How to configure Captive Portal on PFSense Firewall

Подписаться 3,2 тыс.

Просмотров 59 тыс.

50% 1

The purpose of this video is to show how to configure captive portal to use vouchers and the local PFSense user database. This video also goes into how to configure a trusted 3rd Party signed SSL certificate and things to know about captive portal and SSL. This video also goes into customizing the PFSense captive portal main page in a real simple page example.
Check out our website (Still Under Construction)
www.vmnerd.com
Check out our Facebook Page
/ vmnerd
Check out our RU-vid Channel
/ @vmnerd
Any comments and feedback are welcomed. Any idea's on topics you all are interested in let me know.

Опубликовано:

19 сен 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 50

@brandonbrooks2845 7 лет назад

Great video, been in the IT business for the past 20 years, really enjoy your videos!!!!

@VMNerd 7 лет назад

Thanks for the feedback. Glad you found the my videos useful.

@cammelspit 7 лет назад

Holy shit dude! Thank you so much for this! I am wanting to set up a captive portal for a shared internet connection with some renters I have rented rooms in the house next door. This is exactly the demonstration of the configuration I was looking for. Looks like it will be time to start dusting off the old HTML skills. My intention is to have links that go right to an FTP server that will have the whole backlog of receipts for each tenant and to also have major house announcements and such right there on the portal page. This is just perfect. I only wish you had shown what happens when you don't have your own legit cert. I will have to get one, though. VERY interesting video and I appreciate it very much!

@VMNerd 7 лет назад

you very welcome ... you can install the ACME package and use let's encrypt as a FREE ssl provider. Also take a look at nextcloud for a free cloud drive. You could use this to share your files with your customers !!

@kstewbert 6 лет назад

To clarify, you're getting the untrusted certificate warning because the captive portal is decrypting the connection. When a client makes a TLS connection request to www.google.com, for example, it expects the server to return its (trusted) certificate with "www.google.com" in the subject and/or subjectAltName fields. But that isn't happening here because it's now pfSense decrypting the connection, thus sending the client a server certificate with "portal.lab.vmnerd.com". And it's doing this because it needs to decrypt the TLS session to insert an HTTP redirect to the captive portal. In other words, pfSense needs to inject an HTTP redirect, but you can't see or manage layer 7 HTTP data inside an encrypted session, so you have to decrypt it first. HSTS, or "HTTP Strict Transport Security", doesn't really have anything to do with this. HSTS tells the browser, for a given site, to always use HTTPS. If a user initially goes to www.google.com, Google will first redirect him to www.google.com, then inside that HTTPS session also send a Strict-Transport-Security header. The browser will store this information for this site, almost indefinitely, so that the next time the user opens the browser and types www.google.com, the browser will automatically switch it to www.google.com without Google having to send the HTTPS redirect.

@mervinmercado4755 7 лет назад

Hi VMNerd, thank you very much for sharing your great and great video on how to set up captive portal etc. one more thing that I want to know with you is that I need first to set up the cert on my pfsense then followed by captive portal that like showed on your video, and is there any possible problem if I mix my bandwidth limit and mac filtering? hoping on your useful answer THANK YOU AND GOD BLESS

@VMNerd 7 лет назад

I don't think so .. but it is possible. I will test and post the results.

@walterleon5581 4 года назад

Saludos amigo y Gracias por el video, tengo una pregunta, como le coloco el tiempo restante que lleva conectado un amigo en portal cautivo, en pfsense (claves wifi pero con VOUCHERS) que les muestre, (Ejemplo: su tiempo restante es: 8minutos y 10segundos.) No encuentro solucion en los foros pfsense, Espero me ayuden, se los agradeceria inmensamente. (yo uso pfsense version 2.4.4 p3)

@puh_fifer 7 лет назад

I wanted to set up a captive portal that shows terms of service and an agree button, no user name/password required. I also wanted to keep track of how many people connect and agree to the terms. Any advice would be awesome!

@VMNerd 7 лет назад

This should be pretty straight forward. I can try to have something up pretty soon !!

@chrisjchalifoux 6 лет назад

you could juest creat a group and apply the User - Services: Captive Portal login on the group insted of adding it to useres everytime and then you can add the new user to that group

@LifeofAedan 5 лет назад

I only have two interfaces. Is there a way I can program it to only send people on DHCP to the portal? I am renting our house out and want people to have to agree to a terms of service.

@VMNerd 5 лет назад

You might be able to allow specific ip addresses as a bypass in the Captive Portal section.

@CristianRodriguez123 7 лет назад

Do you know how can I get more than 1023 key per voucher without create too much vouchers?, I need it for a hotel with more than 1000 users per day. Thanks!!

@VMNerd 7 лет назад

To be honest I am not sure about the number of key vouchers. I know that opnsense a fork of pfsense supports voucher servers which might work with pfsense.

@Daz2281 6 лет назад

Would it be possible for you to show us how you implemented the real certificate? I've been on a tangent with SSL providers with no luck! Thanks!

@VMNerd 4 года назад

Hey Jeff, I will spin up another Captive Portal Video that will handle the SSL component. The one thing to keep in mind is that if someone has SSL as their default home page when they start a browser they will get SSL messages. Anyways, that should be a straight forward video.

@SuomiNomad 7 лет назад

Hi. Thanks for the great video. I have a pfsense setup with only 2 NIC's WAN & Lan. Lan is configured as a proxy to use by few users. And I cannot add another NIC as my MOBO only support 2 PCI slots. Is there any way that I could set up a captive portal under the same setup.?

@VMNerd 7 лет назад

if your switch supports vlan tags you can look into using vlans as an option as this will allow you to control at least which traffic goes to which interface. Think of VLANs as a virtual interface off of a physical connection. You will need to create an interface for each one.

@mike09271993 6 лет назад

thank for this video but im just asking if it possible that the CA use in captive portal is the pf sense own certificate

@VMNerd 5 лет назад

Yes technically but the clients will need to trust the pFSense CA which may not always be the case.

@albrough 6 лет назад

How did you Import an existing Certificate private key? I have the cert but no idea where the private key comes from

@VMNerd 6 лет назад

When you generate a certificate request (CSR) to have your certificates signed by a provider you will need a private key to do that. You can use PFSense to generate your private key or use OpenSSL to do that was well. Below is a sample command that will allow you to create your certificate with OpenSSL just replace that values that apply to you. openssl req -new -newkey rsa:2048 -nodes -out portal_lab_vmnerd_com.csr -keyout portal_lab_vmnerd_com.key -subj "/C=US/ST=California/L=Los Angeles/O=VMNerd/OU=IT/CN=portal.lab.vmnerd.com"

@Radiofreak1041 7 лет назад

Hey! You are using portal.lab.vmnerd.com as a domain, but what if I don't have a website? What do I have to put there? My external IP?

@VMNerd 7 лет назад

the name is something that your captive portal clients can resolve. So technically that can be anything including the ip address. Just note it is very difficult if not impossible to get a third party to sign SSL on an ip address.

@MrLeofezollari 7 лет назад

Congratulation for this nice video . I added www.google.com to Allowed Hostnames , but still this page is blocked . I can not access it without login to Captive Portal , any recommendations ?

@davidsierrafernandez1744 7 лет назад

I have a problem,i am trying to configure a captiveportal very similar to yours but there is a prblem,i have 2 netowrking cards (external 192.168.168.254) and internal 192.168.5.4 so once i have co figured my captive portal it doesn't makes any redirection to the login pagecan you help me please?

@VMNerd 7 лет назад

are you getting anything at all?

@massarcanjo6451 5 лет назад

Hi, thanks so much for your great video. I need a help: how can I get the certificate for Captive?

@VMNerd 5 лет назад

I just released a video using ACME certificates for a valid signed certificate you may want to follow. Watch it and let me know if it will work. Also note the one thing about Captive Portal that no one can solve is someone going to a SSL site as the first site they visit. The browser will almost always display an untrusted certificate warning. I am still looking for a solid solution on this !!

@OliveInsider 6 лет назад

Hello! VMNerd I found a probleme by installing pfSense . system prompted that CPU does not support for a long mode. what can you do 4 me?

@VMNerd 6 лет назад

If you are testing this in a virtual machine you need to make sure that you enable VT or AMD-V mode in the BIOS and create a 64 bit VM. If not then you probably have a 32 bit OS and pFSense today only supports 64bit. Hope this helps ...

@rajendraprasadsuyal1635 7 лет назад

thankyou for making this awesome video guide sir could you please guide us how to install free ssl certificate in pfsense

@VMNerd 7 лет назад

Glad this has been very helpful.

@obeliskdix 6 лет назад

followed the configuration but it doesn't work in pfsense virtual machine. My traffic shapping configuration too from pfsense virtual doesn't work on a physical pfsense box. Just totally lost my interest right now.

@VMNerd 6 лет назад

There are some known issues with traffic shaping in this version. All my tests are using virtual machines but you should get similar results as long as you have two network cards or two vlans defined going into a vlan aware switch.

@divneetsingh4835 7 лет назад

hello , i'm unable to get the captive portal working . A little help would be appreciated . do i need to setup a dhcp server ?

@VMNerd 7 лет назад

When I setup these video's I typically leave the base configuration on them and update just the IP's to reflect a real world scenario. DHCP and DNS are important a play a role in the success of your configuration. I may rework this video to talk about all those little pieces. Hope this helps.

@snetgh 7 лет назад

Please can do video on captive portal with freeradius in pfsense? I will be glad thanks

@VMNerd 7 лет назад

I do not see why not. Adding another authentication source should be straightforward. I will add that to my to do list and I think I could crank this out quickly.

@apigoterry 7 лет назад

Subbed. Yes please do make authentication using freeradius

@VMNerd 7 лет назад

I have added it to my list of things to do

@pedropablodelgadomartell5514 6 лет назад

I enter this video for that FreeRADIUS+Captive Portal. Isn't ready yet? Thanks for the video.

@luisdominguezherrera 7 лет назад

Great video! I'm looking for information about how I could sell vouchers for a period of time and deliver Internet without contracts, do you can give me some information how to achieve this? Best regards from Chile!!

@VMNerd 7 лет назад

You can generate vouchers and sell them in an online store. You would just allow that website through the captive portal itself.

@st1ckyfing3rz 7 лет назад

how do you make the vouchers short? Maybe 5 characters only instead of 13?

@VMNerd 7 лет назад

I personally have never tried this but I found an forum article that explains an approach to performing this. forum.pfsense.org/index.php?topic=41658.0

@st1ckyfing3rz 7 лет назад

thanks bro.

@fakihf 7 лет назад

This is mi network I want to put behind : * router Router ZTE F660 *Access point TP-LINK AP500 *TP-link RE 580 repeater that extends the wifi network of the access point '' TP-LINK AP500 '' How to configure pfSens to make the captive portal operational for my entire network I want to generate access codes with a limited time for each client how can I do thank you

@VMNerd 7 лет назад

Can you give me the full layout of your network. The hardware you have should work with the exception of the pFSense itself you will need a machine or virtual machine with a recommended 3 interfaces. I would have a WAN interface which is direct connection to your ISP. The LAN interface for all non-wireless traffic and an OPT3 for your Access Point and the repeater. On pFSense you could enable the captive portal and setup some vouchers for time based access. This sounds like an interesting concept where you could setup a store and sell the vouchers ..... sounds like a possible video for me to do !!