PacketFence Voucher-Based WLAN Setup

I already have PacketFence running in a Proxmox-hosted VM and now need it tuned for a real-world roll-out. The immediate goal is to keep new wireless clients in a restricted VLAN that lets them reach only one thing—our internal voucher-purchase website—until they buy access. Once they complete payment, I want PacketFence to recognise the voucher and seamlessly grant the correct level of service through a token-based mechanism.

Here is what I need from you:
• A live consultation focused on best-practice, security-oriented configuration decisions (RADIUS roles, DHCP scopes, firewall rules, captive portal hardening, SSL, accounting, logs, etc.).
• Hands-on configuration of PacketFence so it automatically places new devices in the “purchase-only” VLAN, hands out the proper IP range, shows the captive portal, and then switches entitlement based on the voucher token.
• Mapping of voucher packages to static IP virtual servers sitting elsewhere on the network, ensuring each package unlocks only its authorised resources.

I will provide full access to the Proxmox environment, the PacketFence VM, and the list of virtual servers and their static addresses. When we finish, a brand-new client should be able to:
1. Connect to Wi-Fi, receive an IP in the restricted VLAN and reach nothing but the purchase portal.
2. Buy a voucher, have PacketFence validate the token, and instantly gain the correct resource access without admin touch.

If you have deep hands-on experience with PacketFence, RADIUS, and VLAN automation inside virtualised environments, let’s get started.