Captive portal in 2.0 Release not working?
-
Ive had my captive portal working with no issues until i have recently upgraded to 2.0-release.
I have wireless clients connecting with their MAC in the Mac pass through. When they dont pay i take them out of there and they are presented with the login page and they know then to pay.. Not now.. even the people i have cut are still up and surfing, even after a reboot. Now today i have even had an antenna that connected and was surfing without even putting it in the MAC list.. how can i fix this? i am afradi that everyone is going to get on and take my bandwidth..
-
What authentication method have you enabled?
-
Authenticating to my external Radius server. We in the office who login with a username and password are working.. those external people who have an antenna to connect, and are not in the Passthrough MAC list should get the captive portal login page.. but aren't… they are just passing by it and straight on to the web..
-
Maybe try a clean install to 2.0. Call me paranoid but with such big changes in versions I tend to prefer to do a clean install. It takes a bit longer but I take a second box and configure everything to match the original. Perform a few tests and switch out the old one for final testing. if no go then I just switch the cables back and continue troubleshooting. If all is good then ;D ;D ;D
-
How can i do this and still keep my squid cache? that is very important for me as my bandwidth is not huge..
-
Sorry, I don't understand the phrase:
@luke240778:those external people who have an antenna to connect,
Perhaps it is hiding a crucial detail.
-
simple search on the web gives this….
In the last episode (Dec 29), Imran Imtiaz said:
i am running squid on my freebsd 5.4 now i want to shift on freebsd
6.0 is there a way that I can import my old cached object on the new
system cause i have a huge cache which i don't wanna lose.Just copy your cache directory to the new server and make sure the
new server's squid.conf cache settings match the old one.Maybe sftp into the pfsense the old pfsense. Copy and sftp into new one and replace....
I do not use squid so not sure where it is stored....
-
Sorry, I don't understand the phrase:
@luke240778:those external people who have an antenna to connect,
Perhaps it is hiding a crucial detail.
Sorry, yeah that makes no sense.. what i meant to say is: In the office we connect through WAP, and the captive portal works. If you dont login, the net doesnt work. On the outside i have an antenna serving my WiSP.. Those clients connect to my antenna with their CPE's.. and some of these are passing straight through to the net.. Not getting the captive portal login at all..
-
OK, so some of these persons bypassing the captive portal come through an external AP? Does their access come with a MAC address of the AP (which is one of the bypass MAC addresses) rather than the actual originating MAC address. Or, are these APs routers rather than bridges?
-
As suggested, you need to check the setup of your APs.
Anyway, using a captive portal for authentication usually isn't the best way to go for a WISP, because it is susceptible to MAC addr spoofing. You should consider switching to PPPoE.
-
OK, so some of these persons bypassing the captive portal come through an external AP? Does their access come with a MAC address of the AP (which is one of the bypass MAC addresses) rather than the actual originating MAC address. Or, are these APs routers rather than bridges?
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense, but for some reason, this all worked perfectly until around 2 weeks ago. Their MAC's show up on the Ruckus as being connected, i see them in DHCP leases but they are not on my MAC pass through list in captive portal, and from Swuid logs i see that they are browsing.
2 Weeks ago 2 things happened.. I updated from 2.0-RC3 to 2.0-RELEASE, and i also updated the Ruckus AP to new firmware.
My office, we connect through a normal indoor AP, in Bridge mode, connected to OPT1 on pfsense, for this, captive portal works as it should..
-
As suggested, you need to check the setup of your APs.
Anyway, using a captive portal for authentication usually isn't the best way to go for a WISP, because it is susceptible to MAC addr spoofing. You should consider switching to PPPoE.
The AP has been working fine as is for months, the setup of these are simple.. my setup basically is as folows:
Pfsense with 3 x NIC.. WAN, LAN and OPT1
LAN IP: 192.168.10.1
OPT1 IP: 192.168.5.1Ruckus ZF2741 outdoor IP settings are just simply (connected to a switch on LAN interface):
IP : 192.168.10.50
GATEWAY: 192.168.10.1Office AP:
192.168.5.254
GATEWAY: 192.168.5.1PPPoE is actually what i have been reading up on and want to do.. but i have around 80 clients and from what i can tell, their antennas (CPE) dont support PPPoE…
-
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense,
Which DHCP list on pfSense?
Have you verified that the source MAC address in traffic from users unexpectedly bypassing the captive portal is NOT the MAC address of the AP. (I'm not familiar with the ZF 2741 and I have read reports that some APs forward traffic with the MAC address of the AP rather than the MAC address of the client.)
-
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense,
Which DHCP list on pfSense?
Have you verified that the source MAC address in traffic from users unexpectedly bypassing the captive portal is NOT the MAC address of the AP. (I'm not familiar with the ZF 2741 and I have read reports that some APs forward traffic with the MAC address of the AP rather than the MAC address of the client.)
The DHCP Leases menu.
The SOurce MAC of the users that i am seeing bypassing the CP are the correct MAC of their CPE's, and not the AP. All currently connected clients, which i see in DHCP leases ad browsing are all the correct MAC of their CPE's.
I strangely, today am seeing 1 MAC, in the DHCP leases, also in the squid logs as browsing and downloading, with an IP in the LAN range.. so from the Outdoor AP.. buts its not showing up in the AP as a connected client at all (all other CPE's show up in the " connected clients" list on the AP.
-
I'm experiencing the same probleme with 2.0 release.
Pfsense doesn't add an pass-trough Mac permission to all Mac adresses that authenticate successfully on the captive portal. It seems just to add the pass-trough Mac permission absolutely randomly - sometimes it adds a permission - sometimes not.
The Option "Enable Pass-through MAC automatic additions" is always enabled.
I've tested several snapshots of the 2.0 Version and they definately don't have this problem.
I'm using PFSense NAND 4g on a Alix Board.
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
This is definetly a bug. A pretty bad one if you use pfsense in a business enviroment.
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
This is definetly a bug. A pretty bad one if you use pfsense in a business enviroment.
Yeah.. which i do.. it is my captive portal for my WiSP.. Is there anyone out there who may know how to fix this?
It is strange, cause i havent changed my AP.. as in how it works, just did a firmware upgrade. Captive portal i have running on my LAN (WiSP users) and my OPT1 (Office).. is working as it should for Office, but not for WiSP.. Helppppp!!
-
You might find it useful to check the output of
ipfw show
ipfw table all list -
Lets hope that this bug will be fixed with the next update to make the captive portal usable again.