Problems with pfsense's captive portal

[Wellan]

Hello,

 

I'm a student and have to configure a captive portal for my project using pfsense.

 

My project is to configure a '' WAN network '' but on a private lab. For that, I need to configure a UNREAL Tournament game server on a DMZ, and the clients are separated from it by another router and can access it in order to play it.

 

 

It's simpler with a picture so the network I have is the following : 

 

 

  

 

 

 

 

So, what I want to do, is telling the clients that as long as they are not authenticated by the captive portal, they can't access to the network and therefore they can't access the game.

 

The problems are : I dont have a dedicated machine to run pfsense so I have to run it on VMs, and my all network doesnt have internet access.

 

I've managed to do this so far : 

 

 

 

NIC1 is my WAN interface and NIC2 is my LAN interface.

 

I can access the webConfigurator.

But from the LAN I can't ping the WAN interface.

 

THe LAN interface is setup as 192.168.1.1, DHCP Disable because I have my own DHCP server on the ROUTER 1

 

The WAN interface is setup statically as 192.168.10.2 and upstream gateway is 192.168.10.1.

 

I'm pretty sure the problem is from this WAN interface setup but I don't know how to fix it really so some help would be nice.

 

Thank you

 

 

 

 

 

 

 

 

 

 

 

 

 

[+BudMan MVC]

"and my all network doesnt have internet access."

 

What does this mean - you clearly have internet.. Since you posted this?

 

What does the internet have to do with anything if "your" running the game server?  This could be all done on vm..  So both routers are pfsense?  Everything even the clients could be vms

 

You show 2 routers, and your pfsense vm?  So there are 3 routers?  So this router1 and router2 and the game server all reside in physical?

 

And the host your on is on this 192.168.10.0/24 network?  And your clients that need to get to the game server are going to be physical or vms?

[Wellan]

This means, my host machine has internet access but I can't allow VMs to have the access because this is an university network with so much restrictions.

 

No both routers are ciscos, the only reason I'm using pfsense is to do the captive portal.

 

Kinda hard to explain but I hope it's understandable.

 

 

And yeah everything is physical except the clients who plays the game from Virtual Machines and the pfsense 

[+BudMan MVC]

Is your host connected to this switch that is the 192.168.10.0/24 network?  From the drawing its not.

 

You have a line from the 192.168.10.0/24 switch to pfsense -- but to what?

 

You say your lan can not ping what wan?  Pfsense 192.168.10.2?  Can pfsense ping 192.168.10.1?

[Wellan]

The host machine is not connected to the 192.168.10.0/24 network because I can't touch any ethernet interfaces -.-

 

I forgot on the drawing that the VMs are connected to the switch, all of them.

 

Also I need to know, with my setup , the VM clients should have an IP address like 192.168.10.x with 192.168.10.1 gateway or 192.168.1.x with 192.168.1.1 gateway ?

 

Sorry i'm new to this and really confused.

 

When my VM client has the address 192.168.10.x I can ping the WAN interface but not the lan and vice-versa.

 

Pfsense can't ping 192.168.10.1

[+BudMan MVC]

"The host machine is not connected to the 192.168.10.0/24 network because I can't touch any ethernet interfaces -.-"

 

Then how and the F is pfsense suppose to be able to talk with 192.168.10.1 ??  So that it can then talk to the game server??  Magic??

 

So you have no wire that runs from this switch to the host box that pfsense is running vm on?  Then how do you show a wire from that switch to pfsense??

 

The host that is running your VM software, that pfsense is a vm on has to have a physical connection to that switch 192.168.10.0/24 or it is not possible for pfsense to be connected to that network - yet you show a line..  Your pc does not have to have an IP in that network.. But it needs a physical connection so that your vm can connect.

 

what are the current connections on your host machine?

[+BudMan MVC]

Here like this

 

 

BTW that 172.108 is a public IP space.. rfc1918 space that starts with 172.16-31.x.x

 

BTW why are you doing nat on the other routers?  Are you not just pretending those are internet services - the nat is of no point when everything is rfc1918 space..  Is that really 172.108 public IP space?

[Wellan]

Ok that was pretty stupid from me. I did the config with my personal laptop, which means I don't have internet access though :

 

WAN Interface : Bridged : Configured by DHCP ( because the ROUTER 1 does DHCP server ) : address 192.168.10.7 , gatewway : 192.168.10.1.

                                                                                                                       

LAN Interface : Internal network intnet : 192.168.1.1. 

 

so pfsense can now ping 192.168.10.1. 

 

Although, from my client VM which is setup as 192.168.10.8 with 192.168.10.1 gateway. The VM is on my personal laptop and is in Internal network intnet.

 

When i try to ping the WAN interface of pfsense ( which is now 192.168.10.7 ) it says " Destination host unreachable. "

 

So now, is this a route problem or something else ? I'm so lost with VMs

 

( I also tried with VM setup as 192.168.1.8 and gateway 192.168.1.1 , because it makes more sense, and it says Request timed out )

 

 

EDIT : Didnt see your last post, 172.108 is a public space but the lab where i'm working is like isolated from the rest so i can put any IP addresses I want, this part will actually be a DMZ later on

[+BudMan MVC]

"172.108 is a public space but the lab where i'm working is like isolated from the rest"

Still VERY VERY BAD!!! Practice to use external public IP space that is not owned by you on your network. There is plenty of rfc1918 space - there is no reason to use public IP space that is not owned you on your own network. And even if owned by you, using it what is clearly a private network makes for confusion.

Now I currently don't show any whois for 172.108, the 172.16/12 is rfc1918, but for example 172.0/12

NetRange: 172.0.0.0 - 172.15.255.255

CIDR: 172.0.0.0/12

OrgName: AT&T Internet Services

You should not be using this address space - it is a VERY BAD habit to get into pulling address space out of thin air and using it.

Ok if the router for 192.168.10.0/24 is handing out dhcp - you can not just use static.. That could cause all kinds of problems (how do you know there is not another device using that IP?). In your vm software if you bridge physical interface that is connect to this 192.168.10.0/24 network, your physical machine should get an IP. And then the virtual machines with interfaces on this network should also get an IP from the dhcp server on this network. Since the VM virtual nic bridged to your physical would have its own mac.

Now you mention this is school and you can not connect vms to the internet? Who owns this router for the 192.168.10.0/24 network and this switch. If it is running any sort of nac or nap, port security - its possible that only the mac it first sees on a port is allowed an IP, etc. Or registered macs can get an IP, etc.

In a nutshell. On your pfsense vm, on its wan interface that is bridged to your physical interface connected to the 192.168.10.0/24 network - you should be able to set it to dhcp and get a IP. If it doesn't then your never going to get this to work. And you need to contact who admins that router, etc. If pfsense can not talk to its wan gateway - then no vms you put behind it would be able to talk out the wan, etc.

If your physical host can ping to the 192.168.10.1 router - then your pfsense wan via dhcp should also be able to ping this 192.168.10.1 address.

[Wellan]

Hm ok thanks for all the answers.

 

With all your help I managed to make it work so thanks a lot ! 

[+BudMan MVC]

Great to hear! So was pfsense your choice, or was that what the class is using - curious?

[Wellan]

Hm actually I had to find a free captive portal solution , considering most of the computers in the lab are using windows I thought of Firstpot but it was not free and then I found pfsense which seemed pretty simple to use. Then my supervisors agreed with that solution even if they didn't know pfsense can be used as a captive portal lol

[+BudMan MVC]

Nice -- so lets hear about that A when you get it ;)

[Wellan]

Well, the project is not finished yet and I have another problem and I don't know how to fix it again -_-

 

So, once I did the captive portal and radius everything works fine if I have internet, but considering in my test lab I don't have internet, I can't use the ISP DNS so the redirection to the captive portal does not work.

 

That's why I installed the bind service. I configured it like this http://ejnetwork.wordpress.com/2014/01/17/blocking-domains-with-pfsense-using-bind/.

 

I am really new to DNS configurations and I still don't know if it is possible to redirect every http or https request to the captive portal. For now if a user enter an IP address in the URL I am able to redirect it but if he types in any domain name like "rjwiepjpweihgpwerihgew" for exemple it doesn't work.

 

So I think it's coming from the DNS server that I configured badly but I don't really know.

 

Sorry again and thank you in advance 

[+BudMan MVC]

And why can you not just use the built in dns of pfsense, you can create host over rides for anything you want..  This would be the common setup for using pfsense..  Yes you would have pfsense forward to something for public dns like your isp or googledns, opendns, etc..

 

But for testing you can create whatever host records you need.. For example if you want www.google.com to resovle to 1.2.3.4 its a simple over ride.  While I love Bind, and it is the golden standard for dns - its not something you start using without some decent understanding of the underlaying principles of dns, etc..

 

I really would suggest you use pfsense built in dns..

 

C:\Users\BudMan>ping www.google.com

Pinging www.google.com [1.2.3.4] with 32 bytes of data:
Control-C
^C

 

 

[Wellan]

I use bind because I have basic linux knowledges and the point of my project is to know more about this, my supervisors just said " use bind " so I did lol

 

THe only point of that is actually this :

 

A client will access our game server, but he can't access it as long as he doesn't authenticate himself on the captive portal.

 

So i saw that on BIND I can modify the file /etc/hosts and tell him like this : " 172.108.10.2 gameserver "

 

So then, if i try to connect onto 172.108.10.2, does the captive portal webpage is supposed to pop ?.

[+BudMan MVC]

you would not be editing any /etc/hosts file in bind.. Where did you see that?

/etc/hosts is a local file for name resolution - has nothing to do with bind at all.

BIND is a recursive or authoritative name server.. Or both.. If all you want is a host to resolve something.domain.tld to some IP then sure you could edit on linux the /etc/hosts file - or on windows you could do the same thing under C:\Windows\System32\drivers\etc there is hosts file you could edit.

Not sure what you think that has to do with a captive portal.. Captive portal can require you to auth yes, but it redirects where ever your going to the "portal" part.. Does not matter if your going to www.google.com, www.neowin.com or whatever.. The captive portal redirects wherever your trying to go to the portal.. Then once you auth, then it lets you go to where you were starting to go. Or some other landing page, etc.

Where do you want your client to go, your game server? What is the fqdn of this name server, and what are you using for local dns so that it resolves? I would assume your systems are using pfsense for dns.. Since this is how it works out of the box and is the common 99.9% of the time setup.

If you are pointing your client to something else for dns, then sure any FQDN you want to go to be it on the internet or you local network should resolve. If your not using local dns, and you need your client to resolve something for a local type fqdn, something.foo.tld then sure you could use a host file.

[Wellan]

Oh ok i definitely didn't understand a damn thing ahah thank you.

;

Yes my client needs to go on my game server. His fqdn is GameServer-HP. I wanted to use the pfsense bind package as a local DNS to resolve it.

 

But if i understood everything correctly, which I am really not sure, if the clients wants to connect to the gameserver he will be redirected to the captive portal webpage if I set up the host file ? I don't even need a local DNS ??

 

I'm really sorry for all these questions and I'm really grateful for all the help budman thank you !

[+BudMan MVC]

Why would you need bind on pfsense, unless you were going to do something really fancy like zone xfer, etc.. Bind is way over the top for resolving a fqdn to an IP. The builtin dnsmasq can do this with a simple host override.

gameserver-hp is not a fqdn btw. gameserver-hp.something.tld would be a fully qualified domain name.

To be redirected your host doesn't have to resolve anything, you could go http://ipaddress and it should be redirected to the captive portal. If you want to go http://gameserver-hp that resolves to ipaddress on your box that is fine. But it has little to do with the redirection mech of a captive portal.

does not matter where you try to go, the captive portal redirects you to its landing page. Once you auth, put in payment, use a voucher, etc. And the captive portal accepts it then it will send you on to where you really were wanting to go. Does not matter if you can really get there or not. The captive portal does not need to even be able to resolve this.

BTW your trying to hit a http or https site right, running some game software that connects to some gameserver port in some game software is not going to get redirected. The captive portal is going to only redirect http or https requests.