Captive Portal - multiple zones

[GreenMatter]

I have configured captive portal for guest net and it works fine.
Now I wanted to run second portal / zone on different interface (which is not so much limited as guest net) but it doesn't work. All devices within said interface's network can't communicate with portal page. I have firewall rule allowing traffic on port 8001 (zone 1) - I can see in firewall's log that packets are flowing but tcpdump showed that reply from 172.16.3.1:8001 is tcp 0. When I open portal's page from other, unrestricted subnet - it works.
I'm totally lost and don't know where to start troubleshooting...

[GreenMatter]

I've just disabled authentication by adding affected interface subnet to allowed addresses. And from now, clients in this subnet are able to access portal page. It is showing clearly that captive portal itself blocks access to its own authorization page (with and without ssl).
What could be wrong within captive portal?