pfSense

many ISPs in India also do a similar thing and etisalat in UAE do a similar thing, if the bill isnt paid by the 15th of the month then all of a sudden u open any web page and u keep getting their annoying ad asking to pay bill and it also says to restart router to be able to surf, problem is they still show this page even if bill is paid. ICMP works but browsing goes down till connection is disconnected and then reconnected

Well it seems that the man behind the curtain of support says that this isn't possible... I refuse to accept that this can't be done in a simple, reliable and supportable fashion. Like it or not Netgate I am going to build this feature in on my boxes. I think you greatly underestimate how many of your users will utilize this, many of us running pfsense are also running Teir 3 circuits (that utilize soft discos) to save money. Even outside of that, ICMP is outdated and not at all a good indicator of whether an end user can "access the internet".

I'm going to try building a script that will work with the existing infrastructure. Seems that the best way to go about it (without much effort or risk) is to use pfctl in a script to block ICMP responses from the configured monitoring host when the script detects a "_SoftDown_". SoftDown will be determined by Wget with "--bind-address" on specified gateway to check for a string in the returned html of a specified website. I'll run the script with cron every 5 minutes. Maybe I'll get fancy and try to email the email address configured in the GUI (maybe sending mail to root is enough) when SoftDown occurs.

Interesting.

There is a "Mark Gateway as Down" option in the GUI. If you could figure out how to script that flag, that might be a better way to go.

I do not know what I have to do here to help. I can help work on this (I can develop), but I have no idea how the coding/plugin system of pfsense works. Where would I start, and what would I mod? Is someone actually working on this?

I have been pushing this for a few years now.

Since the target version has been deleted, is there anyway to prove to the pfSense devs that this feature is important or worth while?

I have a ton of these firewalls in the wild, and your competitors do Speedtesting, HTTP checks, DNS checks, etc.

ISP's are so horrible now a days, and even QoS ping. So dropping pings just for the heck of it. Dropping anycast addresses.

What can we do to help?

Another downright evil thing that Verizon FIOS does here in the US is: for suspended lines (if customer forgets to pay etc) they will allow ICMP traffic through but nothing else. So pfSense happily chugs along thinking all is fine since pings are successful. So yeah an HTTP check would be one way to mitigate this.