Explain pfSense voucher elapsed time before promising reusable guest hours

Logging out does not pause the voucher clock, and moving its use can stop the previous session.

Source facts

Netgate documents that a captive-portal voucher’s duration runs from the start of its session and continues after logout. During that interval the code can be used again on the same or another computer, but use on another computer stops the previous session. Changing voucher keys or generation bits invalidates existing rolls.

Source: Netgate — Vouchers.

Applicability

This concerns pfSense captive-portal vouchers and their documented lifecycle.

DSE recommendation

DSE recommends describing vouchers as elapsed access windows in the guest-facing instructions. Match the roll duration to the service being offered and avoid implying that a user can save unused time by signing out. Protect exported code lists because they grant access. Schedule generation-setting changes around outstanding rolls and prepare replacement codes when an intentional invalidation is necessary. Keep issuance records limited to the information required by the organization’s policy. Give reception or guest-support staff an example showing activation time, expiry time, and a device handoff. Have them confirm that wording matches the offered service. Treat a voucher-key change as a guest-access change with a replacement-roll plan, rather than an isolated housekeeping edit.

Verification

With a disposable voucher in a test zone, start a session, sign out, and verify the remaining elapsed window. Use the code from another approved test device and confirm the previous session ends. Test expiry separately, and record any roll-setting change without distributing live guest codes in the evidence.

Official reference

Netgate — Vouchers. Reviewed October 20, 2026.