Captive portal: IPv6 support by swhite2 · Pull Request #9745 · opnsense/core

swhite2 · 2026-02-06T08:55:53Z

TODO: banner showing hostwatch disabled -> no ipv6 support

- Show IPv4 and IPv6 addresses in IP Address column - Aggregate traffic statistics across all IPs for a session - Add tooltip to display full IP addresses when truncated - Update accounting to include traffic from all associated IPs

…tack support - Resolved conflicts in captiveportal.inc: Use upstream's getValues() method while keeping IPv6 rules - Resolved conflicts in AccessController.php: Merged upstream's hostwatch dump with our IPv6 NDP fallback - Resolved conflicts in clients.volt: Use upstream's zone selection placement while keeping tooltip initialization - Resolved conflicts in pf.py: Preserved IPv6 protocol handling (0x86dd) and accounting methods - Resolved conflicts in db.py: Merged our aggregation logic with upstream's prev_* fields for counter reset detection - Resolved conflicts in cp-background-process.py: Adapted dual-stack MAC handling to use upstream's helper methods All IPv6 dual-stack functionality is preserved while incorporating upstream improvements.

fichtner · 2026-02-06T08:59:02Z

src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/ServiceController.php

+        $backend = new Backend();
+        $backend->configdRun('template reload OPNsense/IPFW');
+        $backend->configdRun("ipfw reload");


is this side effect a good idea? feels a bit too clever :)

I expected comments here ;)

To be honest this was the quickest win here, the IPFW reload is a requirement though, and missing since the re-introduction of it and I didn't spot any other obvious hooks in the right place.

for context: the spot where this code resided previously was cleaned up in d8519a0

Looks duplicate now, as in the following line both dnctl and ipfw are triggered when no argument is specified:

core/src/etc/inc/filter.inc

Line 179 in 36b17ad

mwexecf('/usr/local/opnsense/scripts/shaper/start.sh');

src/opnsense/mvc/app/models/OPNsense/CaptivePortal/CaptivePortal.xml

fichtner · 2026-02-06T14:01:49Z

src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/forms/dialogZone.xml

-        <label>Allow multiple client IPs</label>
-        <help>Allow a connecting client to use multiple IPs (bound to the same MAC). For IPv4, these can be virtual IPs on the client. For IPv6, this option is needed for maximum compatibility because a client may actively use multiple IPv6 addresses.</help>
+        <label>Client roaming</label>
+        <help>Allow a connecting client to use multiple IPs (bound to the same MAC) over the course of its session. For IPv4, these can be virtual IPs on the client. For IPv6, this option is needed for maximum compatibility because a client may actively use multiple IPv6 addresses.</help>


strictly speaking the more common term is "alias" for an extra address (as per ifconfig). Both could still be confusing. Perhaps we can remove the IPv4 explanation or change it to a minor note "This also affects IPv4."

Wouldn't that also allow login from multiple IPs? Didn't we have a setting for that? Concurrent something?

(if it's strictly tied to the MAC/DUID that's something else and please ignore me)

"roaming" keys clients (with IP aliases) to a MAC address, if they connect from a different device the "concurrent user logins" setting still applies, different MAC.

Monviech · 2026-02-06T19:53:37Z

src/etc/inc/plugins.inc.d/captiveportal.inc

+                            'to' => "<__captiveportal_zone_{$zoneid}>",
+                            'to_not' => true,
+                            'to_port' => $to_port,
+                            'target' => $intf . 'ip',


Is the rdr working in an IPv6 only network?

With the rdr now bound to the primary IPv6 address of the specified interface, yes :)

AdSchellevis · 2026-02-21T10:53:30Z

src/opnsense/service/templates/OPNsense/Captiveportal/lighttpd-zone.conf

-                    {% do item.update({'interface_hostaddr':conf_inf.ipaddr}) %}
+                {% if conf_key == intf_tag %}
+                    {# prefer IPv6 if available, fallback to IPv4 #}
+                    {% if conf_inf.ipv6 and conf_inf.ipv6|length > 0 %}


this looks highly suspicious, there is no interface.XXX.ipv6 in our configuration.

AdSchellevis · 2026-02-21T11:03:40Z

src/etc/inc/plugins.inc.d/captiveportal.inc


            foreach ($zone->interfaces->getValues() as $intf) {
-                // allow DNS
+                // allow DNS (IPv4 + IPv6)


I think we can just kill the whole comment, it doesn't add much to be honest

AdSchellevis · 2026-02-21T11:05:06Z

src/etc/inc/plugins.inc.d/captiveportal.inc

+                        ]
+                    );
+
+                    // Allow access to the captive portal (IPv4 + IPv6)


same is the case for this one I guess, the description is already pretty clear.

AdSchellevis · 2026-02-21T11:05:24Z

src/etc/inc/plugins.inc.d/captiveportal.inc

                }

-                // block all non-authenticated users
+                // block all non-authenticated users (IPv4 + IPv6)


AdSchellevis · 2026-02-21T11:14:16Z

src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/AccessController.php

                }
            }
+
+            // IP-based lookup failed - try MAC-based lookup for MAC-authenticated sessions


This whole block is a bit questionable in my opinion, list clients should be responsible for tracking the changes via the sqlite database. When we query specifically on mac here we might end with the situation where the frontend reports "AUTHORIZED", but in reality I'm still reflected to the login page for not being in the list yet.

If we do want to wait for the "accounting department" to be finished with the registration, we can make the frontend query again in the background to see if the "connected" state changed after 30 seconds or so. But this would be more a default template thing....

AdSchellevis · 2026-02-21T11:56:07Z

src/opnsense/scripts/captiveportal/lib/db.py

+            current_ips = {row[0] for row in cur.fetchall()}
+
+            # if identical (order-independent), do nothing
+            if current_ips == new_ips:


nice touch using a set here

AdSchellevis · 2026-02-21T11:58:26Z

src/opnsense/scripts/captiveportal/lib/db.py

+        - roaming IPs are cp_client_ips.ip_address
+        Returns a de-duplicated set[str] (order not guaranteed).
+        """
+        if isinstance(sessionid, bytes):


same as in update_roaming_ips(), how?

AdSchellevis · 2026-02-21T12:13:46Z

src/opnsense/scripts/captiveportal/lib/db.py

+        # Ensure primary IP is included for each session
+        for rec in sessions.values():
+            pip = rec.get('primary_ip')
+            if pip is not None and str(pip).strip() != '':


going further through the code, I notice a lot of "consumers" strip() their results, it feels a bit like we're either doing something wrong with storing the data or these are not needed at all.

AdSchellevis · 2026-02-21T12:23:10Z

src/opnsense/scripts/captiveportal/sql/init.sql

 create index cp_clients_ip ON cp_clients (ip_address);
 create index cp_clients_zone ON cp_clients (zoneid);

+-- multiple IPs per session


we might consider always calling init.sql so we can change the create table statements to create table if not exists and remove the create when not there yet code earlier.

AdSchellevis · 2026-02-21T12:26:49Z

src/opnsense/scripts/captiveportal/listClients.py

 args = parser.parse_args()

-response = DB().list_clients(int(args.z) if str(args.z).isdigit() else None)
+response = DB().list_clients(int(args.z) if str(args.z).isdigit() else None, True)


DB().list_clients(...,True) doesn't seem to have an actual meaning, so either the default None is an issue or adding the bool here was not needed.

agoodkind · 2026-02-22T16:15:08Z

Thanks for taking this over!

agoodkind and others added 6 commits January 2, 2026 18:16

Merge remote-tracking branch 'origin/master' into captive-portal-ipv6

6d0c140

captive portal: WIP for IPv6 support

9937de0

Merge remote-tracking branch 'origin/master' into captive-portal-ipv6

3fe3500

captive portal: limit hostwatch output and other small changes

ac2dc26

swhite2 requested review from AdSchellevis, Monviech and fichtner February 6, 2026 08:55

swhite2 self-assigned this Feb 6, 2026

swhite2 marked this pull request as draft February 6, 2026 08:56

fichtner reviewed Feb 6, 2026

View reviewed changes

clean up ipv6 localhost usage

e90249c

fichtner reviewed Feb 6, 2026

View reviewed changes

src/opnsense/mvc/app/models/OPNsense/CaptivePortal/CaptivePortal.xml Outdated Show resolved Hide resolved

comment not relevant anymore

f788e18

swhite2 mentioned this pull request Feb 6, 2026

Add IPv6 dual-stack support to Captive Portal #9575

Closed

swhite2 added 2 commits February 6, 2026 12:02

shorten this

9b545e2

captive portal: rename virtual IPs to 'roaming'

219e076

fichtner reviewed Feb 6, 2026

View reviewed changes

Monviech reviewed Feb 6, 2026

View reviewed changes

captive portal: fix and clean up session handling

d1ee6b7

swhite2 marked this pull request as ready for review February 11, 2026 13:50

swhite2 added 5 commits February 11, 2026 15:59

captive portal: simplify hostdiscovery output handling

43675dd

captive portal: no scope stripping needed

8be14b6

in fact, this documents itself

c6d526f

captive portal: some more cleanups

fe4748b

remove unused code

8297c7d

AdSchellevis force-pushed the master branch from b32c61a to 6cfd38c Compare February 12, 2026 09:02

AdSchellevis requested changes Feb 21, 2026

View reviewed changes

Conversation

swhite2 commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agoodkind commented Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

swhite2 commented Feb 6, 2026 •

edited

Loading