domain is already working

Also did not add pfsense's hostname and domain in Services > "DNS Resolver" > "General Settings" > "Host Overrides" and "Domain Overrides" because opening pfsense using hostname + domain is already working

Gertjan

@richardsago

Your Captive portal is using the pfSense LAN as it's interface ?
Normally, the pfSense LAN is a trusted network, you connect your own trusted devices, and you use LAN to access the pfSense GUI for administration etc.
A captive portal is by nature a non-trusted network, so this can't be the LAN, but some other OPTx interface. This interface will contain firewall rules that apply to your portal visitors.

I'm not saying that the captive portal network can't be LAN, but it's a bit 'strange'.

Can you test this : connect your device to the portal network - no need to login. Can you show this :

ipconfig /all

Remember : DHCP and DNS should work.

edit :
@richardsago said in Captive Portal using domain name not working:

After a correct voucher code is entered then the device will be connected to the internet

If you don't user 'users' and 'password', you can remove this part :

so only

shows up.

richardsago

Thank you @Gertjan for the reply. Here is the output of ipconfig /all

The captive portal is set to VLAN 70. How do I get around to making captive portal work using domain name, without using pfSense LAN?

Gertjan

Ok, the image shows that the gateway == the DNS. That's good.

@richardsago said in Captive Portal using domain name not working:

The captive portal is set to VLAN 70

That's can be an additional source of issues.
Before activating pfSense you have to be sure that the VLAN setup works. This means that the VLAN setup of pfSense matches the VLAN setup of your VLAN capable switch.
Or, you use VLAN capable access points.
VLAN settings need to be tested and validated before activating the portal.

@richardsago said in Captive Portal using domain name not working:

How do I get around to making captive portal work using domain name, without using pfSense LAN?

That's what I use : a dedicated interface for the portal.
I didn't have a choice as my captive portal is used by 'unknown' strangers that 'I don't trust'. I use the captive portal for what it was meant to be used (why it was created) : I use the portal for a hotel, so my hotel clients use the hotel portal (wifi) access.

You actually mentioned already all the needed steps.

I picked a local network interface (and called PORTAL) for the captive portal :

Btw : my pfSense certificate is a wildcard certificate.
As I own (rent actually) the domain name :

I set up acme.sh to get a wildcard *.my-hotel-domain.tld certificate.
My pfSense GUI uses this certificate, so pfsense.my-hotel-domain.tld which already resolves to 192.168.1.1 (and the IPv6 equivalent) will work just fine.

For the portal, I used this :

and selected of course the same certificate to be used.

https is URL or host name based**, so I have to tell pfSense, the resolver, what IP "portal.my-hotel-domain.tld" is.
easy, you've said so yourself : I created a Host Overrides (resolver settings page) so from now on, when a web browser uses portal.my-hotel-domain.tld it will find 192.168.2.1 (my PORTAL pfSense IPv4).

** I think - check first, that you can now also add IPv4 as a SAN for the certificate. But for me, it's way better the client sees portal.my-hotel-domain.tld - showing IPs in an URL can be considered 'scarry'.

For testing purposes, set up a pass all firewall rule on the PORTAL interface.

You can change it later, add more rules, for more control.

Don't forget to set up the DHCP server for the portal interface and give it a big pool like 192.168.2.10 -> 192.168.2.254.

Have a look at the pfSense /etc/hosts file.

richardsago

Thank you @Gertjan for the reply. I followed your guide and it works after these steps:

Add a new SAN for the portal in acme
Generate updated acme certificate that now includes the portal SAN
Add this new portal in System > "DNS Resolver" > "General Settings" > "Host Overrides" pointing to the portal IP
Change Services > "Captive Portal" > "HTTPS server name" to point to the new portal SAN