pfSense 2.0 RC1 – Captive Portal with RADIUS Authentication and Vouchers


After we have setup Captive Portal and customized the pages in the previous posts. Now let’s wrap it up with the other two authentication methods. In this article we are going to configure RADIUS authentication for users, and create Vouchers for our Guests.


In the previous post pfSense 2.0 RC1 – Configure Captive Portal for Guests, we used Local User Manager for authentication. But managing users in multiple systems can be dull task. For that reason we could provide our Users with a way to use their Active Directory user accounts to authenticate against the Captive Portal.

For our Guest We can create one Guest user account in Active Directory, but a better solution would be to provide them with one time use Voucher, that can be dispose of at the end of day.


The only change from our previous setup is the use of one Windows Server 2008 R2, with Active Directory Domain Services and Network Policy Server roles.


Network Policy Server (NPS) aka RADIUS Server, Configuration

We can reuse the setup of NPS from OpenVPN with RADIUS authentication on pfSense 2.0 RC1, up until the pfSense configuration. So I would not duplicate the steps here.

On the pfSense side:

Now go to the Services > Captive Portal

On the Captive Portal leaf, scroll down to the Authentication Section.

As Authentication choose RADIUS Autentication

Primary RADIUS server, IP address –

Enter Shared Secret

Optionally if you wish tick the send RADIUS accounting packets check box.

And under RADIUS options, RADIUS NAS IP Attribute, select the LAN interface. I presume that behind this interface is your RADIUS server.

Save the configuration.

Vouchers Configuration

The first time you Enable the Vouchers, a pair of RSA keys are generated for you automatically.

The pre generated RAS keys are 32 bits.  For now we will use the default. But if you want to create 64 bit keys, you can check our the article Captive Portal Vouchers.

For the Save Interval, the default value is 5 minutes, but I do not want the state of the vouchers to be kept in my configuration file, so I’ll change it to 0. Leave the rest of the fields to default values. Save the configuration.


No let’s generate some vouchers, in the Voucher Rolls section, click on the “+” sign.

On the new page, enter

Roll# – 16, Minutes per Ticker – 460 (8 hours), Count – 10 this is the number of vouchers generated. You can put some comment for reference. Save it.

Upon return to the Vouchers leaf, click on the circle with “i” in it to export the list of vouchers.

The result should look similar to this:


Open a browser on a computer connected to the Guest interface of pfSense, enter a web address, and you should be presented with the Captive Portal page.

For RADIUS test , enter a user name and password, from the Active Directory, and you should successfuly log in.

For test of the Voucher system, copy one of the rows from the csv file, and paste it in the Voucher field.

The web address that you typed should load, and you will have access for the next 8 hours.

On the web GUI, you could check that the user is successfuly connected.


Aggregated all topics related to Captive Portal in pfSense Documentation

Specific article for the Vouchers

m0n0wall documentation of the Captive Portal, can be used for cross references.


During the last three posts we look at the basic configuration of Captive Portal in pfSense 2.0 RC1. Also we customized the Portal pages, and used different authentication methods available. Using this feature of pfSense you can safely provide Internet access to your users and guests. Of course there are many other options that we have not covered, but they are left for future posts.

Thank you for reading, and I hope it was helpful.

OpenVPN with RADIUS authentication on pfSense 2.0 RC1

This is the last post in the series of authentication alternatives for OpenVPN in pfSense 2.0 RC1.

In the previous posts we looked at the local database of pfSense and Active Directory. Now we will use Remote Authentication Dial In User Service (RADIUS) instead. Again we will authenticate our users against Active Directory, as domain user accounts.

For that purpose we need to add Network Policy and Access Services server role to our Windows Server 2008 R2.

From the Role services select only the Network Policy Server. We don’t need any of the other services.

After the successful installation, open the Network Policy Server console. Under RADIUS Clients and Servers, create new RADIUS Client.

Take note of the Friendly name of the client, we will use is later in the Network Policy. In our case pfSense.

Enter the LAN address of pfSense, and Shared secret.

Leave the default configuration on the Advanced leaf.

We won’t configure additional Connection request Polies.

A new Network Policy is needed, because the default Connections to other access servers block requests send by pfSense.

Enter Policy name of your preference, and leave the default Type of network access server to Unspecified. Otherwise your authentication request will be denied.

For Condition, let’s add the Client Friendly Name. In our case the client is our pfSense router. Type in here the Friendly name that you used in the RADIUS Client configuration. In our case pfSense.

On Specify Access Permission, leave Access granted.

As Authentication Methods add Unencrypted authentication (PAP, SPAP). The explanation follows later.

Leave constraints to defaults, if you don’t have some specific requirements. The same is valid for Settings too.

All done

On your pfSense go to System > User Management > Servers add new.

Enter descriptive name of your liking. As type select Radius. Enter the IP address of the server that we just configure to be our RADIUS server. Under Services offered, leave the default Authentication and Accounting. Take note that we have not configured accounting on our NPS service, but you could easily enable it. The default ports are fine. If you have Windows Firewall, or some other kind of firewall service running, make sure required ports are open.

It is time to go to your OpenVPN Server configuration and select our new RADIUS provider as Backend for authentication.

Now if you make test connection with test user, take a look at the security logs on the RADIUS server.

You will see RADIUS Client Friendly Name match out configuration, and which Policies were used,and that the Authentication Type is PAP, that is why we added it to the policy earlier.

That’s it.