Secure Guest Wi‑Fi on pfSense: Using Captive Portal with Subnet‑Based Bandwidth Control

The Guest Wi‑Fi Challenge

Small‑to‑medium businesses often need a quick way to let visitors connect to the internet without exposing internal resources. The solution must: (1) authenticate users, (2) prevent abuse of bandwidth, and (3) be easy to maintain. A common approach is to create a separate guest network and use a captive portal for authentication. However, many administrators run into the problem that the portal itself does not enforce bandwidth limits, and the limits that are available apply to entire subnets rather than individual users.

pfSense Captive Portal – What It Does

The Captive Portal feature in pfSense intercepts HTTP(S) traffic from a selected interface, redirects it to an authentication page, and then allows the traffic to flow once the user has logged in. It can be backed by a local database, LDAP, or RADIUS. By default, the portal only handles authentication; it does not impose per‑user bandwidth throttling. Instead, the limits you see in the portal settings are applied to the whole subnet that the interface serves.

Combining with Traffic Shaping

To get per‑subnet bandwidth control, you pair the Captive Portal with pfSense’s traffic shaper. The shaper can be configured with a HFSC scheduler that limits the total throughput for a given interface or IP range. Because the portal itself cannot limit individual users, this approach ensures that all guest traffic stays within the defined ceiling.

Step‑by‑Step Example

Below is a practical example that sets up a guest network on LAN2 (192.168.2.0/24), enables the Captive Portal, and limits the subnet to 1 Mbps using the traffic shaper. All commands are executed through the pfSense web UI; the same configuration can be applied via the API or by editing config.xml if you prefer command‑line work.

1. Create a Guest Interface

1. Navigate to Interfaces > Assign and add a new interface that points to the physical port connected to the guest Wi‑Fi access point. Give it a name, e.g., LAN2.
2. Enable the interface, set IPv4 Address to 192.168.2.1/24, and enable DHCP if you want the portal to assign addresses.

2. Enable the Captive Portal

1. Go to Services > Captive Portal. Check Enable captive portal for the LAN2 interface.
2. Choose a simple authentication method (e.g., local database). Set a welcome message and a timeout of 30 minutes.
3. Under Bandwidth limits, set Maximum bandwidth per subnet to 1 Mbps. Note that this applies to all hosts on 192.168.2.0/24.
4. Save the configuration.

3. Configure Traffic Shaping

Traffic shaping is configured under Firewall > Traffic Shaper. We’ll use the HFSC scheduler.

1. Click Add to create a new shaper rule for LAN2:
2. Interface: LAN2
3. Queue name: guest-shaper
4. Bandwidth: 1 Mbps
5. Scheduler: HFSC
6. Save and apply.

In the configuration XML, the rule would look like this:

<trafficshaper>
  <queue>
    <name>guest-shaper</name>
    <interface>LAN2</interface>
    <maxbw>1000000</maxbw>  
    <scheduler>HFSC</scheduler>
  </queue>
</trafficshaper>

Ensure that the rule is placed before any generic rules that might override it.

4. Verify the Setup

1. Connect a device to the guest Wi‑Fi. It should redirect to the portal page.
2. Log in with the credentials you configured.
3. Open a browser and navigate to a high‑bandwidth site (e.g., a video stream). Use iftop or the pfSense Status > System Logs > Traffic Shaper to confirm that traffic does not exceed 1 Mbps.
4. Check the Diagnostics > Packet Capture on LAN2 to verify that packets are being queued by the guest-shaper queue.

Trade‑Offs & Limitations

• Per‑subnet limits – The Captive Portal’s bandwidth setting applies to the entire subnet, not to individual users. If you need per‑user limits, you must implement a more granular QoS system or use a third‑party solution.
• Hardware acceleration – VPN performance (if you also run a VPN for guests) can be impacted by the lack of AES‑NI support on older CPUs. This has no direct effect on the portal but can influence overall throughput.
• Memory allocation – Traffic shapers consume memory. For large networks, monitor Status > System Performance to ensure you have enough RAM for the queues.
• Rule order – Traffic shaper rules must be correctly ordered; a later rule that allows higher bandwidth will override the guest limit.

Wrap‑Up

By combining pfSense’s Captive Portal with a traffic shaper, you can deliver a secure, authenticated guest Wi‑Fi network that respects bandwidth constraints. Remember that the portal’s limits are subnet‑wide, so plan your network layout accordingly. Test the configuration thoroughly, monitor logs, and adjust the shaper if you notice performance issues. This approach gives you a robust, maintainable solution that scales with your business’s guest access needs.