INTEGRATION
pfSense Captive Portal
Integration
The built-in pfSense captive portal gets guests online. What it does not give you is a branded welcome screen, verified guest identity or a guest database you can market to. Useroam adds that on top of the pfSense you already run.
What the pfSense integration does
Useroam Cloud takes the guest passing through the pfSense captive portal, presents a welcome page carrying your brand, verifies their identity and keeps their access records. Setup has two parts: the custom captive portal page option is enabled on the portal zone and the page downloaded from the Useroam panel is uploaded to it, and the Useroam RADIUS server is registered as the authentication backend. Guests sign in with a one-time code over SMS or WhatsApp, a voucher, a room number and surname in hotels, or a username and password, and the verified mobile number becomes the RADIUS username for the session. Per-user download and upload speed, data quota, session timeout and idle timeout follow the group defined in the panel and are returned in the RADIUS reply, while interim accounting keeps usage live in the panel. Access records are forwarded from pfSense over remote syslog, signed daily with an RFC 3161 timestamp from an accredited timestamp authority and retained for the period local regulation requires, with no on-site logging server and no extra hardware.
How the integration works
Custom portal page
The custom captive portal page option is enabled on the pfSense portal zone and the page downloaded from the Useroam panel is uploaded; guests reach the Useroam login screen through it.
Portal and walled garden
A branded welcome page is designed in Useroam Cloud; the portal and verification services are added to the walled garden so they stay reachable before login.
RADIUS authorisation
The guest verifies their identity over SMS or WhatsApp; the verified mobile number is checked against the Useroam RADIUS server registered as the pfSense authentication backend. Per-user speed, quota, session and idle timeouts are returned in the RADIUS reply.
Syslog and signed logs
Remote logging on pfSense is pointed at Useroam and logging is enabled on the guest rule; access records are signed daily with an RFC 3161 timestamp from an accredited timestamp authority and retained for the period local regulation requires.
The welcome screen carries your brand
The captive portal is designed in the panel with your logo, colours and background image, and published with a live per-device preview. The same screen doubles as a placement for your campaigns and announcements.
What to know on the pfSense side
- Supported from pfSense CE 2.7.0 and pfSense Plus 23.05 onwards, where RADIUS-supplied bandwidth limits are applied correctly.
- On the portal zone, RADIUS authentication (PAP), interim accounting, per-user bandwidth and traffic quota are enabled, and reauthentication is left off.
- The Useroam address is added to the captive portal allowed-IP list and HTTPS login is kept off.
- OPNsense is out of scope for this integration: its portal and request format differ and need a separate integration.
A marketing layer on the same network
The pfSense integration is not only about getting guests online: every guest who connects becomes permissioned data. The Bumerang modules run from the same panel, with no additional deployment.
Campaigns
Welcome and win-back flows go out automatically over WhatsApp/SMS, and the return visit is measured in the panel.
Surveys
Happy guests are routed to a Google review, unhappy feedback comes to you — your reputation is fed by the WiFi.
QR Menu
Multilingual menu and order-from-table, with reporting on which item drew interest and when.
Other integrations
Useroam is vendor-agnostic: even when sites run different devices, everything is managed from one panel.
Your hardware is ready. Let's open the guest network.
Send us your model and we will plan the integration steps together and open a demo environment the same day.
Frequently asked questions
Do I need extra hardware or a licence for pfSense guest WiFi?
How are access logs handled?
Which versions are supported, and does it cover OPNsense?
Related guides
Firewall Guest WiFi Integrations: Sophos, FortiGate & More
A brand-by-brand look at how guest WiFi authentication and logging integrate with Sophos, FortiGate, Palo Alto, Zyxel and MikroTik — and how to choose.
What Is a Captive Portal and How Does It Work?
The captive portal is the sign-in screen guests see when they join your WiFi. Here is how it works, what it does for your business and why cloud-based portals win.