{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "item": { "id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "slug": "explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours", "url": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours.md", "json": "https://update.dsesecurity.com/api/v1/posts/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/" }, "title": "Explain pfSense voucher elapsed time before promising reusable guest hours", "summary": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:26+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 254, "potentially_affected": "This concerns pfSense captive-portal vouchers and their documented lifecycle.", "dse_recommendation": "DSE recommends describing vouchers as elapsed access windows in the guest-facing instructions.", "primary_source": { "name": "Netgate — Vouchers", "url": "https://docs.netgate.com/pfsense/en/latest/captiveportal/vouchers.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Logging out does not pause the voucher clock, and moving its use can stop the previous session.

\n

Source facts

\n

Netgate documents that a captive-portal voucher’s duration runs from the start of its session and continues after logout. During that interval the code can be used again on the same or another computer, but use on another computer stops the previous session. Changing voucher keys or generation bits invalidates existing rolls.

\n

Source: Netgate — Vouchers.

\n

Applicability

\n

This concerns pfSense captive-portal vouchers and their documented lifecycle.

\n

DSE recommendation

\n

DSE recommends describing vouchers as elapsed access windows in the guest-facing instructions. Match the roll duration to the service being offered and avoid implying that a user can save unused time by signing out. Protect exported code lists because they grant access. Schedule generation-setting changes around outstanding rolls and prepare replacement codes when an intentional invalidation is necessary. Keep issuance records limited to the information required by the organization’s policy. Give reception or guest-support staff an example showing activation time, expiry time, and a device handoff. Have them confirm that wording matches the offered service. Treat a voucher-key change as a guest-access change with a replacement-roll plan, rather than an isolated housekeeping edit.

\n

Verification

\n

With a disposable voucher in a test zone, start a session, sign out, and verify the remaining elapsed window. Use the code from another approved test device and confirm the previous session ends. Test expiry separately, and record any roll-setting change without distributing live guest codes in the evidence.

\n

Official reference

\n

Netgate — Vouchers. Reviewed October 20, 2026.

", "content_text": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.\nSource facts\nNetgate documents that a captive-portal voucher’s duration runs from the start of its session and continues after logout. During that interval the code can be used again on the same or another computer, but use on another computer stops the previous session. Changing voucher keys or generation bits invalidates existing rolls.\nSource: Netgate — Vouchers.\nApplicability\nThis concerns pfSense captive-portal vouchers and their documented lifecycle.\nDSE recommendation\nDSE recommends describing vouchers as elapsed access windows in the guest-facing instructions. Match the roll duration to the service being offered and avoid implying that a user can save unused time by signing out. Protect exported code lists because they grant access. Schedule generation-setting changes around outstanding rolls and prepare replacement codes when an intentional invalidation is necessary. Keep issuance records limited to the information required by the organization’s policy. Give reception or guest-support staff an example showing activation time, expiry time, and a device handoff. Have them confirm that wording matches the offered service. Treat a voucher-key change as a guest-access change with a replacement-roll plan, rather than an isolated housekeeping edit.\nVerification\nWith a disposable voucher in a test zone, start a session, sign out, and verify the remaining elapsed window. Use the code from another approved test device and confirm the previous session ends. Test expiry separately, and record any roll-setting change without distributing live guest codes in the evidence.\nOfficial reference\nNetgate — Vouchers. Reviewed October 20, 2026.", "content_markdown": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.\n\n## Source facts\n\nNetgate documents that a captive-portal voucher’s duration runs from the start of its session and continues after logout. During that interval the code can be used again on the same or another computer, but use on another computer stops the previous session. Changing voucher keys or generation bits invalidates existing rolls.\n\nSource: [Netgate — Vouchers](https://docs.netgate.com/pfsense/en/latest/captiveportal/vouchers.html).\n\n## Applicability\n\nThis concerns pfSense captive-portal vouchers and their documented lifecycle.\n\n## DSE recommendation\n\nDSE recommends describing vouchers as elapsed access windows in the guest-facing instructions. Match the roll duration to the service being offered and avoid implying that a user can save unused time by signing out. Protect exported code lists because they grant access. Schedule generation-setting changes around outstanding rolls and prepare replacement codes when an intentional invalidation is necessary. Keep issuance records limited to the information required by the organization’s policy. Give reception or guest-support staff an example showing activation time, expiry time, and a device handoff. Have them confirm that wording matches the offered service. Treat a voucher-key change as a guest-access change with a replacement-roll plan, rather than an isolated housekeeping edit.\n\n## Verification\n\nWith a disposable voucher in a test zone, start a session, sign out, and verify the remaining elapsed window. Use the code from another approved test device and confirm the previous session ends. Test expiry separately, and record any roll-setting change without distributing live guest codes in the evidence.\n\n## Official reference\n\n[Netgate — Vouchers](https://docs.netgate.com/pfsense/en/latest/captiveportal/vouchers.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "url": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Explain pfSense voucher elapsed time before promising reusable guest hours", "item": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/#article", "identifier": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "url": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/", "headline": "Explain pfSense voucher elapsed time before promising reusable guest hours", "description": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.", "abstract": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.", "articleBody": "Logging out does not pause the voucher clock, and moving its use can stop the previous session.\nSource facts\nNetgate documents that a captive-portal voucher’s duration runs from the start of its session and continues after logout. During that interval the code can be used again on the same or another computer, but use on another computer stops the previous session. Changing voucher keys or generation bits invalidates existing rolls.\nSource: Netgate — Vouchers.\nApplicability\nThis concerns pfSense captive-portal vouchers and their documented lifecycle.\nDSE recommendation\nDSE recommends describing vouchers as elapsed access windows in the guest-facing instructions. Match the roll duration to the service being offered and avoid implying that a user can save unused time by signing out. Protect exported code lists because they grant access. Schedule generation-setting changes around outstanding rolls and prepare replacement codes when an intentional invalidation is necessary. Keep issuance records limited to the information required by the organization’s policy. Give reception or guest-support staff an example showing activation time, expiry time, and a device handoff. Have them confirm that wording matches the offered service. Treat a voucher-key change as a guest-access change with a replacement-roll plan, rather than an isolated housekeeping edit.\nVerification\nWith a disposable voucher in a test zone, start a session, sign out, and verify the remaining elapsed window. Use the code from another approved test device and confirm the previous session ends. Test expiry separately, and record any roll-setting change without distributing live guest codes in the evidence.\nOfficial reference\nNetgate — Vouchers. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:26+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/explain-pfsense-voucher-elapsed-time-before-promising-reusable-guest-hours/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Explain pfSense voucher elapsed time before promising reusable guest hours" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 254, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Vouchers", "url": "https://docs.netgate.com/pfsense/en/latest/captiveportal/vouchers.html" } } ] } }