Manage your café internet
with EveryCafe.

Have the following details ready before changing any network settings:

• Access to pfSense Community Edition (CE) and its version number.
• Network access from the EveryCafe main station to the pfSense management address.
• The purpose of each internet line and the main station’s IP address.
• A current pfSense configuration backup and a suitable maintenance window.
• For Wi-Fi: the interface used by wireless clients.

EveryCafe selects the policy for each station, while pfSense enforces the selected gateway, speed and access rules. All managed traffic must pass through pfSense.

If you only need to manage desktop stations, complete steps 03–07 and continue with the final tests in step 12.

In pfSense, go to System → REST API. If the menu exists, proceed to step 04.

1. Check your pfSense CE version.
2. Find a compatible package in the pfrest release list and verify its compatibility with your EveryCafe version.
3. If required, open 8 · Shell in the pfSense console and run the installation command for that exact package.
4. Refresh the web interface and check for the REST API menu.

Go to System → REST API → Settings. Enable the API, restrict Allowed Interfaces to the local interface used by the EveryCafe main station (for example LAN), leave Read Only unchecked and enable Key authentication. Never expose this API on the WAN interface.

1. Save your settings and open Keys.
2. Enter a recognizable description, such as EveryCafe Integration.
3. Save and securely copy the generated key.

In EveryCafe, open Settings → Integrations → pfSense Integration.

1. Enable the integration.
2. Enter the management URL (for example https://192.168.10.1, with your actual port and protocol).
3. Paste the key from step 04.
4. Click Test Connection, then save the settings after a successful test.

If the test fails, check the address, authentication key, certificate trust and allowed local interface before continuing.

Click Run Setup Wizard on the same integration screen. The wizard configures EveryCafe’s EC-prefixed aliases, limiters and firewall entries.

1. Verify the connection: check the URL and API key, test and continue.
2. Name the internet lines: select the gateways, assign names such as EC_OYUN and EC_INTERNET, and choose the default line. Verify which physical WAN each gateway uses.
3. Select the game line and rules: review game IP networks and ports; only add values you know are correct.
4. Review and apply: confirm the summary, finish the wizard and wait until pfSense applies the changes.

The optional setting to block internet access when a session closes should match your business policy. Check the result on a test station before using it for customers.

Open EveryCafe → Settings → Tariffs and edit a tariff.

1. Choose its internet line, for example EC_INTERNET.
2. Enable applying the line on login or tariff change.
3. Save and repeat for other tariffs such as the game tariff.
4. On the main screen, select a station and use a speed shortcut to apply or remove a limiter.
5. Confirm the active Internet Line and Speed Limit in the session summary.

Unlimited means removing the EveryCafe speed limit, not increasing your physical internet capacity. Test tariff changes on a spare station before rollout.

For optional Wi-Fi member sign-in, go to pfSense → System → User Manager → Authentication Servers → Add.

• Name: EveryCafe; type/protocol: RADIUS / PAP.
• Server IP: the EveryCafe main station, for example 192.168.10.10 — not the pfSense IP.
• Choose a strong Shared Secret; enter the same value in EveryCafe in step 10. It is not the REST API key.
• Enable Authentication and Accounting on UDP ports 1812 and 1813.

Save, keep the main station IP fixed or reserved, and allow the relevant traffic from pfSense through its Windows firewall.

In pfSense → Services → Captive Portal, create a zone such as everycafe_wifi.

1. Enable the portal for the local wireless client interface, never WAN.
2. Enable a custom portal page and upload portal-giris.html (login), portal-hata.html (authentication error) and portal-cikis.html (logout) from the EveryCafe installation package.
3. Set Authentication Method to an authentication backend and Authentication Server to EveryCafe.
4. Enable Use RADIUS Session-Timeout attributes so access ends at the allocated time.
5. For Accounting, enable Send RADIUS accounting packets, select EveryCafe, use Interim updates, leave the input/output inversion and idle-time options unchecked.

Save and apply changes. The HTML file for this guide is not a portal login file; obtain the three portal files from the EveryCafe installer or support team.

Open EveryCafe → Settings → Integrations → pfSense → Wireless and enable listening for wireless logins.

• Shared Secret: exactly the same password configured in step 08.
• Fee: amount deducted from the member balance; set it to 0 for free member access.
• Duration: permitted minutes before the session ends.
• Listening address: the main station’s local IP reachable from pfSense.
• Security code: a separate code for authorized free access, not a member password.

Example: a fee of 30 TRY and a duration of 60 minutes deducts 30 TRY for one hour. This is an illustration, not a recommended price. Verify that the RADIUS listener starts without port conflicts.

pfSense can forward DNS lookup events to the EveryCafe main station. These logs do not capture full URLs or HTTPS page contents and do not cover every query made through other DNS providers, encrypted DNS or VPNs.

1. In Services → DNS Resolver → General Settings, enable DNS Resolver and add log-queries: yes under the existing server: block (or create that block if absent).
2. Save, apply and restart the unbound service. DNS resolution may be interrupted briefly.
3. In Status → System Logs → Settings, enable Remote Logging to the main station, for example 192.168.10.10:514, over IPv4 and select DNS Events.
4. Allow UDP 514 traffic from the pfSense address through the main station firewall. Do not disable the firewall; keep this traffic on the LAN.

Then make a test DNS query and check the EveryCafe IPLog output.

Before enabling the integration for customers, verify the behavior on a test desktop and phone.

Desktop checks

• The EveryCafe pfSense connection test succeeds.
• Internet and game tariffs select the expected gateway.
• Speed limiter shortcuts apply and are removed correctly.
• If enabled, internet access stops when the session closes.

Wi-Fi checks

• Disable mobile data, join the café Wi-Fi and open the portal.
• Sign in as a test member and verify any balance deduction.
• Check that internet works and stops when the test duration expires.
• If configured, verify that a DNS event reaches IPLog.

REST API menu missing

Verify the package and pfSense version; reinstall the compatible package if required.

Connection test failed

Check URL, port, TLS certificate, API enablement, Key authentication and Allowed Interfaces.

Tariff changes but line does not

Check tariff mapping, automatic application, station IP and successful wizard completion.

Phone has internet without a portal

Verify that mobile data is off, the AP DHCP is disabled, and clients use the pfSense-controlled interface.

Correct member password, Wi-Fi login rejected

Verify the EveryCafe RADIUS listener, PAP, the shared secret, main station IP, UDP 1812/1813, member status and balance.

Session duration or accounting incorrect

Check Session-Timeout, RADIUS Accounting, Interim updates and UDP 1813.

DNS logs missing

Check DNS Resolver query logging, unbound restart, DNS Events, syslog server IP and UDP 514.

When contacting support, provide software versions, the failed step and screenshots with all secrets concealed.

WAN / Gateway

Internet uplink and the gateway used by that connection.

LAN / Interface

Local network and a pfSense network interface.

Alias

Named list of IP addresses or networks used to manage stations.

Limiter

Rule that restricts a connection’s speed.

API key

Secret credential allowing EveryCafe to access pfSense settings.

RADIUS / PAP

Member authentication service and its authentication protocol.

Accounting / Interim

Session usage reporting and periodic ongoing updates.

Shared Secret

Password configured on both sides of the RADIUS connection.

Captive Portal

The login page shown when a client joins Wi-Fi.

DHCP / DNS / Syslog

IP address assignment, domain lookup and remote log transmission.