After upgrading from PacketFence 15.0 to 15.1, the sponsor-based guest activation flow breaks when the sponsor accesses the activation link from the management network.
Root cause: The 15.1 upgrade regenerates iptables rules and only adds port 443 (HTTPS) ACCEPT rules for registration/internal interfaces (eth0.201, eth0.203), but not for the management interface (eth0.150). Port 1443 (admin UI) is correctly added for the management interface. This means sponsors on the corporate/management network cannot reach https://<hostname>/activate/email/sponsor/<code> on port 443, even though the admin UI on port 1443 works fine from the same network. Impact: Sponsor activation links silently fail — the HTTPS connection is dropped by the firewall. The sponsor sees a timeout or "connection not secure" error. Guests are never approved. Affected version: 15.1.0 (ZEN image, Debian 12) Workaround: Add the missing rule manually: # Immediate fix iptables -I INPUT -i eth0.150 -p tcp --dport 443 -j ACCEPT # Persistent fix echo '-A input-management-if -p tcp --dport 443 -j ACCEPT' > /usr/local/pf/conf/iptables-input-management.conf.inc Expected behavior: The iptables template (iptables.conf.tt) should include port 443 on the management interface, matching how port 1443 is handled. Thanks, - Arun
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
