Captive portal with only two interfaces LAN & WAN

[fathibn]

Hi,
My setup:
WAN interface connected to a 4G router via an ethernet switch
LAN interface connected to another switch with several wifi access points
All user traffic coming to OPNSense LAN interface through wifi-ap --> switch -->  LAN
DHCP assignments and DNS resolution served by another server on the LAN net segment with OPNSense LAN served as default gateway for dhcp clients
So dhcp and dns resolution works even if OPNSense VM is down but no internet connection is possible as the other server doesn't route any traffic to the internet even if it is connected to the internet independently of the OPNSense server.
Squid is set transparent mode with related port forwarding rule active and works well.

When I setup captive portal on LAN interface, all traffic to the internet is blocked but no captive portal page is show. Tried to acces ONSense on ports 8000-8002 while CP is active but it doesn't show any page.
without cp, an ipfw list shows one single rule, that all traffic is allowed. When activating cp, ipwfw list shows a lot of new rules.

Can someone help me please.
TIA