Jump to content



Photo

Problems with pfsense's captive portal


  • Please log in to reply
18 replies to this topic

#1 Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 13 May 2014 - 12:11

Hello,

 

I'm a student and have to configure a captive portal for my project using pfsense.

 

My project is to configure a '' WAN network '' but on a private lab. For that, I need to configure a UNREAL Tournament game server on a DMZ, and the clients are separated from it by another router and can access it in order to play it.

 

 

It's simpler with a picture so the network I have is the following : 

 

 

  network picture.png

 

 

 

 

So, what I want to do, is telling the clients that as long as they are not authenticated by the captive portal, they can't access to the network and therefore they can't access the game.

 

The problems are : I dont have a dedicated machine to run pfsense so I have to run it on VMs, and my all network doesnt have internet access.

 

I've managed to do this so far : 

 

network picture.png

 

 

NIC1 is my WAN interface and NIC2 is my LAN interface.

 

I can access the webConfigurator.

But from the LAN I can't ping the WAN interface.

 

THe LAN interface is setup as 192.168.1.1, DHCP Disable because I have my own DHCP server on the ROUTER 1

 

The WAN interface is setup statically as 192.168.10.2 and upstream gateway is 192.168.10.1.

 

I'm pretty sure the problem is from this WAN interface setup but I don't know how to fix it really so some help would be nice.

 

Thank you

 

 

 

 

 

 

 

 

 

 

 

 

 




#2 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 12:16

"and my all network doesnt have internet access."

 

What does this mean - you clearly have internet.. Since you posted this?

 

What does the internet have to do with anything if "your" running the game server?  This could be all done on vm..  So both routers are pfsense?  Everything even the clients could be vms

 

You show 2 routers, and your pfsense vm?  So there are 3 routers?  So this router1 and router2 and the game server all reside in physical?

 

And the host your on is on this 192.168.10.0/24 network?  And your clients that need to get to the game server are going to be physical or vms?



#3 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 13 May 2014 - 12:18

This means, my host machine has internet access but I can't allow VMs to have the access because this is an university network with so much restrictions.

 

No both routers are ciscos, the only reason I'm using pfsense is to do the captive portal.

 

Kinda hard to explain but I hope it's understandable.

 

 

And yeah everything is physical except the clients who plays the game from Virtual Machines and the pfsense 



#4 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 12:24

Is your host connected to this switch that is the 192.168.10.0/24 network?  From the drawing its not.

 

You have a line from the 192.168.10.0/24 switch to pfsense -- but to what?

 

You say your lan can not ping what wan?  Pfsense 192.168.10.2?  Can pfsense ping 192.168.10.1?



#5 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 13 May 2014 - 12:58

The host machine is not connected to the 192.168.10.0/24 network because I can't touch any ethernet interfaces -.-

 

I forgot on the drawing that the VMs are connected to the switch, all of them.

 

Also I need to know, with my setup , the VM clients should have an IP address like 192.168.10.x with 192.168.10.1 gateway or 192.168.1.x with 192.168.1.1 gateway ?

 

Sorry i'm new to this and really confused.

 

When my VM client has the address 192.168.10.x I can ping the WAN interface but not the lan and vice-versa.

 

Pfsense can't ping 192.168.10.1



#6 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 13:02

"The host machine is not connected to the 192.168.10.0/24 network because I can't touch any ethernet interfaces -.-"

 

Then how and the F is pfsense suppose to be able to talk with 192.168.10.1 ??  So that it can then talk to the game server??  Magic??

 

So you have no wire that runs from this switch to the host box that pfsense is running vm on?  Then how do you show a wire from that switch to pfsense??

 

The host that is running your VM software, that pfsense is a vm on has to have a physical connection to that switch 192.168.10.0/24 or it is not possible for pfsense to be connected to that network - yet you show a line..  Your pc does not have to have an IP in that network.. But it needs a physical connection so that your vm can connect.

 

what are the current connections on your host machine?



#7 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 13:23

Here like this

 

somethinglikethis1.png

 

BTW that 172.108 is a public IP space.. rfc1918 space that starts with 172.16-31.x.x

 

BTW why are you doing nat on the other routers?  Are you not just pretending those are internet services - the nat is of no point when everything is rfc1918 space..  Is that really 172.108 public IP space?



#8 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 13 May 2014 - 13:27

Ok that was pretty stupid from me. I did the config with my personal laptop, which means I don't have internet access though :

 

WAN Interface : Bridged : Configured by DHCP ( because the ROUTER 1 does DHCP server ) : address 192.168.10.7 , gatewway : 192.168.10.1.

                                                                                                                       

LAN Interface : Internal network intnet : 192.168.1.1. 

 

so pfsense can now ping 192.168.10.1. 

 

Although, from my client VM which is setup as 192.168.10.8 with 192.168.10.1 gateway. The VM is on my personal laptop and is in Internal network intnet.

 

When i try to ping the WAN interface of pfsense ( which is now 192.168.10.7 ) it says " Destination host unreachable. "

 

So now, is this a route problem or something else ? I'm so lost with VMs

 

( I also tried with VM setup as 192.168.1.8 and gateway 192.168.1.1 , because it makes more sense, and it says Request timed out )

 

 

EDIT : Didnt see your last post, 172.108 is a public space but the lab where i'm working is like isolated from the rest so i can put any IP addresses I want, this part will actually be a DMZ later on



#9 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 15:18

"172.108 is a public space but the lab where i'm working is like isolated from the rest"

Still VERY VERY BAD!!! Practice to use external public IP space that is not owned by you on your network. There is plenty of rfc1918 space - there is no reason to use public IP space that is not owned you on your own network. And even if owned by you, using it what is clearly a private network makes for confusion.

Now I currently don't show any whois for 172.108, the 172.16/12 is rfc1918, but for example 172.0/12

NetRange: 172.0.0.0 - 172.15.255.255
CIDR: 172.0.0.0/12
OrgName: AT&T Internet Services

You should not be using this address space - it is a VERY BAD habit to get into pulling address space out of thin air and using it.

Ok if the router for 192.168.10.0/24 is handing out dhcp - you can not just use static.. That could cause all kinds of problems (how do you know there is not another device using that IP?). In your vm software if you bridge physical interface that is connect to this 192.168.10.0/24 network, your physical machine should get an IP. And then the virtual machines with interfaces on this network should also get an IP from the dhcp server on this network. Since the VM virtual nic bridged to your physical would have its own mac.

Now you mention this is school and you can not connect vms to the internet? Who owns this router for the 192.168.10.0/24 network and this switch. If it is running any sort of nac or nap, port security - its possible that only the mac it first sees on a port is allowed an IP, etc. Or registered macs can get an IP, etc.

In a nutshell. On your pfsense vm, on its wan interface that is bridged to your physical interface connected to the 192.168.10.0/24 network - you should be able to set it to dhcp and get a IP. If it doesn't then your never going to get this to work. And you need to contact who admins that router, etc. If pfsense can not talk to its wan gateway - then no vms you put behind it would be able to talk out the wan, etc.

If your physical host can ping to the 192.168.10.1 router - then your pfsense wan via dhcp should also be able to ping this 192.168.10.1 address.

#10 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 13 May 2014 - 16:35

Hm ok thanks for all the answers.

 

With all your help I managed to make it work so thanks a lot ! 



#11 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 13 May 2014 - 16:41

Great to hear! So was pfsense your choice, or was that what the class is using - curious?

#12 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 14 May 2014 - 13:02

Hm actually I had to find a free captive portal solution , considering most of the computers in the lab are using windows I thought of Firstpot but it was not free and then I found pfsense which seemed pretty simple to use. Then my supervisors agreed with that solution even if they didn't know pfsense can be used as a captive portal lol



#13 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 15 May 2014 - 12:16

Nice -- so lets hear about that A when you get it ;)



#14 OP Wellan

Wellan

    Neowinian

  • Joined: 13-May 14

Posted 03 June 2014 - 13:06

Well, the project is not finished yet and I have another problem and I don't know how to fix it again -_-

 

So, once I did the captive portal and radius everything works fine if I have internet, but considering in my test lab I don't have internet, I can't use the ISP DNS so the redirection to the captive portal does not work.

 

That's why I installed the bind service. I configured it like this http://ejnetwork.wor...nse-using-bind/.

 

I am really new to DNS configurations and I still don't know if it is possible to redirect every http or https request to the captive portal. For now if a user enter an IP address in the URL I am able to redirect it but if he types in any domain name like "rjwiepjpweihgpwerihgew" for exemple it doesn't work.

 

So I think it's coming from the DNS server that I configured badly but I don't really know.

 

Sorry again and thank you in advance 



#15 +BudMan

BudMan

    Neowinian Senior

  • Tech Issues Solved: 93
  • Joined: 04-July 02
  • Location: Schaumburg, IL
  • OS: Win7, Vista, 2k3, 2k8, XP, Linux, FreeBSD, OSX, etc. etc.

Posted 03 June 2014 - 13:48

And why can you not just use the built in dns of pfsense, you can create host over rides for anything you want..  This would be the common setup for using pfsense..  Yes you would have pfsense forward to something for public dns like your isp or googledns, opendns, etc..

 

But for testing you can create whatever host records you need.. For example if you want www.google.com to resovle to 1.2.3.4 its a simple over ride.  While I love Bind, and it is the golden standard for dns - its not something you start using without some decent understanding of the underlaying principles of dns, etc..

 

I really would suggest you use pfsense built in dns..

 

C:\Users\BudMan>ping www.google.com

Pinging www.google.com [1.2.3.4] with 32 bytes of data:
Control-C
^C

 

pfsensednssetuphost.png