Implementing pfSense Captive Portal Authentication for Guest Network Access

Problem: Controlled Guest Access Without Compromising Internal Networks

You need to provide internet access to visitors while maintaining visibility into their activity and enforcing usage limits. pfSense's captive portal feature redirects unauthenticated users to a login page, enabling you to control guest access through local accounts, external authentication servers, or time-limited vouchers.

Prerequisites

• pfSense firewall running version 2.5.0 or later
• Guest network interface configured and routed
• Administrative access to pfSense web interface
• DNS resolution working for the captive portal domain

Configure Captive Portal Service

1. Navigate to Services > Captive Portal
2. Select the guest network interface from the dropdown
3. Set Authentication Backend to Local User Manager (or configure RADIUS/LDAP if external)
4. Configure Session Timeout (e.g., 4 hours for guest sessions)
5. Set Idle Timeout to disconnect inactive sessions after 30 minutes
6. Enable Redirect URL to a custom landing page if desired
7. Click Save and Apply Changes

Create Guest Users or Vouchers

For simple deployments, create individual accounts in System > User Manager. For scalable guest access, use vouchers:

1. Go to Services > Captive Portal > Vouchers
2. Click Add and set validity period (e.g., 24 hours)
3. Choose voucher type: Single Use or Multi Use
4. Generate vouchers and distribute to guests via email or printed codes

Expected Checks and Verification

After configuration, perform these validation steps:

• Test login redirect: Connect a device to the guest network and attempt any HTTP request. You should be redirected to the login page.
• Verify session creation: After successful authentication, check Access > Logged In Users to confirm the session appears with correct IP and timeout values.
• Review logs: Navigate to System > Logs > Captive Portal and confirm authentication events are recorded. Look for entries like "User authenticated successfully" and "Session started".

Limitations and Security Considerations

Be aware of these constraints:

• HTTPS warnings: Self-signed certificates will trigger browser warnings. Install a proper certificate from a trusted CA or use the pfSense CA for internal trust.
• MAC bypass risk: Sophisticated users may spoof authenticated MAC addresses. Consider combining captive portal with firewall rules that limit access by IP ranges or services.
• Performance impact: On low-resource hardware, hundreds of concurrent sessions can degrade performance. Monitor CPU and memory usage under load.

Recovery Options

If captive portal issues arise:

• Disable and re-enable: Uncheck Enable Captive Portal, Save, then re-enable and Apply.
• Clear sessions: Use Access > Logged In Users and click Kill on problematic sessions.
• Rollback configuration: If changes cause network disruption, use System > Configuration > Backups to restore a previous configuration.

Practical Verification Command

From a client on the guest network, test DNS resolution:

nslookup 1.1.1.1

If captive portal is active and you are unauthenticated, this should redirect to the login page rather than resolving normally.