FON Hotspot on La Fonera 2013
From DD-WRT Wiki
WARNING: This page is a work in progress, not a useful set of instructions yet. It is in the process of being updated (July 2013).
So, I was messing around upgrading my La Fonera to the latest DD-WRT (r21676), which bricked the Fonera and took my FON hotspot offline. This needed recovery with RedBoot, and I reflashed it with r21286, the newest version for which I could find reports of success on a Fonera 2100.
This gives me a fine opportunity to update the FON_Hotspot_on_La_Fonera howto, which I wrote a few years back.
Here's a concise list of the steps to get a FON hotspot working on a La Fonera router, as of July 2013.
- Installed r21286 via TFTP and Redboot, as per La_Fonera_Flashing.
- Reset router to factory defaults via the Web GUI.
- Rebooted the router; noted that it takes several minutes to start up. Not sure it likes the 3.x kernel.
- Enabled JFFS from the Web GUI, selecting the Clean JFFS option, waited for reboot.
- Enabled SSHD, disabled telnet and ttraff daemon
- Configured a single unsecured WLAN, on interface ath0, with SSID: FON-via-VirginMedia
- Configured an additional bridge br1, under Setup -> Networking
- Assigned interface ath0 to bridge br1, under Setup -> Networking
- Enabled ChilliSpot via the Web GUI
- Configured for LAN IP address of 192.168.1.2, disabled DHCP server, plugged direct into LAN
- Logged in via SSH to debug ChilliSpot startup
- DNS resolution not working; set local DNS to primary router and disabled dnsmasq
- Fixed some minor errors in the ChilliSpot config, persuaded Chillispot to start
- Connected a client to the FON-via-VirginMedia SSID, verified IP address in 192.168.182.x
- Connected a client again, verified the web redirect to FON, verified the ability to log in
- Set up the FON heartbeat, roughly as per FON_Hotspot_on_La_Fonera
- Set up QoS, roughly as per the firewall script in FON_Hotspot
Contents |
[edit] Changes since the previous FON_Hotspot_on_La_Fonera guide
[edit] URLs have changed for heartbeat scripts
- URLs for the fon key and thinclient script have changed. The version of thinclient that I found is configured for /tmp rather than for /jffs, but we can run it through sed as we download it...
cd /jffs wget http://www.inaudible.co.uk/perm/fonkey wget -O - http://www.inaudible.co.uk/perm/thinclient | sed -e s/tmp/jffs/g > /jffs/thinclient chmod 755 /jffs/thinclient
[edit] Manual ChilliSpot configuration
- The rate-limiting as specified in the FON_Hotspot guide doesn't work as a startup script, because it tries to create qdiscs on interface tun0, which doesn't exist until ChilliSpot is up and running. The way to get around this is to add any QoS incantations for tun0 into ChilliSpot's ipup script, which under DD-WRT is to be found in /tmp/chilli/ip-up.sh (recreated on boot). DD-WRT doesn't make this easy, and overwriting the file from the firewall script doesn't seem to work either. The solution is to deconfigure ChilliSpot in the Web GUI and run it manually from static configuration files under /jffs (the old-fashioned way). That lets us use ip-up, ip-down, con-up and con-down scripts from JFFS, as well as maintain a static ChilliSpot configuration.
[edit] ChilliSpot configuration files
The following commands will create a set of Chillispot configuration files in /jffs/etc/chilli; once JFFS is enabled, you can paste them into your router over SSH.
mkdir -p /jffs/etc/chilli cd /jffs/etc/chilli cat > chilli.conf << EOF ipup /jffs/etc/chilli/ip-up.sh ipdown /jffs/etc/chilli/ip-down.sh radiusserver1 radius01.fon.com radiusserver2 radius02.fon.com radiussecret garrafon dhcpif br1 uamserver https://www.fon.com/login/gateway conup /jffs/etc/chilli/con-up.sh condown /jffs/etc/chilli/con-down.sh dns1 208.67.220.220 dns2 208.67.222.222 uamsecret garrafon uamanydns uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,ssl.google-analytics.com,maps.fon.com net 192.168.182.0/24 EOF echo "radiusnasid `nvram get wl0_hwaddr`" >> chilli.conf cat > con-up.sh << EOF #!/bin/sh EOF cat > fonusers.local << EOF EOF cat > ip-down.sh << EOF #!/bin/sh iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i tun0 -j ACCEPT iptables -D FORWARD -o tun0 -j ACCEPT iptables -t nat -D PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu iptables -t nat -D POSTROUTING -s 192.168.182.0/24 -j MASQUERADE EOF cat > ip-up.sh << EOF #!/bin/sh iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i tun0 -j ACCEPT iptables -D FORWARD -o tun0 -j ACCEPT iptables -I INPUT -i tun0 -j ACCEPT iptables -I FORWARD -i tun0 -j ACCEPT iptables -I FORWARD -o tun0 -j ACCEPT iptables -t nat -D PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP iptables -t nat -I PREROUTING -i br1 ! -s 192.168.182.0/24 -j DROP iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu iptables -t nat -D POSTROUTING -s 192.168.182.0/24 -j MASQUERADE iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu iptables -t nat -I POSTROUTING -s 192.168.182.0/24 -j MASQUERADE DEV="tun0" DOWNLINK="1024" UPLINK="256" # limit download tc qdisc add dev $DEV root handle 1: htb tc class add dev $DEV parent 1: classid 1:1 htb rate kbit burst 6k tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1 # limit upload tc qdisc add dev $DEV ingress handle ffff: tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate kbit burst 10k drop flowid :1 EOF