A Captive Portal allows you to force authentication, or redirection to a click through page for network access. This is commonly used on hotspot networks, but is also widely used in corporate networks for an additional layer of security on wireless or Internet access.
OPNsense’s unique template manager makes setting up your own login page an easy task. At the same time it offers additional functionalities, such as:
Different zones can be setup on each interface or multiple interfaces can share one zone setup. Each Zone can use a different Captive Portal Template or share it with another zone.
Secure authentication via HTTPS or splash-only portal with URL redirection to a given page Different sources can be used to authenticate a user in a zone:
OPNsense’s Captive Portal has an easy voucher creation system that exports the vouchers to a csv file for use with your favorite application. The export allows you to print vouchers by merging them with your Microsoft Word or LibreOffice template and create a good looking handout with your logo and company style.
Connection can be terminated after the user has been idle for a certain amount of time (idle timeout) and/or force a disconnect when a number of minutes have passed even if the user is still active (hard timeout). In case a user reconnects within the idle timeout and/or hard timeout no login is required and the user can resume its active session.
The Built-in traffic shaper can be utilized to:
MAC and IP addresses can be white listed to bypass the portal.
Through the integrated REST API the captive portal application can be integrated with other services. See: Use the API
The Administration menu offers access to zone configuration and template management.
When creating a zone, a couple of options are available which we will try to explain briefly in the grid below:
Enable the zone, which will install a network trap on the interfaces specified
Read-only sequence of the configured zone
Interfaces which should be guarded by this captive portal
Select interfaces from which to allow inbound (stateful) traffic. This can be convenient if the zone in question contains machines/servers which should be accessible from other networks attached to this firewall.
Select an authenticator specified in System ‣ Access ‣ Servers
Always send accounting requests
[RADIUS only] This will make the captive portal always send accounting requests, rather than just when there is a need for accounting (e.g. when there is a daily session limit).
Enforce local group
Restrict access to users in the selected (local)group, to validate group membership, see System ‣ Access ‣ Groups
Idle timeout (minutes)
Clients will be disconnected after this amount of inactivity. They may log in again immediately, though.
Hard timeout (minutes)
Clients will be disconnected after this amount of time, regardless of activity. They may log in again immediately, though.
Concurrent user logins
If this option is set, users can login on multiple machines at once. If disabled subsequent logins will cause machines previously logged in with the same username to be disconnected.
Certificate to use on the captive portal login system. Leave empty for HTTP only.
Hostname (of this machine) to redirect login page to, leave blank to use this interface IP address, otherwise make sure the client can access DNS to resolve this location. When using a SSL certificate, make sure both this name and the cert name are equal.
Avoid authentication for addresses and subnets specified in this list
Allowed MAC addresses
Avoid authentication for MAC addresses specified in this list
Extended pre auth data
Offer extended data to the login template before authentication (mac addresses for upstream use).
Template to use for the login page, specified in the templates tab.
In the templates tab you can manage your templates, the default template can be fetched using the button in the bottom right corner.
The file offered is a standard zip file, which can be unpacked locally and modified to your needs, the new contents can be saved into a new zip file and uploaded in a new template ( )
Basic Real Time Reporting is Integrated using the sessions menu, this shows the following information for each zone.
Here you can create new vouchers for all voucher servers configured in System ‣ Access ‣ Servers
To setup a hotspot controller for business or hotel usage see: Setup a Guest Network
© Copyright 2016-2024, Deciso B.V.
