FON Hotspot on La Fonera 2013

From DD-WRT Wiki

Jump to: navigation, search

WARNING: This page is a work in progress, not a useful set of instructions yet. It is in the process of being updated (July 2013).


So, I was messing around upgrading my La Fonera to the latest DD-WRT (r21676), which bricked the Fonera and took my FON hotspot offline. This needed recovery with RedBoot, and I reflashed it with r21286, the newest version for which I could find reports of success on a Fonera 2100.

This gives me a fine opportunity to update the FON_Hotspot_on_La_Fonera howto, which I wrote a few years back.

Here's a concise list of the steps to get a FON hotspot working on a La Fonera router, as of July 2013.

  1. Installed r21286 via TFTP and Redboot, as per La_Fonera_Flashing.
  2. Reset router to factory defaults via the Web GUI.
  3. Rebooted the router; noted that it takes several minutes to start up. Not sure it likes the 3.x kernel.
  4. Enabled JFFS from the Web GUI, selecting the Clean JFFS option, waited for reboot.
  5. Enabled SSHD, disabled telnet and ttraff daemon
  6. Configured a single unsecured WLAN, on interface ath0, with SSID: FON-via-VirginMedia
  7. Configured an additional bridge br1, under Setup -> Networking
  8. Assigned interface ath0 to bridge br1, under Setup -> Networking
  9. Enabled ChilliSpot via the Web GUI
  10. Configured for LAN IP address of 192.168.1.2, disabled DHCP server, plugged direct into LAN
  11. Logged in via SSH to debug ChilliSpot startup
  12. DNS resolution not working; set local DNS to primary router and disabled dnsmasq
  13. Fixed some minor errors in the ChilliSpot config, persuaded Chillispot to start
  14. Connected a client to the FON-via-VirginMedia SSID, verified IP address in 192.168.182.x
  15. Connected a client again, verified the web redirect to FON, verified the ability to log in
  16. Set up the FON heartbeat, roughly as per FON_Hotspot_on_La_Fonera
  17. Set up QoS, roughly as per the firewall script in FON_Hotspot




Contents

[edit] Changes since the previous FON_Hotspot_on_La_Fonera guide

[edit] URLs have changed for heartbeat scripts

  • URLs for the fon key and thinclient script have changed. The version of thinclient that I found is configured for /tmp rather than for /jffs, but we can run it through sed as we download it...
cd /jffs
wget http://www.inaudible.co.uk/perm/fonkey
wget -O - http://www.inaudible.co.uk/perm/thinclient | sed -e s/tmp/jffs/g > /jffs/thinclient
chmod 755 /jffs/thinclient

[edit] Manual ChilliSpot configuration

  • The rate-limiting as specified in the FON_Hotspot guide doesn't work as a startup script, because it tries to create qdiscs on interface tun0, which doesn't exist until ChilliSpot is up and running. The way to get around this is to add any QoS incantations for tun0 into ChilliSpot's ipup script, which under DD-WRT is to be found in /tmp/chilli/ip-up.sh (recreated on boot). DD-WRT doesn't make this easy, and overwriting the file from the firewall script doesn't seem to work either. The solution is to deconfigure ChilliSpot in the Web GUI and run it manually from static configuration files under /jffs (the old-fashioned way). That lets us use ip-up, ip-down, con-up and con-down scripts from JFFS, as well as maintain a static ChilliSpot configuration.

[edit] ChilliSpot configuration files

The following commands will create a set of Chillispot configuration files in /jffs/etc/chilli; once JFFS is enabled, you can paste them into your router over SSH.

mkdir -p /jffs/etc/chilli
cd /jffs/etc/chilli
cat > chilli.conf << EOF
ipup /jffs/etc/chilli/ip-up.sh
ipdown /jffs/etc/chilli/ip-down.sh
radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
radiussecret garrafon
dhcpif br1
uamserver https://www.fon.com/login/gateway
conup /jffs/etc/chilli/con-up.sh
condown /jffs/etc/chilli/con-down.sh
dns1 208.67.220.220
dns2 208.67.222.222
uamsecret garrafon
uamanydns
uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,ssl.google-analytics.com,maps.fon.com
net 192.168.182.0/24
EOF
echo "radiusnasid `nvram get wl0_hwaddr`" >> chilli.conf
cat > con-up.sh << EOF
#!/bin/sh
EOF
cat > fonusers.local << EOF
  
EOF
cat > ip-down.sh << EOF
#!/bin/sh
iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -j ACCEPT
iptables -D FORWARD -o tun0 -j ACCEPT
iptables -t nat -D PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP
iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -D POSTROUTING -s 192.168.182.0/24 -j MASQUERADE
EOF
cat > ip-up.sh << EOF
#!/bin/sh
iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -j ACCEPT
iptables -D FORWARD -o tun0 -j ACCEPT
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
iptables -t nat -D PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP
iptables -t nat -I PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP
iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -D POSTROUTING -s 192.168.182.0/24 -j MASQUERADE
iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -I POSTROUTING -s 192.168.182.0/24 -j MASQUERADE
DEV="tun0"
DOWNLINK="1024"
UPLINK="256"
# limit download
tc qdisc add dev $DEV  root handle 1: htb
tc class add dev $DEV parent 1: classid 1:1 htb rate  kbit burst 6k
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1
# limit upload
tc qdisc add dev $DEV ingress handle ffff:
tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate kbit burst 10k drop flowid :1
EOF