On the Vouchers tab, there were several options available that are worthy of further explanation:

• Voucher Public Key/Voucher Private Key: In these two text boxes, you may enter an RSA public/private key pair of your choice – or you can use the pair that pfSense has generated for you. You can also click on the Generate new keys button in the Voucher Public Key section to generate a new public/private key pair.
• Character set: This field allows you to define the character set used in generated voucher codes.
• # of Roll bits/# of Ticket bits/# of Checksum bits: You can change the numbers in these fields to redefine the range of each. For example, the default number of roll bits is 16; the default number of ticket bits is 10. This allows us to define roll numbers from 0 to 65535, and each voucher roll can have up to 1,023 codes. If we needed to generate a greater number of codes per roll, we could change the number of ticket bits to 12, thus allowing us up to 4,096 codes per roll. The only restriction is that the sum of the roll, ticket, and checksum (the checksum field defines the size of the checksum over roll and ticket) bits must be one less than the RSA key size, as shown in the following screenshot:

• Voucher Database Synchronization: This section allows you to define the IP address, port, username, and password for the master voucher database node. Setting up a voucher database that is synchronized over multiple pfSense nodes allows you to ensure that used voucher codes are marked as used on all nodes. You can leave these fields blank in the following instances:
  • There is only one pfSense node on your network, thus eliminating the need for synchronization
  • This is the only pfSense node on which the captive portal is enabled
  • This is the master voucher database node (the page warns us that this option should only be used on slave nodes)