Authentication proxy ?
Does pfsense have a feature similar to the Cisco "authentication proxy" ?
Basically, the remote user authenticates to the firewall via http. After successful authentication, the firewall opens up whatever ports were configured for that user.
See "Captive Portal"
I thought captive portal only works on LAN based connection ie not coming in from WAN?
You're correct, there is no authentication system for authenticating WAN side connections in pfSense.