Chillispot

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 19:02, 13 August 2008 (edit)
S2s2 (Talk | contribs)
m (Speculative note was wrong, other language clerical stuff. Clean-up.)
← Previous diff
Revision as of 20:05, 13 August 2008 (edit) (undo)
S2s2 (Talk | contribs)
(Many items cleaned up.)
Next diff →
Line 1: Line 1:
<!-- Note to Chillispot Service Providers: --> <!-- Note to Chillispot Service Providers: -->
 +
<!-- Advertisements (links to your service) go in the Link Section at the bottom. --> <!-- Advertisements (links to your service) go in the Link Section at the bottom. -->
 +
==Brief Introduction== ==Brief Introduction==
-[http://www.chillispot.org Chillispot]:+[http://www.chillispot.info Chillispot]:
* Is a complete authentication and management system for Hotspots. * Is a complete authentication and management system for Hotspots.
** Tickets can be generated producing income or limiting use ** Tickets can be generated producing income or limiting use
** The DD-WRT Device can also be setup as free to use. ** The DD-WRT Device can also be setup as free to use.
-* At no direct cost to the DD-WRT Device Owner/Operator, the WLAN Hotspot and/or LAN connections of the DD-WRT Device force clients to look at an initial web page. Such as:+* At no direct cost to the DD-WRT Device Owner or Operator, the WLAN and/or LAN connections of the DD-WRT Device can force clients to look at an initial web page. Such as:
** Hotspot News ** Hotspot News
-** an Access Agreement+** Access Agreement
-** a Disclaimer+** Disclaimer
-** or Usage Policy<br>+** Usage Policy<br>
-Can all appear on Client Screens. While Disclaimers are a practical basic necessary in some legal regions when providing Internet Access to unknown persons - additional news or usage agreements, or advertising, are more helpful on a daily basis. Consult a legal professional for specific advice on Disclaimers and Usage Agreements, or ignore it and have a fun life, and possibly a friend named ''Bubba''.+The above items can all appear on Client Screens. While Disclaimers are a practical basic necessary in some legal regions when providing Internet Access to unknown persons - additional news or usage agreements, or advertising, are more helpful on a daily basis. Consult a legal professional for specific advice on Disclaimers and Usage Agreements, or ignore it and have a fun life, and possibly a friend named ''Bubba''.
==Terms and Definitions== ==Terms and Definitions==
Line 27: Line 29:
* Check to make sure that you can connect to the Internet from your computer. If not, configure your Internet connection. * Check to make sure that you can connect to the Internet from your computer. If not, configure your Internet connection.
-* '''For those using an On-line Chillispot Back-End Provider, the DD-WRT Device ''must'' already have Internet access.''' Example, check your laptop is working through the DD-WRT Device to get Internet.+* '''For those using an On-line Chillispot Back-end Provider, the DD-WRT Device ''must'' already have Internet access.''' Example, check your laptop is working through the DD-WRT Device to get Internet.
-* When using Chillispot ''without'' using an online provided service, this requires a '''Web Server''' to host the redirect website and a '''Radius Server''' for accounting. The Web Server and Radius Server may be installed on the same machine, but not the DD-WRT Device, of course.<br>The advantage of a Chillispot Service Provider is Chillispot can be up and running in minutes.+* When using Chillispot ''without'' using an on-line Chillispot Back-end Provider service, you must provide your own '''Web Server''' to host the redirect website and a '''Radius Server''' for accounting. The Web Server and Radius Server may be installed on the same machine, but generally not the DD-WRT Device. Installation and Set-up of Chillispot without an Online Chillispot Back-end Provider is beyond the scope of this guide.
 +* The advantage of a Chillispot Service Provider is Chillispot can be up and running in minutes.
** Create a Chillispot Account on WorldSpot.net or equivalent provider. ** Create a Chillispot Account on WorldSpot.net or equivalent provider.
** After signing up, WorldSpot.net gives you a convenient customized screen-image (based on V2.3SP2) displaying the entries for the DD-WRT Device. Other providers may do the same. ** After signing up, WorldSpot.net gives you a convenient customized screen-image (based on V2.3SP2) displaying the entries for the DD-WRT Device. Other providers may do the same.
-* Ideally, connect a cable to your laptop and a LAN port on the DD-WRT Device.+* A cable connecting to your laptop LAN port and a LAN port on the DD-WRT Device.
* The DD-WRT Device's Web Management Interface must work. You should be able to connect to at http://192.168.1.1/ (default), or whatever LAN IP you have set your DD-WRT Device. * The DD-WRT Device's Web Management Interface must work. You should be able to connect to at http://192.168.1.1/ (default), or whatever LAN IP you have set your DD-WRT Device.
-* Setup your Wireless LAN. Disable encryption for the WLAN.+* Setup your Wireless LAN, but disable encryption for the WLAN for now.
* Check to make sure you can connect to the Internet from a Wireless client. * Check to make sure you can connect to the Internet from a Wireless client.
-* These instructions assume your DD-WRT Device currently provides your clients a homogeneous, private subnet. If this sounds technical, don't worry: it is the default setup of DD-WRT. The DD-WRT Device uses 192.168.1.1 as a LAN IP, and all clients are assigned an address automatically of 192.168.1.x. While other configurations are possible, the examples used here assume your DD-WRT Device is using the default settings.+* These instructions assume your DD-WRT Device currently provides your clients a single, homogeneous, private subnet. If this sounds technical, don't worry: it is the default setup of DD-WRT. By factory setup, a DD-WRT Device uses 192.168.1.1 as a LAN IP, and all clients are assigned an address automatically of 192.168.1.x. While other configurations are possible, the examples used here assume your DD-WRT Device is using the default settings.
* http://192.168.1.1: The assumed LAN IP address of your DD-WRT Device's Web Management. If you have changed this number, use in place, whatever you changed it to. * http://192.168.1.1: The assumed LAN IP address of your DD-WRT Device's Web Management. If you have changed this number, use in place, whatever you changed it to.
-* '''V23SP2 Introduces the option of Enabling 'Separation of Wifi [WLAN] from the LAN Bridge': having ChilliSpot control ONLY the WLAN interface.''' The WLAN is torn away from the combined WLAN+LAN Bridge (br0), and the DD-WRT Device behaves as if the WLAN and LAN are separate networks completely. Most guides including the WorldSpot.net guide, assume this 'Separate WiFi' configuration.<br>However:+* '''V23SP2 Introduces the option of Enabling 'Separation of Wifi [WLAN] from the LAN Bridge': having ChilliSpot control ONLY the WLAN interface.''' The WLAN is used only for Chillispot, and the existing DD-WRT Device settings are only used for the LAN. The DD-WRT Device behaves as if the WLAN and LAN are separate networks completely. Most guides including the WorldSpot.net guide, assume this 'Separate WiFi' configuration is Enabled.<br>However:
** If you have Secondary Access Points specifically to increase the WLAN coverage, and these SAP's are physically wired into the LAN ports on the main Chillispot'ed DD-WRT Device, you do not want to 'Separate Wifi from the LAN Bridge'. ** If you have Secondary Access Points specifically to increase the WLAN coverage, and these SAP's are physically wired into the LAN ports on the main Chillispot'ed DD-WRT Device, you do not want to 'Separate Wifi from the LAN Bridge'.
** If you have Public Access terminals which are Wired in, such as in a Library, to the DD-WRT Device, and you want these clients to be directed to the ChilliSpot Authentication Splash Page, you also do not want to 'Separate Wifi from the LAN Bridge'. ** If you have Public Access terminals which are Wired in, such as in a Library, to the DD-WRT Device, and you want these clients to be directed to the ChilliSpot Authentication Splash Page, you also do not want to 'Separate Wifi from the LAN Bridge'.
** If you want to maintain a homogeneous network [all internet-connected devices shares the same private subnet], of wireless and wired clients, and your wired clients have been made secure from wireless attacks [outside of the scope of this guide], then you do not want to 'Separate Wifi from the LAN Bridge'. ** If you want to maintain a homogeneous network [all internet-connected devices shares the same private subnet], of wireless and wired clients, and your wired clients have been made secure from wireless attacks [outside of the scope of this guide], then you do not want to 'Separate Wifi from the LAN Bridge'.
- 
-'''So, if you are not using 'Separate WiFi from LAN Bridge' the DD-WRT Device's DHCP Server must be off.''' Chillispot has it's own DHCP Server. For Clients to use the same subnet, as before enabling Chillispot, do as in the following example:<br> 
-::Your old private LAN subnet was 192.168.1.x and your DD-WRT Device LAN IP was 192.168.1.1. You must change the DD-WRT Device LAN IP to another subnet, such as 192.168.2.1, Apply, reconnect to the Administration Web Site of the DD-WRT Device at 192.168.2.1, and turn off the DD-WRT DHCP Server. After enabling and configuration of Chillispot, Chillispot creates a virtual LAN Adapter at 192.168.1.1 and provides DHCP Services on 192.168.1.x for all your Wireless and Wired clients. 
- 
-<sup>(2)</sup> <tt>net 192.168.1.0/24</tt> in DD-WRT's Chillispot, is labeled the "Remote Network" option, and entered simply as "192.168.1.0/24" 
- 
-<sup>(3)</sup> In DD-WRT, <tt>dynip 192.168.1.128/26</tt> is entered in the "Additional Chillispot Options" box. In this example, the dynip command has Chillispot's DHCP Server dispense address assignments from 192.168.1.128 to 192.168.1.191, to clients. IP's from 2 through 127 are left for fixed assignements. If <tt>dynip</tt> is not entered, Chillispot uses the range specified by <tt>net</tt>  
===Additional Prerequisites for Older Firmwares=== ===Additional Prerequisites for Older Firmwares===
Line 60: Line 56:
== Configuration== == Configuration==
-After carefully following the above section:+After carefully following the above sections:
-* Simply enable Chillispot:+
-**V24Final: Services, Hotspot - Chillispot section.+
-**V23xx: Administration, Hotspot - Chillispot section.+
-** Enable Chillispot+
-Two Networks, WLAN separate from LAN:+'''If you are not enabling/using 'Separate WiFi from LAN Bridge' the DD-WRT Device's DHCP Server must be off.''' Chillispot has it's own DHCP Server. For Clients to use the same subnet, as before enabling Chillispot, do as in the following example:<br>
-If you choose 'Chillispot - Separate WiFi from the LAN Bridge' - ENABLE:+::Your old private LAN subnet was 192.168.1.x and your DD-WRT Device LAN IP was 192.168.1.1. You must now change the DD-WRT Device LAN IP to another subnet, such as 192.168.2.1, Apply, reconnect to the Administration Web Site of the DD-WRT Device on 192.168.2.1, and turn off the DD-WRT DHCP Server. Now, the LAN IP of the DD-WRT Device does not interact with Clients. After enabling and configuration of Chillispot (covered later), Chillispot will create a virtual LAN Adapter at 192.168.1.1 and provides DHCP Services on 192.168.1.x for all your Wireless and Wired clients.
-* Chillispot '''DHCP Interface''', select WLAN.+
-* '''Remote Network''': the default value is '192.168.182.0/24' (192.168.182.x), but you can choose something else, so long as it is NOT your existing DD-WRT LAN Range, e.g. '192.168.1.0/24'.+
-* Bridge Separation makes ChilliSpot control only your WLAN. The wired LAN continues to connect directly to the Internet without going through Chillispot, as before Chillispot was enabled. Your LAN ports are also inaccessible by your WiFi users.+
One Network: One Network:
Keep your pre-Chilli private subnet throughout. 'Separate WLAN from LAN' - DISABLE Keep your pre-Chilli private subnet throughout. 'Separate WLAN from LAN' - DISABLE
-* Requires changing the DD-WRT Device LAN IP in the Basic DD-WRT settings and turning off DD-WRT's DHCP Server.+* Requires changing the DD-WRT LAN IP in Basic DD-WRT settings to 192.168.2.1
-** You must change the IP of your computer after this, to continue to talk to the DD-WRT device.+** Applying
-* '''Chillispot - DHCP Interface - LAN''' This option is misleading, the documentation is poor. This choice should be labeled 'WLAN & LAN', as it means the br0 interface.+** Changing the LAN IP of YOUR Client temporarily to 192.168.2.10
-* '''Chillispot - Remote Network: 192.168.1.0/24'''. Or whatever the DD-WRT DHCP Server range was prior to Chillispot. Chillispot takes over this DHCP Server function.+** Reconnecting to the Web Interface of DD-WRT on 192.168.2.1
 +* and on the DD-WRT Basic page, turning off DD-WRT's DHCP Server.
 + 
 +Now enable Chillispot options:
 + * V24Final: Services, Hotspot - Chillispot section.
 + * V23xx: Administration, Hotspot - Chillispot section.
 + * Enable Chillispot
 + 
 +Two Networks, WLAN separate from LAN:
 +If you choose to have a Chillispot-managed WLAN, and leave your LAN as before 'Separate WiFi from the LAN Bridge' - ENABLE, also select:
 +* Chillispot '''DHCP Interface''', select WLAN.
 +* '''Remote Network''': the default value is '192.168.182.0/24' (192.168.182.x), but you can choose something else, so long as it is NOT your existing DD-WRT LAN Range of '192.168.1.0/24'.
 +* This 'Bridge Separation' makes ChilliSpot control only your WLAN. The wired LAN continues to connect directly to the Internet without going through Chillispot, as before Chillispot was enabled. Your LAN ports are also inaccessible by your WiFi users.
-** '''RADIUS Server 1''' to be the IP address of a your primary RADIUS server.+** '''RADIUS Server 1''' As assigned by On-line Chillispot Back-end Provider. the IP address of your primary RADIUS server.
-** '''RADIUS Server 2''' to be the IP address of a your secondary RADIUS server.+** '''RADIUS Server 2''' As assigned by OCBP. The IP address of your secondary RADIUS server.
-*** If you have only one Radius Server, leave as 0.0.0.0 or specify Radius Server #1+*** If you have only one Radius Server, leave as 0.0.0.0 or specify the same field value of Radius Server 1.
-** '''DNS Server''' to be the 1st Internet DNS server+** '''DNS IP''' YOUR ISP's 1st DNS Server.
-** '''Shared Key''' put your RADIUS secret password+** '''Remote Network''' 192.168.1.0/24 <sup>(1)</sup>
-** '''RADIUS NASID''': the RADIUS name of your Hotspot+** '''Redirect URL''' As given by your Online Chillispot Back-end Provider. The address of the UAM Server, the web authentication portal.
-** '''Redirect URL''' is the address of the UAM Server, the web authentication portal.+** '''Shared Key''' As given by your OCBP. It's also called your RADIUS secret password
 +** '''RADIUS NAS ID''' As given by your OCBP. The RADIUS name of your Hotspot
** '''UAM Secret''' is a secret password between the Redirect URL and the Hotspot. ** '''UAM Secret''' is a secret password between the Redirect URL and the Hotspot.
 +** '''UAM AnyDNS''' Allows Clients to use their own DNS servers. Allows ANY traffic through port 53. Only set this to 1 if you know what you are doing, and can reconfigure IPTABLES properly!
** '''UAM Allowed''' is a list of websites that unauthenticated users are allowed to access. ** '''UAM Allowed''' is a list of websites that unauthenticated users are allowed to access.
 +** '''MacAUTH''' Enabled or Disabled. Allows authentication of clients by their WLAN or LAN card MAC (hardware) address. Not used in this guide.
 +** '''Additional Chillispot Options'''
 +*** If your local domain is 'local', then<br>
 +::<tt>domain local</tt>
 +**** Your provider may offer another, optional setting for domain.
 +*** If your second Internet DNS is for example 4.2.2.4, then for redundancy<br>
 +::<tt>dns2 4.2.2.4</tt>
 +*** To tell Chillispot to issue addresses 192.168.1.128 through 191 to clients (DHCP)<br>
 +::<tt>dynip 192.168.1.128/26</tt> <sup>(2)</sup>
-'''Additional Chillispot Options'''+* Apply Changes/Save, and if needed, reboot your DD-WRT Device.
-* If your second Internet DNS is 4.2.2.4, then<br>+* Your Chillispot Hotspot should work now. If you tested your wireless client device before setting up Chillispot, repair the WLAN in XP to get a new Chillispot-provided IP address.
-:<tt>dns2 4.2.2.4</tt>+
-* For WorldSpot.net users:<br>+
-:<tt>domain key.worldspot.net</tt>+
-* To tell Chillispot to issue addresses 192.168.1.128 through 191 to clients (DHCP)<br>+
-:<tt>dynip 192.168.1.128/26</tt>+
-* Apply Changes/Save, and if needed, reboot your router.+<sup>(1)</sup> Remote Network is the same as the <tt>net</tt> command, found on the Internet, elsewhere in references to ChilliSpot configuration and chilli.conf. <tt>net</tt> defines the Chillispot network. In DD-WRT, the field is called Remote Network, but it is the same setting as <tt>net</tt>.
-* Your Chillispot Hotspot should work now. If you tested your wireless client device before setting up Chillispot, restart (repair the WLAN in XP, or disable it and then enable it again) to get a new Chillispot-provided IP address.+ 
 +<sup>(2)</sup> <tt>dynip</tt> tells Chillispot to use a limited range of IP's within <tt>net</tt> for the Client DHCP pool, instead of using the entire <tt>net</tt> range. In this example, address assignments from 192.168.1.128 to 192.168.1.191 are given to Clients. IP's from 2 through 127 are left for fixed assignements, and can be used by <tt>statip</tt>, or used by existing network servers.
==Notes== ==Notes==
-IMPORTANT: When doing this, chillispot will manage you LAN ports, and may block any access to the DD-WRT admin interface. You must make sure that you can reach DD-WRT admin interface from the WAN port BEFORE setting up chillispot.+If you are not knowledgeable about your LAN security, or have insecure (i.e. poorly configured XP) devices on your LAN, to reduce possible attacks from WLAN Clients, you can enable the option: "Separate WiFi from the LAN Bridge" (your LAN won't be visible to WLAN Clients). If you /know/ your LAN is configured as secure, which it should be anyway, and you want to have access to your LAN equipment from your WLAN, then leave "Separate..." Disabled.
-Note: It is strongly recommended that you use v23sp2 version to enable the option: "separate wifi from the wireless bridge" +* Chillispot will not start unless it can see the DNS Server specified the Chillispot settings.
-This is required to ensure security of your Hotspot (your LAN won't be visible)+* Note that after reboot, it can take a certain time before a wifi client receives an IP address. Don't forget to enable automatic ip assignment (dhcp) on your Client Wireless or Wired Interfaces when testing!
- +
-* Chillispot will not start unless it can see the dns server specified the chillispot settings.+
-* Note that after reboot, it can take a certain time before you wifi client will get its ip address. Don't forget to enable automatic ip assignment (dhcp) on your client wifi interface!+
- +
-* Chillispot is operating on the wrt if your client picks up a DHCP address of 192.168.182.2 +
==Troubleshooting== ==Troubleshooting==
-===You get an IP (192.168.182.X) but you see no welcome page===+===Your Client gets a Chillispot IP but you see no welcome page===
Maybe you are using a PPPOE modem and went into the MTU bug. Maybe you are using a PPPOE modem and went into the MTU bug.
More info [http://www.chillispot.org/forum/viewtopic.php?t=1038 in this forum post] More info [http://www.chillispot.org/forum/viewtopic.php?t=1038 in this forum post]
-===Administration/Hotspot/Chillispot tab does not show===+===DD-WRT Firmware: Administration/Hotspot/Chillispot tab does not show===
-# Make sure you are using a package that includes chillispot. Chillispot is not in the micro and mini versions of dd-wrt (consult [[What_is_%22DD-WRT%22%3F#v23_File_Versions|this table]]).+Make sure you are using a package that includes chillispot. Chillispot is not in the micro and mini versions of dd-wrt (consult [[What_is_%22DD-WRT%22%3F#v23_File_Versions|this table]]).
===Connection Failed on Older Firmwares=== ===Connection Failed on Older Firmwares===
-If your client does not recieve 192.168.182.x address via chillispot you may have changed the Chillispot DHCP Interface. Touching this setting breaks Chillispot on Sp23 V2. A fix is to reset to factory defaults and re-enter all your settings.+If your client does not recieve a Chillispot IP address you may have changed the Chillispot DHCP Interface. On older versions of DD-WRT Firmware, touching this setting breaks Chillispot. A fix is to reset to factory defaults and re-enter all your settings or use newer firmware.
- +
-If the UAM secret is bad, you will have an authentication failure.+
-If the RADIUS shared secret is bad, the login process will hang.+If the UAM Secret you entered in Chillispot Settings is incorrect, you will have an authentication failure.
-If you are using the radius server at www.chillispot.org you may find you can't get past the HotRadius Login page. Then try creating a www.worldspot.net account, it even shows you the exact entrys to copy and paste into your dd-wrt chillispot page.+If the RADIUS Shared Secret is incorrect, the login process will hang.
=== More things to try=== === More things to try===
Line 140: Line 141:
ping google.com ping google.com
-if you don't have any ping return, check the output of "ifconfig", and post it on the [http://worldspot.net/forum/ WorldSpot forum]+Worldspot Users: if you don't have any ping return, check the output of "ifconfig", and post it on the [http://worldspot.net/forum/ WorldSpot forum]
If internet works from your router but you don't have chillispot working, check first that the chillispot process is launched with If internet works from your router but you don't have chillispot working, check first that the chillispot process is launched with
Line 146: Line 147:
ps -ef ps -ef
-You should see a "chilli" process. If not, recheck your chillispot settings. For example, if you put a whitespace in the NASID, the chilli process won't launch.+You should see a "chilli -c /tmp/chilli.conf" process. If not, recheck your chillispot settings. For example, if you put a whitespace in the NAS ID, the chilli process won't launch.
-If you need more assistance, you can post on the [http://worldspot.net/forum/ WorldSpot forum]+Worldspot Users: If you need more assistance, you can post on the [http://worldspot.net/forum/ WorldSpot forum]
==For the FON Hotspot== ==For the FON Hotspot==
Line 154: Line 155:
Please see the [[FON Hotspot|FON Hotspot]] page for a guide and advice on setting up a [http://www.fon.com FON] hotspot using DD-WRT and Chillispot. Please see the [[FON Hotspot|FON Hotspot]] page for a guide and advice on setting up a [http://www.fon.com FON] hotspot using DD-WRT and Chillispot.
-==Links for Online Chillispot Back-end Providers==+==List of Online Chillispot Back-end Providers==
-A hosted Chillispot portal can be used to speed-up HotSpot setup and Management, and ease payment and other back-end requirements. Only a router is necessary, the rest is done by third parties listed below.<br>+A hosted Chillispot portal can be used to speed-up HotSpot setup and Management, and ease payment and other back-end requirements. Only a DD-WRT Device is necessary, the rest is done by third parties listed below.<br>
'''Disclaimer: NONE of the following links are endorsements. You are Entirely Responsible Solely for your Choices.''' '''Disclaimer: NONE of the following links are endorsements. You are Entirely Responsible Solely for your Choices.'''

Revision as of 20:05, 13 August 2008


Contents

Brief Introduction

Chillispot:

  • Is a complete authentication and management system for Hotspots.
    • Tickets can be generated producing income or limiting use
    • The DD-WRT Device can also be setup as free to use.
  • At no direct cost to the DD-WRT Device Owner or Operator, the WLAN and/or LAN connections of the DD-WRT Device can force clients to look at an initial web page. Such as:
    • Hotspot News
    • Access Agreement
    • Disclaimer
    • Usage Policy

The above items can all appear on Client Screens. While Disclaimers are a practical basic necessary in some legal regions when providing Internet Access to unknown persons - additional news or usage agreements, or advertising, are more helpful on a daily basis. Consult a legal professional for specific advice on Disclaimers and Usage Agreements, or ignore it and have a fun life, and possibly a friend named Bubba.

Terms and Definitions

  • Client Computer: Your laptop
  • DD-WRT Device: Your Linksys WRT54GL or equivalent
  • Chillispot Account: Your [free] account on WorldSpot.net or another On-line Provider of Chillispot services.
  • Chillispot Service Provider: An on-line (Internet-based) provider of the necessary Back-end Services for the DD-WRT Device running Chilllispot.

Prerequisites & Assumptions

Obviously:

  • A DD-WRT-Compatible Device programmed with V24 Final or V23SP2. This will be your public access point, Chilli-enabled.
  • Check to make sure that you can connect to the Internet from your computer. If not, configure your Internet connection.
  • For those using an On-line Chillispot Back-end Provider, the DD-WRT Device must already have Internet access. Example, check your laptop is working through the DD-WRT Device to get Internet.
  • When using Chillispot without using an on-line Chillispot Back-end Provider service, you must provide your own Web Server to host the redirect website and a Radius Server for accounting. The Web Server and Radius Server may be installed on the same machine, but generally not the DD-WRT Device. Installation and Set-up of Chillispot without an Online Chillispot Back-end Provider is beyond the scope of this guide.
  • The advantage of a Chillispot Service Provider is Chillispot can be up and running in minutes.
    • Create a Chillispot Account on WorldSpot.net or equivalent provider.
    • After signing up, WorldSpot.net gives you a convenient customized screen-image (based on V2.3SP2) displaying the entries for the DD-WRT Device. Other providers may do the same.
  • A cable connecting to your laptop LAN port and a LAN port on the DD-WRT Device.
  • The DD-WRT Device's Web Management Interface must work. You should be able to connect to at http://192.168.1.1/ (default), or whatever LAN IP you have set your DD-WRT Device.
  • Setup your Wireless LAN, but disable encryption for the WLAN for now.
  • Check to make sure you can connect to the Internet from a Wireless client.
  • These instructions assume your DD-WRT Device currently provides your clients a single, homogeneous, private subnet. If this sounds technical, don't worry: it is the default setup of DD-WRT. By factory setup, a DD-WRT Device uses 192.168.1.1 as a LAN IP, and all clients are assigned an address automatically of 192.168.1.x. While other configurations are possible, the examples used here assume your DD-WRT Device is using the default settings.
  • http://192.168.1.1: The assumed LAN IP address of your DD-WRT Device's Web Management. If you have changed this number, use in place, whatever you changed it to.
  • V23SP2 Introduces the option of Enabling 'Separation of Wifi [WLAN] from the LAN Bridge': having ChilliSpot control ONLY the WLAN interface. The WLAN is used only for Chillispot, and the existing DD-WRT Device settings are only used for the LAN. The DD-WRT Device behaves as if the WLAN and LAN are separate networks completely. Most guides including the WorldSpot.net guide, assume this 'Separate WiFi' configuration is Enabled.
    However:
    • If you have Secondary Access Points specifically to increase the WLAN coverage, and these SAP's are physically wired into the LAN ports on the main Chillispot'ed DD-WRT Device, you do not want to 'Separate Wifi from the LAN Bridge'.
    • If you have Public Access terminals which are Wired in, such as in a Library, to the DD-WRT Device, and you want these clients to be directed to the ChilliSpot Authentication Splash Page, you also do not want to 'Separate Wifi from the LAN Bridge'.
    • If you want to maintain a homogeneous network [all internet-connected devices shares the same private subnet], of wireless and wired clients, and your wired clients have been made secure from wireless attacks [outside of the scope of this guide], then you do not want to 'Separate Wifi from the LAN Bridge'.

Additional Prerequisites for Older Firmwares

  • Firmware V23xx: If you haven't reset to factory settings after installation, do it, then reboot once more.

Anyone familiar with the V23-series firmwares, please change the above point if this is only needed on specific revisions

  • Resetting to factory defaults is NOT needed for V24Final.

Configuration

After carefully following the above sections:

If you are not enabling/using 'Separate WiFi from LAN Bridge' the DD-WRT Device's DHCP Server must be off. Chillispot has it's own DHCP Server. For Clients to use the same subnet, as before enabling Chillispot, do as in the following example:

Your old private LAN subnet was 192.168.1.x and your DD-WRT Device LAN IP was 192.168.1.1. You must now change the DD-WRT Device LAN IP to another subnet, such as 192.168.2.1, Apply, reconnect to the Administration Web Site of the DD-WRT Device on 192.168.2.1, and turn off the DD-WRT DHCP Server. Now, the LAN IP of the DD-WRT Device does not interact with Clients. After enabling and configuration of Chillispot (covered later), Chillispot will create a virtual LAN Adapter at 192.168.1.1 and provides DHCP Services on 192.168.1.x for all your Wireless and Wired clients.

One Network: Keep your pre-Chilli private subnet throughout. 'Separate WLAN from LAN' - DISABLE

  • Requires changing the DD-WRT LAN IP in Basic DD-WRT settings to 192.168.2.1
    • Applying
    • Changing the LAN IP of YOUR Client temporarily to 192.168.2.10
    • Reconnecting to the Web Interface of DD-WRT on 192.168.2.1
  • and on the DD-WRT Basic page, turning off DD-WRT's DHCP Server.

Now enable Chillispot options:

   * V24Final: Services, Hotspot - Chillispot section.
   * V23xx: Administration, Hotspot - Chillispot section.
   * Enable Chillispot 

Two Networks, WLAN separate from LAN: If you choose to have a Chillispot-managed WLAN, and leave your LAN as before 'Separate WiFi from the LAN Bridge' - ENABLE, also select:

  • Chillispot DHCP Interface, select WLAN.
  • Remote Network: the default value is '192.168.182.0/24' (192.168.182.x), but you can choose something else, so long as it is NOT your existing DD-WRT LAN Range of '192.168.1.0/24'.
  • This 'Bridge Separation' makes ChilliSpot control only your WLAN. The wired LAN continues to connect directly to the Internet without going through Chillispot, as before Chillispot was enabled. Your LAN ports are also inaccessible by your WiFi users.
    • RADIUS Server 1 As assigned by On-line Chillispot Back-end Provider. the IP address of your primary RADIUS server.
    • RADIUS Server 2 As assigned by OCBP. The IP address of your secondary RADIUS server.
      • If you have only one Radius Server, leave as 0.0.0.0 or specify the same field value of Radius Server 1.
    • DNS IP YOUR ISP's 1st DNS Server.
    • Remote Network 192.168.1.0/24 (1)
    • Redirect URL As given by your Online Chillispot Back-end Provider. The address of the UAM Server, the web authentication portal.
    • Shared Key As given by your OCBP. It's also called your RADIUS secret password
    • RADIUS NAS ID As given by your OCBP. The RADIUS name of your Hotspot
    • UAM Secret is a secret password between the Redirect URL and the Hotspot.
    • UAM AnyDNS Allows Clients to use their own DNS servers. Allows ANY traffic through port 53. Only set this to 1 if you know what you are doing, and can reconfigure IPTABLES properly!
    • UAM Allowed is a list of websites that unauthenticated users are allowed to access.
    • MacAUTH Enabled or Disabled. Allows authentication of clients by their WLAN or LAN card MAC (hardware) address. Not used in this guide.
    • Additional Chillispot Options
      • If your local domain is 'local', then
domain local
        • Your provider may offer another, optional setting for domain.
      • If your second Internet DNS is for example 4.2.2.4, then for redundancy
dns2 4.2.2.4
      • To tell Chillispot to issue addresses 192.168.1.128 through 191 to clients (DHCP)
dynip 192.168.1.128/26 (2)
  • Apply Changes/Save, and if needed, reboot your DD-WRT Device.
  • Your Chillispot Hotspot should work now. If you tested your wireless client device before setting up Chillispot, repair the WLAN in XP to get a new Chillispot-provided IP address.

(1) Remote Network is the same as the net command, found on the Internet, elsewhere in references to ChilliSpot configuration and chilli.conf. net defines the Chillispot network. In DD-WRT, the field is called Remote Network, but it is the same setting as net.

(2) dynip tells Chillispot to use a limited range of IP's within net for the Client DHCP pool, instead of using the entire net range. In this example, address assignments from 192.168.1.128 to 192.168.1.191 are given to Clients. IP's from 2 through 127 are left for fixed assignements, and can be used by statip, or used by existing network servers.

Notes

If you are not knowledgeable about your LAN security, or have insecure (i.e. poorly configured XP) devices on your LAN, to reduce possible attacks from WLAN Clients, you can enable the option: "Separate WiFi from the LAN Bridge" (your LAN won't be visible to WLAN Clients). If you /know/ your LAN is configured as secure, which it should be anyway, and you want to have access to your LAN equipment from your WLAN, then leave "Separate..." Disabled.

  • Chillispot will not start unless it can see the DNS Server specified the Chillispot settings.
  • Note that after reboot, it can take a certain time before a wifi client receives an IP address. Don't forget to enable automatic ip assignment (dhcp) on your Client Wireless or Wired Interfaces when testing!

Troubleshooting

Your Client gets a Chillispot IP but you see no welcome page

Maybe you are using a PPPOE modem and went into the MTU bug. More info in this forum post

DD-WRT Firmware: Administration/Hotspot/Chillispot tab does not show

Make sure you are using a package that includes chillispot. Chillispot is not in the micro and mini versions of dd-wrt (consult this table).

Connection Failed on Older Firmwares

If your client does not recieve a Chillispot IP address you may have changed the Chillispot DHCP Interface. On older versions of DD-WRT Firmware, touching this setting breaks Chillispot. A fix is to reset to factory defaults and re-enter all your settings or use newer firmware.

If the UAM Secret you entered in Chillispot Settings is incorrect, you will have an authentication failure.

If the RADIUS Shared Secret is incorrect, the login process will hang.

More things to try

If it does not work, you must connect with ssh or telnet to your router.

login: root 
password: <your password>

First, check that you have internet access:

ping google.com

Worldspot Users: if you don't have any ping return, check the output of "ifconfig", and post it on the WorldSpot forum

If internet works from your router but you don't have chillispot working, check first that the chillispot process is launched with

ps -ef

You should see a "chilli -c /tmp/chilli.conf" process. If not, recheck your chillispot settings. For example, if you put a whitespace in the NAS ID, the chilli process won't launch.

Worldspot Users: If you need more assistance, you can post on the WorldSpot forum

For the FON Hotspot

Please see the FON Hotspot page for a guide and advice on setting up a FON hotspot using DD-WRT and Chillispot.

List of Online Chillispot Back-end Providers

A hosted Chillispot portal can be used to speed-up HotSpot setup and Management, and ease payment and other back-end requirements. Only a DD-WRT Device is necessary, the rest is done by third parties listed below.
Disclaimer: NONE of the following links are endorsements. You are Entirely Responsible Solely for your Choices.

Note: WorldSpot.net has been recommended by many people as having the best support and development. Some of the links are simply ads which were inserted into this Wiki in a badly-organized fashion (HotSpotExpress.In), if this helps inform you about which one to test.

WorldSpot.net. Free for free hotspots. Earn 75% in revenue sharing.
Skyrove free for free hotspots only, otherwise a payed account is required.
HotSpotSystem.com. Free sign up with a revenue share based solution for paid hotspots.
Hotspotexpress HotSpot services to use with Chillispot]

Any of these systems linked above are designed to replace both a local radius server and webserver, and bring powerful features. Simply register online and create your hotspot. Then you can get the chillispot configuration setting:

SkyRove Chillispot Page
Setup DD-WRT for WorldSpot
HotSpotSystem.com to enter in the steps below, and you can get your hotspot working in some minutes.
Chillispot info