topic Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login in Unleashed

Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

getcom — Fri, 20 Oct 2023 21:42:38 GMT

Hello all,

on a test system we try to integrate the pfSense captive portal into Ruckus unleashed and ran into issues.
I just explain below what we have done and what is the issue with that setup.

Maybe somebody can enlighten me.

On pfSense we have done following:

Adding a VLAN 100 on top of a physical link:

Creating a new interface GUESTNET on this VLAN with a static IPv4 address with CIDR 24:

Adding a firewall rule for the GUESTNET with full access for testing:

Enabled DHCP on GUESTNET with a range, no limitations, rest is default:

Adding a Captive Portal zone getcom_Guest_Net on interface GUESTNET with max 100 concurrent connections and a idle time of 1440 minutes, customized login page with terms and conditions and SSL enabled server name plus letsencrypt wildcard certificate:

Creation of a Voucher list:

Created a host override entry in the DNS resolver for the virtual server name:

The letsencrypt cert is working for all services and with this we have no issue here.

Cisco VLAN setup: all stacking ports/LACP ports/PoE ports for Ruckus APs are trunk ports.
VLAN 100 was added into the VLAN setup.

On Ruckus:

Created a SSID / WiFi Network with a Hotspot Service and added VLAN 100, Access Control, Radio Control, Others is default:

Hotspot Service has a redirection URL for unauthorized users to https://guestlogin.getcom.de:8003/index.php?zone=getcom_guest_net which is only reachable from VLAN 100:

On iOS or Android client:

After selecting the new WiFi "getcom guest net" the login page is popping up, you can type in a Vouche code, accept the terms and conditions and press the login button. Then it tells you you are connected but nothing else is happening. It stays on this side. iOS and Android is telling you that you are not connected to the internet.
It looks like a name server issue, but if I connect to the pfSense I can nslookup over the GUESTNET interface.

If I check the client status it is telling me it is unauthorized:

The question is, how Ruckus unleashed is getting the information that the client is authenticated?

Thanks for reading this post...

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

sanjay_kumar — Sun, 22 Oct 2023 01:22:02 GMT

Hi @getcom

The config looks fine, but the client is authenticated but Unleashed (Controller) does not know about it from the Captive portal.

You need to have POST configured on the pdSense which tells to the Unleashed about the client authorization.
Then the Auth status for the client on the Unleashed changes from "Unauthorized" to "Authorized".

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

getcom — Thu, 26 Oct 2023 01:21:04 GMT

Hello Sanjay,

Thank you for your answer.

Which POST URL has to be requested on pfSense?

Thank you in advance.

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

getcom — Thu, 26 Oct 2023 03:05:07 GMT

I found following:

https://${sip}:9998/login
http://${sip}:9997/login

Where ${sip} is the FQDN of the master AP.

Same result: blank page, user is still unauthorized.

Another documentation tells me to replace /login with /SubscriberPortal/hotspotlogin

Then I got the message to enable EjsErrors in the browser.

Is there an additional documentation to the current 200.14 release where I can read that?
All what I got was either missleading, outdated, wrong, not working or dead documentation links. Additionally I could not read anything about this topic, so lots of information, nothing new,, but without interesting content.

Maybe somebody ot the quality people should check this...

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

sanjay_kumar — Thu, 26 Oct 2023 04:14:47 GMT

Hi @getcom

The POST URL is correct. But we should also look into the post parameters which will be submitting to the Unleashed. The Post parameters are something like this, no need to edit anything but pfSense should use this format and return the values accordingly. If you still have issues, then you can open a support case so that we can assist you on this.

username=${USERNAME}
password=${PASSWORD}
client_mac=${client_mac}
uip=${uip}
url=${RETURN_URL}

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

getcom — Thu, 26 Oct 2023 08:02:55 GMT

Does it need username and password?

The Captive Portal is configured to use vouchers because this type of WLAN is for guest users only, so no username/password is needed here.

The voucher could be the password. As username I could use the MAC address without colon.
I will test this settings and will come back.

Re: Unleashed R610/T610 and captive portal from pfSense: No internet access after Voucher login

sash — Tue, 26 Nov 2024 19:00:41 GMT

After struggling to get authentication working on my ruckus unleashed r770 and pfsense (I could not get pfsense to send post request back to ap that client is authenticated) I decided to just update hot spot walled garden settings to allow basically everything through. So even though clients appear unauthorized in unleashed, they have internet access and captive portal works as expected.