View source for Modern Guide: pfSense Captive Portal with FreeRADIUS & ACME

= Modern Guide: pfSense Captive Portal with FreeRADIUS & ACME =

'''Based on the Lawrence Systems Methodology'''

Reference Videos:
* [https://www.youtube.com/watch?v=hdHDCafeFdU pfSense Captive Portal with FreeRADIUS – Lawrence Systems]
* [https://www.youtube.com/watch?v=qlcVx-k-02E Quick and Easy Local SSL Certificates for Your Homelab – Wolfgang's Channel]

This guide focuses on a "production-ready" setup that minimizes browser errors (SSL warnings) on modern devices by using proper Let's Encrypt certificates and Split DNS. It also covers per-user bandwidth limiting and strict content whitelisting.

----

== Prerequisites ==

* '''pfSense Firewall:''' Version 2.4/2.5 or higher.
* '''Domain Name:''' You need a domain name (buy one or use DuckDNS).
* '''Guest Network:''' A dedicated interface/VLAN (e.g., 192.168.2.1/24) for guests.
* '''Packages:''' Install <code>freeradius3</code> and <code>acme</code>.

----

== Phase 1: WebGUI Configuration (Port Conflict Prevention) ==

# Navigate to '''System > Advanced > Admin Access'''.
# '''TCP Port:''' Change this to <code>5555</code>.
# '''WebGUI Redirect:''' Ensure "Disable webConfigurator redirect rule" is '''unchecked'''.
# Click '''Save'''.

----

== Phase 2: Free SSL Certificates (DuckDNS & Let's Encrypt) ==

'''The Problem:''' Modern browsers block "Self-Signed" certificates.
'''The Fix:''' Use DuckDNS (free) to get a valid certificate.

=== Step A: Get a Free DuckDNS Domain ===
# Go to [https://www.duckdns.org DuckDNS.org].
# Create a domain (e.g., <code>mywifinetwork</code>).
# Copy your '''Token'''.

=== Step B: Configure ACME on pfSense ===
# '''Install ACME:''' Go to '''System > Package Manager''' and install <code>acme</code>.
# '''Create Account Key:''' Services > ACME > Account Keys > Add.
#* Name: <code>LetsEncryptKey</code>
#* Server: Let's Encrypt Production
# '''Issue the Certificate:'''
#* Go to '''Services > ACME > Certificates'''.
#* Click '''Add'''.
#* '''Name:''' <code>CaptivePortalCert</code>
#* '''Domain name:''' <code>mywifinetwork.duckdns.org</code>
#* '''Method:''' DNS-DuckDNS
#* '''Token:''' Paste your token
#* Click '''Save''' then '''Issue/Renew'''.

----

== Phase 3: Split DNS Configuration ==

Ensure users resolve the domain to the local IP.

# Navigate to '''Services > DNS Resolver'''.
# Go to '''Host Overrides > Add'''.
#* '''Host:''' <code>mywifinetwork</code>
#* '''Domain:''' <code>duckdns.org</code>
#* '''IP Address:''' <code>192.168.2.1</code> (Guest Interface IP)
# Click '''Save''' and '''Apply Changes'''.

----

== Phase 4: Configure FreeRADIUS (Users & Bandwidth) ==

We will define three users with specific bandwidth limits.

=== 1. Interfaces & Client ===
* '''Services > FreeRADIUS > Interfaces:''' Add <code>*</code> for ports 1812 & 1813.
* '''Services > FreeRADIUS > NAS / Clients:''' Add <code>127.0.0.1</code> with secret <code>SecretPass123</code>.

=== 2. Create Users ===

{| class="wikitable"
|-
! User
! Username
! Password
! Bandwidth Down
! Bandwidth Up
|-
| '''Admin (Full Access)'''
| <code>adminuser</code>
| <code>adminpass</code>
| Unlimited (leave blank)
| Unlimited (leave blank)
|-
| '''Resident (0.1 Mbps)'''
| <code>resident</code>
| <code>resident123</code>
| 100 Kbps
| 100 Kbps
|-
| '''Guest (0.01 Mbps)'''
| <code>guest</code>
| <code>guest123</code>
| 10 Kbps
| 10 Kbps
|}

----

== Phase 5: Firewall Rules & Whitelisting ==

=== Step A: Define Admin Devices (Static IPs) ===
# Go to '''Services > DHCP Server > [Guest Interface]'''.
# Scroll to '''Static Mappings'''.
# Add your Admin Device's MAC Address and assign a specific IP (e.g., <code>192.168.2.10</code>).
# Repeat for all Admin devices.

=== Step B: Create Aliases (The Whitelist) ===
# Go to '''Firewall > Aliases'''.
# '''Create Admin Alias:'''
#* '''Name:''' <code>Admin_IPs</code>
#* '''Type:''' Host(s)
#* '''Content:''' <code>192.168.2.10</code> (and other admin IPs)
# '''Create Apps Alias:'''
#* '''Name:''' <code>Allowed_Domains</code>
#* '''Type:''' Host(s)
#* '''Content:''' <code>grab.com</code>, <code>lalamove.com</code>, <code>api.grab.com</code>, <code>api.lalamove.com</code>
# '''Create Messaging Ports Alias:'''
#* '''Name:''' <code>Messaging_Ports</code>
#* '''Type:''' Port(s)
#* '''Content:''' 3478 (WhatsApp/Messenger STUN), 5222 (WhatsApp/XMPP), 443 (HTTPS), 53 (DNS)

=== Step C: Apply Strict Rules ===
Go to '''Firewall > Rules > [Guest Interface]'''. '''Delete''' any existing "Allow All" rules. Create these rules in this '''exact order''':

{| class="wikitable"
|-
! Rule #
! Action
! Source
! Destination
! Result
|-
| 1
| Pass
| Single Host or Alias → <code>Admin_IPs</code>
| Any
| Admins bypass all blocks.
|-
| 2
| Pass (UDP)
| Any
| Port 53 (DNS)
| Everyone needs DNS to function.
|-
| 3
| Pass (TCP/UDP)
| Any
| <code>Allowed_Domains</code>, Port 443
| Allows traffic to Grab/Lalamove IPs.
|-
| 4
| Pass (TCP/UDP)
| Any
| Any, Port → <code>Messaging_Ports</code>
| Allows WhatsApp/Messenger calls.
|-
| 5
| '''Block'''
| Any
| Any
| Blocks YouTube, Social Media, general browsing for Residents/Guests.
|}

----

== Phase 6: Configure the Captive Portal ==

# '''Enable Portal:'''
#* Go to '''Services > Captive Portal'''.
#* Add Zone <code>GuestZone</code>, Enable it, select Guest Interface.
# '''Authentication:'''
#* '''Method:''' RADIUS Authentication
#* '''Primary Server:''' <code>127.0.0.1</code>, Secret: <code>SecretPass123</code>
#* '''Re-authentication:''' Checked (Every minute)
#* '''RADIUS Options:''' Check '''Use RADIUS per-user bandwidth attributes'''
# '''HTTPS Login:'''
#* '''Enable HTTPS:''' Checked
#* '''Host Name:''' <code>mywifinetwork.duckdns.org</code>
#* '''Certificate:''' <code>CaptivePortalCert</code>
# Click '''Save'''.

----

== Phase 7: Verification ==

=== Test Admin ===
* Connect with an Admin device (ensure it gets Static IP <code>192.168.2.10</code>).
* Log in as <code>adminuser</code>.
* Try YouTube. '''Result:''' Should work.

=== Test Resident ===
* Connect with a random phone.
* Log in as <code>resident</code>.
* Try Fast.com. '''Result:''' Speed capped at 0.1 Mbps.
* Try YouTube. '''Result:''' Blocked.
* Try Grab App. '''Result:''' Should load.

=== Test Guest ===
* Log in as <code>guest</code>.
* Try Fast.com. '''Result:''' Speed capped at 0.01 Mbps (very slow).