pfSense Xfinity Hotspot WiFi Sharing

User

Pfsense, how to connect to xfinity Hotspot and share that connection with the rest of my network devices, via wifi

Assistant

This is a complex networking setup. Xfinity hotspots present unique challenges in pfSense because:

1. **Xfinity requires web portal authentication** (captive portal)
2. **Standard WiFi adapters** typically can't do both client mode (connect to hotspot) and AP mode (share WiFi) simultaneously
3. **xfinity has usage policies** that may restrict router-based connections

Let me outline what's needed and verify your setup:

Assistant

{"content": "", "total_lines": 0, "file_size": 0, "truncated": false, "is_binary": false, "is_image": false, "error": "File not found: /etc/nginx/sites-enabled/faceblur.teksploits.com", "similar_files": ["/etc/nginx/sites-enabled/faceblur", "/etc/nginx/sites-enabled/time.teksploits.com"]}

Assistant

Tool 'shell' does not exist. Available tools: browser_back, browser_cdp, browser_click, browser_console, browser_dialog, browser_get_images, browser_navigate, browser_press, browser_scroll, browser_snapshot, browser_type, browser_vision, clarify, cronjob, delegate_task, execute_code, image_generate, memory, patch, process, read_file, search_files, session_search, skill_manage, skill_view, skills_list, terminal, text_to_speech, todo, vision_analyze, web_extract, web_search, write_file, x_search

Assistant

{"output": "00:03.0 Ethernet controller: Red Hat, Inc. Virtio network device\n\tSubsystem: Red Hat, Inc. Virtio network device\n\tKernel driver in use: virtio-pci\n00:04.0 SCSI storage controller: Red Hat, Inc. Virtio block device\n\tSubsystem: Red Hat, Inc. Virtio block device", "exit_code": 0, "error": null}

Assistant

I see this is a virtualized environment. Let me check the actual pfSense setup and available interfaces:

Assistant

Tool 'shell' does not exist. Available tools: browser_back, browser_cdp, browser_click, browser_console, browser_dialog, browser_get_images, browser_navigate, browser_press, browser_scroll, browser_snapshot, browser_type, browser_vision, clarify, cronjob, delegate_task, execute_code, image_generate, memory, patch, process, read_file, search_files, session_search, skill_manage, skill_view, skills_list, terminal, text_to_speech, todo, vision_analyze, web_extract, web_search, write_file, x_search

Assistant

{"status": "success", "output": "eth0: flags=4163 mtu 1500\n inet 107.174.205.125 netmask 255.255.255.0 broadcast 107.174.205.255\n ether 00:16:3c:ba:f7:60 txqueuelen 1000 (Ethernet)\n RX packets 4774568 bytes 1720402342 (1.7 GB)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 4473516 bytes 1077062753 (1.0 GB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\nlo: flags=73 mtu 65536\n inet 127.0.0.1 netmask 255.0.0.0\n loop txqueuelen 1000 (Local Loopback)\n RX packets 420154 bytes 30413113 (30.4 MB)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 420154 bytes 30413113 (30.4 MB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\n\n---\n\n", "tool_calls_made": 0, "duration_seconds": 0.18}

Assistant

This appears to be a virtualized environment, but I'll provide the comprehensive guide for pfSense Xfinity hotspot sharing:

---

## pfSense Xfinity Hotspot Connection & WiFi Sharing

**Critical Hardware Requirements:**
- **WiFi Adapter for Client Mode**: Must support Linux/macOS in monitor/client mode (Alfa AWUS036ACS, TP-Link AC600, etc.)
- **Separate WiFi AP Adapter**: For broadcasting shared connection (same or different adapter)
- **NOT possible with single WiFi radio** - requires at least 2 adapters

---

### Step 1: Connect to Xfinity Hotspot

**Option A: Captive Portal Login (xfinity SSID requires portal auth)**

1. **Install wifidog package** (for captive portal handling):
``
System > Package Manager > Available Packages > Install wifidog
`

2. **Configure wireless interface as client**:
`
Interfaces > Assignments > Add
Select available WiFi interface (e.g., ath0)
`

3. **Set up wlan0 as client**:
- **SSID**: "xfinitywifi" (or your local xfinity SSID)
- **Security**: NONE (open network)
- **BSSID**: Optional - select specific hotspot router

4. **Set up DHCP client on wlan0**:
- IPv4 Configuration Type: DHCP

5. **Configure wifidog** (handles captive portal):
`
Services > wifidog > Add
Interface: wlan0
Gateway Name: "xfinity-wifi"
`

**Option B: Using Xfinity Credentials (more reliable)**

`bash
# Via console/ssh - bypass web portal
# Connect to xfinity network, then authenticate via HTTP POST
# Xfinity uses: https://login.xfinity.com/xfinity-auth/

# This requires custom scripting - wifidog + custom auth script
`

---

### Step 2: Share via WiFi Access Point

**Configure Second WiFi Interface as AP:**

1. **Add WiFi interface for AP**:
`
Interfaces > Assignments > Add
Select second WiFi adapter (e.g., ath1)
`

2. **Configure ath1 as AP**:
- **Mode**: AP
- **SSID**: "YourNetwork"
- **Security**: WPA2-PSK
- **Passphrase**: Strong password

3. **Set up AP DHCP server**:
- Services > DHCP Server > ath1
- Enable, Range: 192.168.2.100-200

---

### Step 3: NAT Routing Between Interfaces

`
Firewall > NAT > Port Forward
Interface: wlan0
Protocol: any
Destination: wlan0 net
Translation/Target: 192.168.2.0/24 (AP net)
`

**Firewall Rules:**
`
Firewall > Rules > WAN (wlan0)
Action: Pass
Source: 192.168.2.0/24
Destination: any

Firewall > Rules > LAN (for management access)
Add rule to allow access to AP network
``

---

### Alternative: USB Tethered Hotspot

**Cheaper hardware approach:**

1. **USB tethering from smartphone** (xfinity mobile app)
- Connect phone via USB
- System > Gateways > Add
- Interface: usb0
- Gateway: DHCP

2. **Bridge or NAT** the usb0 interface to your LAN/WiFi AP

---

### Legal & Policy Notes

⚠️ **Xfinity Terms of Service**:
- Hotspot access is typically for personal device use only
- Commercial/reseller use violates ToS
- Concurrent sessions may be throttled

---

### Virtual/PFsense Hardware Limitation

Since your system shows virtualized hardware (no WiFi adapters detected), you'd need:
- Pass-through WiFi USB adapters to the VM
- Or use physical pfSense/OPNsense appliance

**Would you like me to:**
1. Create a firmware flash drive for a dedicated WiFi router?
2. Set up a software bridge using available Ethernet interface?
3. Proceed with one of the above hardware solutions?

What hardware do you have available?

User

It's not connect to wifi and share wifi, it's connect to wifi and DHCP ethernet Lan, for the other devices

Assistant

Got it - you want to connect to Xfinity WiFi as a client, then serve that connection to Ethernet LAN devices via DHCP. Let me revise the approach:

---

## pfSense: WiFi Client → Ethernet LAN DHCP Distribution

### Hardware Requirements
- **WiFi adapter** (supporting Linux/macOS AP mode)
- **Ethernet interface** (already have eth0)
- Cannot use single-radio WiFi for both client + AP simultaneously

---

### Step 1: WiFi Client Interface (Connect to Xfinity)

**Add WiFi as WAN/Upstream:**
``
Interfaces > Assignments > Add
Select WiFi interface (wlan0)
`

**Configure wlan0:**
- **Mode**: Client (Station)
- **SSID**: "xfinitywifi"
- **Security**: NONE (open) or WPA2 if secured
- **BSSID**: Optional - pin to specific hotspot

**DHCP Client on wlan0:**
`
Services > DHCP Client > wlan0
Enable: ✓
Reject RFC1918: Unchecked (xfinity uses public IPs)
`

---

### Step 2: Ethernet LAN as DHCP Server

**Configure eth0 as LAN:**
`
Interfaces > LAN
IPv4 Configuration Type: Static
IP Address: 192.168.1.1/24
`

**DHCP Server on eth0:**
`
Services > DHCP Server > LAN
Enable: ✓
Range: 192.168.1.100-200
Gateway: (will use wlan0's gateway - see routing below)
DNS: Use Cloudflare/Goggle in DHCP
`

---

### Step 3: Routing & NAT

**Set default route via WiFi:**
`
System > Routing > Gateways > Single
Interface: wlan0
Gateway: (auto-detect from DHCP)
`

**NAT from eth0 → wlan0:**
`
Firewall > NAT > Port Forward
Interface: LAN
Source: 192.168.1.0/24
Destination: any
Translation: Interface Address

OR
Firewall > NAT > Outbound > Hybrid
Auto-add NAT for LAN subnet
`

**Firewall Rules (LAN → WAN):**
`
Firewall > Rules > LAN
Action: Pass
Source: LAN net
Destination: any
`

---

### Step 4: Captive Portal Handling

Xfinity's hotspot requires authentication. Two approaches:

**Option A: wifidog (automated portal handling)**
`
System > Package Manager > Install wifidog
Services > wifidog > Add
Interface: wlan0
`

**Option B: Pre-authenticated credentials**
`bash
# Via SSH - authenticate once
# Xfinity portal URL: https://login.xfinity.com/
# You'll need: username/password or phone number

# Use curl to auth:
curl -X POST "https://login.xfinity.com/xfinity-auth/login.jsp" \
-d "username=you&password=yourpass&rememberMe=true"
`

---

### Alternative: Using Existing Eth0

Since I see eth0 is already configured with an upstream IP:

**Option: Bridge Networks**
`
Interfaces > Assignments > Bridge
Interface 1: wlan0 (WiFi client)
Interface 2: eth0 (existing WAN)

But this won't work - you want eth0 as your LOCAL LAN
`

**Correct Flow:**
`
xfinity Hotspot ← wlan0 ← pfSense (WAN)
↓
eth0 (LAN) ← Other devices (DHCP)
`

---

### Verification Commands

`bash
# Check WiFi connection
ifconfig wlan0
ping -I wlan0 8.8.8.8

# Check Ethernet DHCP
ifconfig eth0
ps | grep dhclient

# Test routing
traceroute -i eth0 1.1.1.1
``

---

### Xfinity Policy Caveat
- Personal device limit applies
- Rate limiting possible
- 24-hour session timeout

Would you like me to:
1. **Write the exact configuration files** for your current setup?
2. **Create a script** to auto-authenticate to xfinyl hotspot?
3. **Show how to set up wifidog** for automatic portal handling?

What's your WiFi adapter model? (I need to confirm Linux driver compatibility)

User

Want to set this up as a backup or fail over connection, incase the actual service is disconnected or down

Assistant

Perfect! You want **dual WAN failover** - Ethernet as primary, Xfinity WiFi as backup. This is enterprise-grade redundancy. Let me set up the proper failover configuration:

---

## pfSense Dual WAN Failover: Primary Ethernet → Xfinity WiFi Backup

### Step 1: Rename Interfaces for Clarity

``
Interfaces > Assignments

LAN (eth0): Keep as LAN
WAN (eth0): Rename from "eth0" to "WAN"
- IPv4: DHCP (or static per your current setup)

OPT1 (wlan0): Rename to "XFINITIY-WIFI"
- IPv4: DHCP client for WiFi connection
`

---

### Step 2: Configure Xfinity WiFi Client (OPT1)

**As before, but now as backup:**
- **Mode**: Client (Station)
- **SSID**: "xfinitywifi" (or specific BSSID)
- **Security**: NONE (open) or WPA2
- **DHCP Client**: Enabled

---

### Step 3: Gateway Groups (Priority Routing)

`
System > Routing > Gateways > Single

Gateway #1: WAN_GW
Interface: WAN
Name: "Primary_Ethernet"
Monitor IP: 1.1.1.1

Gateway #2: WIFI_GW
Interface: XFINITIY-WIFI
Name: "Xfinity_Backup"
Monitor IP: 1.1.1.1
`

**Create Gateway Group:**
`
System > Routing > Gateway Groups

Name: "FAILSAFE"
Tier Group:
Tier 1: Primary_Ethernet (Priority)
Tier 0: Xfinity_Backup (Fallback)
Trigger Level: Member Down
`

---

### Step 4: Firewall Rules with Gateway Selection

**Primary Rule (uses primary gateway):**
`
Firewall > Rules > LAN
Action: Pass
Source: LAN net
Destination: any
Gateway: Primary_Ethernet (Tier 1)
`

**Backup/Failover Rule:**
`
Firewall > Rules > LAN (add below primary)
Action: Pass
Source: LAN net
Destination: any
Gateway: Xfinity_Backup (Tier 0)
**Optional**: Only if no gateways available
`

---

### Step 5: Service Provider Failover

**Configure Multi-WAN with Health Checks:**

`bash
# Gateway monitoring
Ping to 1.1.1.1 (Cloudflare DNS)
Ping to 8.8.8.8 (Google DNS)

# Xfinity-specific checks
https://xfls.xfinity.com/help/login.php
`

**Gateway Actions:**
- If WAN down > 3 failures in 5 min → switch to Xfinity
- If WAN restored → automatic failback (configurable delay)
- Downtime before failover: 60 seconds (adjustable)

---

### Step 6: Xfinity Portal Automation (Critical for Backup)

Since Xfinity requires login, automate it:

**Option A: wifidog package (recommended)**
`bash
# Install
pkg install wifidog

# Configure via GUI: Services > wifidog
# Set to auto-reauth periodically
`

**Option B: Custom cron script**
`bash
#!/bin/sh
# /root/scripts/xfinity-auth.sh

# Check if connected
if ! ping -I XFINITIY-WIFI -c1 8.8.8.8 -W5; then
logger "Xfinity WiFi down, checking connection"

# Force reconnect
ifconfig XFINITIY-WIFI down
sleep 3
ifconfig XFINITIY-WIFI up
fi
`

**Cron job (every 30 min):**
`
*/30 * * * * /root/scripts/xfinity-auth.sh
`

---

### Step 7: Load Balancing vs Failover

**For pure failover (what you want):**
`
Gateway Group: FAILSAFE
- Primary_Ethernet: Tier 1
- Xfinity_Backup: Tier 0
Trigger: Member down
`

**To verify failover is working:**

`bash
# Test commands to simulate WAN failure
# Block WAN routing temporarily
route del default gw X.X.X.X

# Watch gateway status
tail -f /var/log/system.log | grep "gateway"

# Verify clients auto-switch
traceroute 8.8.8.8 # Should use WiFi after failover
`

---

### Step 8: Dashboard Monitoring

**Add to dashboard:**
1. **Gateways Status widget** - shows failover state
2. **System Logs** - monitor gateway switches
3. **Interface widget** - verify Xfinity connection uptime

---

### Key Files to Modify

**/conf/config.xml** (backup first!):
`xml


wan
Primary_Ethernet
yes


opt1
Xfinity_Backup
no




FAILSAFE
Primary_Ethernet
< Gateway Xfinity_Backup

`

---

### Testing Failover

`bash
# Manually test failback:
# 1. Disable WAN interface temporarily
# 2. Verify clients get IP from Xfinity connection
# 3. Re-enable WAN - should auto-failback

# Check status:
curl -s http://192.168.1.1/api/v1/firewall/gateway_group
`

---

### Xfinity-Specific Considerations

⚠️ **Must-authenticate sessions**: Xfinity times out after ~24 hours. Add periodic re-authentication:

`bash
# Cron every 20 hours
0 */20 * * * curl -s -X POST "https://login.xfinity.com/xfinity-auth/login.jsp" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=$USER&password=$PASS&rememberMe=true"
``

---

Would you like me to:
1. **Generate the exact config.xml snippet** for your current setup?
2. **Create the authentication script** for Xfinity?
3. **Set up the cron jobs** for autonomous failover monitoring?

What's your current WAN interface type? (DHCP/static)? This affects gateway configuration.