captive portal

[Alessandro Masotti]

Hi, i transfer here another post for more clarity

Hi, I'm interested in the captive portal function, you can tell me how to link openwisp2 to pfsense?
I had looked long ago pfsense but openwisp has better management of multiple AP

Ciao, sono interessato alla funzione di captive portal, sai dirmi come collegare a grandi linee pfsense con openwisp2?
Avevo guardato tempo fa pfsense ma openwisp ha una migliore gestione di più AP

replay

First thing you have to do, is to to configure the layer2 VPN (OpenVPN tap or bridge mode) on PfSense so that users are blocked by the captive portal.

Then you have to configure a way for your users to authenticate, maybe to begin you could just use a simple authentication that requires "accepting terms and conditions". I'm over simplifying here, I don't remember by memory all the exact steps to implement this. I'm sure there are guides that will help you to do this on PfSense.

Once you are done with PfSesnse and you are sure it works, go on your OpenWISP2 instance and proceed this way:

- create a new VPN Server, mirror the same configuration you put on PfSense, import the Certification Authority and Server certificate from PfSense (copy and paste the x509 data into the appropiate fields).

- create a new template of type "VPN-client", select the new VPN, leave the configuration empty and save (it will automatically generate a generic client configuration for you), then set this template as "default" so it will be enabled by default on all newly registered devices

- try registering a new device, see if it works, if it doesn't you should check the vpn log for errors; you can also post the problem here and I'll try to help you out.

Federico

 

You think is possible to use as captive portal wifidog like pfsense?

I'm trying to use it on debian 8.7.

[Federico Capoano]

Hi Alessandro,

I am not 100% sure because I have never used wifidog, but we did use our own captive portal implementation (owcpm) under linux until a few years ago (which used iptables under the hood), in that setup we used to install openvpn in layer2 mode (tap) on the same host of OWCPM.

As long as the captive portal accepts layer2 vpn connections from access points and has a firewall that redirects unauthenticated users to a captive page with the login form or or an "accept terms and conditions" checkbox (or other shiny authentication mechanisms like social login) you will be fine.

I hope it helps.
Looking forward to hear if you make it with wifidog.

Fed

--
You received this message because you are subscribed to the Google Groups "OpenWISP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openwisp+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Alessandro Masotti]

hi, I try but it seem that wifidog doesn't have radius and open vpn.

when I run the synchronization between pfsense and openwish2, what is the program that controls access?

I need to use it in a remote way, i have 18 buildings that i need to connect to a server stored in a office.

[Federico Capoano]

I didn't understand your question very well, could you rephrase it please?

There's another open source linux captive portal you may want to try: https://coova.github.io

--

[Alessandro Masotti]

ciao,
grazie per la dritta di coova.

Una volta configurati openwisp e pfsense con openvpn, quale dei due software segue e gestisce l'autenticazione degli utenti?
Faccio questa domanda perchè il server (quello/i con openwisp2 e pfsense) va installato in un ufficio per gestire 18 alberghi, dove installerò gli hotspot.

Hello,
thanks for the tip of Coova.

Once I configured openwisp and pfsense with openpvn, whichever software monitors and manages user authentication?
I ask this question because the server (with openwisp2 and pfsense) must be installed in an office to manage 18 hotels, where I will install hotspots.

[Federico Capoano]

Let me summarise:

PfSense is a basically a firewall that can block or allow a device to use the network or be redirect to an authentication page.

Who decides if a user is authorized or not? That's RADIUS job, for this we use freeradius, you will have to configure PfSense to talk to RADIUS.

OpenVPN in layer2 mode is used to bridge the wifi to the firewall, so you can have a central captive portal, otherwise you would need to install a captive portal on each device.

Federico

--