Let's do it step by step.....
1) Make sure that the basic network access is working - bypass the CP
in GUI > VNS > Virtual Network > GUEST
set non-authenticated and authenticated to Guest_Captive_authen
Q: could you access the internet with the wireless client
2) DNS
change the value back in 1)
open a DOS window on the client and ping extreme.networks.com
Q: does the name resultion work = do you see the 104.154.197.154 address
Example:

3) open a browser and go to 10.10.10.10
Q: are you redirected to the portal
4) add another rule to the non-auth role
I can't remember the exact issue but it was necessary to also allow ARP
You'd try whether that helps, add the 0x806 rule....

Cheers,
Ron