DOCUMENTATION

OPNsense Integration

Integrating Captivo with the OPNsense Captive Portal

Requirements: OPNsense 23.1+ and an active LAN/WLAN interface
For the Active Sessions list to work: enable RADIUS accounting (port 1813) AND make the device send periodic accounting updates. Captivo treats a session as live while the device keeps signalling it; if only a start and a stop are sent, a guest who is still online drops off the list after 10 minutes while the device's own screen still shows them. The setting is usually called Interim, Accounting Interim Update or Update Interval; one minute is a good value.
Bandwidth limit: The OPNsense Captive Portal does not apply the WISPr-Bandwidth-Max-Down/Upattributes received over RADIUS. Even if you set a download/upload speed in your Captivo profiles, OPNsense ignores these values.

Workaround: There are two ways to limit speed on the OPNsense side:
  • Services → Captive Portal → Zone → Edit → the Bandwidth fields
  • Traffic shaping setup via Firewall → Shaper
If you use pfSense, the speed limits in Captivo profiles apply without issue; this limitation only applies to OPNsense.

1Defining the RADIUS Server

First, define the Captivo RADIUS server in OPNsense:

  1. Go to System → Access → Servers
  2. Click Add
FieldValue
Descriptive nameCaptivo RADIUS
TypeRADIUS
Hostname or IPCaptivo RADIUS server address
Shared secretCopy from Captivo
Authentication port1812
Accounting port1813
To see live sessions in the Captivo dashboard, enable RADIUS accounting on the zone (point it at the same server, port 1813). Auth alone logs identity but not active-session stats.

2Creating a Captive Portal Zone

  1. Go to Services → Captive Portal → Administration
  2. Click + to add a new zone
SettingValue
EnabledChecked
InterfacesYour Guest or WiFi interface
Authenticate usingCaptivo RADIUS (the one we created)
Idle timeout15
Hard timeout480

3Template Settings

In Captivo, download the OPNsense template from Settings → Portal → Templates.

  1. Go to Services → Captive Portal → Templates
  2. Click + to add a new template
  3. Upload the file you downloaded from Captivo as-is — it is already a complete ZIP
The OPNsense download is already a ready-to-upload ZIP that contains index.html plus its CSS and assets. Do not extract it or re-zip only the HTML — that would break the template. (Note: OPNsense uses a single ZIP, whereas pfSense uses two separate HTML files.)

4Linking the Template to the Zone

  1. Go back to Services → Captive Portal → Zones
  2. Edit the zone we created
  3. In the Template field, select the template you uploaded
  4. Save and Apply

5Allowed Hosts

  1. Go to Services → Captive Portal → Allowed Hostnames
  2. Add the Captivo server domain
This step lets guests reach the Captivo server before authentication.

Troubleshooting

The template won't upload
  • Check that index.html is inside the ZIP file
  • The ZIP file must be smaller than 1MB
  • Do not use special characters in the file name
Can't establish RADIUS connection
  • Check the shared secret
  • Verify that ports 1812 and 1813 are open in the firewall
  • Ping the RADIUS server from OPNsense

For product-wide problems: The portal does not open · Sign-in is rejected · Sessions do not appear

Was this article helpful?