Captive Portal for IPsec Clients

jnorthe

Hi,
we have the following scenario with pfsense version 2.2.4:

Internet –- pfSense(Voucher-CaPo) =====IPSec-Tunnel===== RemoteFirewall(nonPfSense) --- Guests 10.0.220.0/24
|
|------------------ Guests 10.0.200.0/24

The guests comming from 10.0.200.0/24 are running into captive portal but guests comming from 10.0.220.0/24 can access internet without :o.
Due to the fact that strongswan is not creating an ipsec interface I tried to bind captive portal to LAN only, LAN+WAN but this does not helped me.

When clients from 10.0.220.0 access http://pfsense:8000 by hand they get a rewritten URL with the public IP address of the pfsense box of the captive portal page.

Any hints for me?

Thanks in advance
Juergen

doktornotor

Yeah, the hint is that this will never work.

jnorthe

cool.
thanx

Juergen

Derelict

Put a router doing captive portal in front of the router doing IPsec and it won't know the difference.

WAY too much emphasis in the pfSense world at getting one "box" (node) doing everything.

hpmueller

@jnorthe:

Any hints for me?

Yeah, the captive portal needs a real interface (that you can select in the captive portal list). I havn't tested this, but if your remote firewall can do GRE, do an additional GRE tunnel over ipsec, that way you get an interface what should work. If you can do OpenVPN, this also work…

/hp

Guest

WAY too much emphasis in the pfSense world at getting one "box" (node) doing everything.

1 from for that.

additional GRE tunnel over ipsec, that way you get an interface what should work.

L2TP/IPSec would be the way to realize this.

Internet –- pfSense(Voucher-CaPo) =====IPSec-Tunnel===== RemoteFirewall(nonPfSense) --- Guests 10.0.220.0/24

One Question from me onto this, why not both sides are using then a pfSense firewall with Captive Portal?
A small PC Engines APU is really able to hold this pfSense based Captive Portal for many users.