From DD-WRT Wiki

Revision as of 21:40, 29 July 2009 by S2s2 (Talk | contribs)
Jump to: navigation, search


Brief Introduction

Executive Summary

ChilliSpot (chilli, chillispot) is a way to

  • Easily make the wireless or lan-connected computers display a 'landing page' on user's browsers.
  • Redirection occurs on the first web page, and until the user clicks through (I Agree/Login).
  • Optionally earn revenue from your hotspot.
  • Provide a WiFi usage agreement, advertising or other neighbourhood or commercial activities.
  • Pro-active over-use prevention:
  • Limit the bandwidth, up and down, hotspot-connected laptops or desktops can use.
  • Limit the number of times within a given period hotspot users can log in.
  • Other fine-grained limitations.

ChilliSpot can be used for single router, or extended with the use of external services to cover an entire metropolitan area.

Technical Description

ChilliSpot is an open source Captive_Portal wireless or LAN access point controller. It is used for authenticating users. It supports web based login which is today's standard for public HotSpots. Authentication, authorization and accounting (AAA) is handled by an on-line provider, or a local radius service you provide.

Chillispot cannot work alone and needs two (2) additional services, provided externally:

  • A Web Portal to which users are redirected. This portal can provide any mean of access control service such as user login, on-line billing, etc...
  • A Radius service for authentication and accounting. Most of the time, the Radius server and the web server will be tightly integrated to offer advanced services.
  • There are several on-line providers (Chillispot Service Provider, CSP) that have the additional services needed to make Chillispot work: Captive_Portal#Provider
  • The advantage of a CSP is your Chillispot hotspot can be up and running in minutes. website is only a copy of the original website, without any development. DD-WRT uses an older version of chillispot. Chillispot development continued, and it is possible to load the latest release of Chillispot into DD-WRT (more later, in an update to this DD-WRT Wiki article).

Also, CoovaChilli is another entire firmware distribution, based on OpenWRT, and available here. It includes the most recent version of Chillispot, but requires changing your router flash and learning a completely new way of setting up the router, especially problematic if you use your router for anything other than just a Chillispot portal. Since this is the DD-WRT Wiki, and not the OpenWRT Wiki, we are not going to cover CoovaChilli here.

More general ChilliSpot information

Terms and Definitions

  • DD-WRT Device: Your DD-WRT-flashed device!
  • Chillispot Account: Your [free] account on or another On-line Provider of Chillispot services.
  • Chillispot Service Provider (CSP): An on-line (Internet-based) provider of the necessary back-end services for the DD-WRT Device running Chillispot. The major contributor to this Wiki and other authors use, but other CSP's are available. If you have good success and are familiar with Wiki-editing and Chilli, please update this Wiki with your preferred provider. A list of CSP's is at the bottom.


  • A DD-WRT-Compatible device programmed with a distribution of DD-WRT containing Chilli. Mini and Standard versions V23SP2, or for a more recent stable build, build 12307 DD-WRT (post V24SP2). See general flashing instructions elsewhere in the DD-WRT Wiki.
  • For those using a CSP, the DD-WRT Device must already have Internet access. Example, check your wireless laptop is working through the DD-WRT Device to get web pages.
  • Important: For easy setup, Internet should come from the WAN (Internet) port of the router (normal router mode), not from the LAN port (router in AP-only mode).
  • If you are adding the DD-WRT Device to an existing network, and your existing network has a subnet like 192.168.1.X, which is probable, there will be a conflict with DD-WRT Device default LAN subnet. You must change the DD-WRT LAN IP address to another subnet, like 192.168.2.x.
    • If you chain your hotspot off your existing LAN network, the DD-WRT WAN interface will be inside this network. It is recommended that you open management interfaces on DD-WRT to the WAN-side so you can control the DD-WRT web interface from your existing network.
  • Create a Chillispot Account on a CSP.
    • After signing up, the CSP should show you a convenient customized screen-image displaying the entries for the DD-WRT Device.
  • An ethernet cable to connect your laptop LAN port to a LAN port on the DD-WRT Device.
  • The DD-WRT Device's Web Management Interface must work. You should be able to connect to at http://192.168.x.1/, or whatever LAN IP you have set your DD-WRT Device.
  • Set-up your DD-WRT Device's Wireless LAN, but disable encryption for the WiFi for now.
  • Check to make sure you can connect to the Internet from a Wireless client.
  • These instructions assume your DD-WRT Device currently provides your clients a single, homogeneous, private subnet. If this sounds technical, don't worry: it is the default setup of DD-WRT. By factory setup, a DD-WRT Device uses as a LAN IP, and all clients are assigned an address automatically of 192.168.1.x. While other configurations are possible, the examples used here assume your DD-WRT Device is using the default settings.
  • The assumed LAN IP address of your DD-WRT Device's Web Management. If you have changed this number, use the new number.
  • Experts: When using Chillispot without using a CSP, you must provide your own Web Server to host the redirect website and a Radius Server for accounting. The Web Server and Radius Server may be installed on the same machine, but generally not the DD-WRT Device. Installation and Set-up of Chillispot without a CSP is beyond the scope of this Wiki article.
  • V23SP2 Introduces the option of Enabling 'Separation of Wifi from the LAN Bridge': having ChilliSpot control only wireless clients. The existing DD-WRT Device settings are only used for the LAN. Clients behave as if the WiFi and LAN connections are separate networks completely. Most guides including the guide, assume this 'Separate WiFi' configuration is Enabled.
    However, new configurations are available with this option:
    • If you have Secondary Access Points specifically to increase the WiFi coverage, and these SAP's are physically wired into the LAN ports on the main Chillispot'ed DD-WRT Device, you do not want to 'Separate Wifi from the LAN Bridge'. Configurations A or B.
    • If you have Public Access terminals which are Wired in, such as in a Library, to the DD-WRT Device, and you want these clients to be directed to the ChilliSpot Authentication Splash Page, you also do not want to 'Separate Wifi from the LAN Bridge'. Configuration A.
    • If you want to maintain a homogeneous network [all internet-connected devices shares the same private subnet], of wireless and wired clients, and your wired clients have been made secure from wireless attacks [outside of the scope of this guide], then you do not want to 'Separate Wifi from the LAN Bridge'. Configuration B.

Additional Prerequisites for Older Firmware

  • Firmware V23xx: If you haven't reset to factory settings after installation, do it, then reboot once more.
Anyone familiar with the V23-series firmware, please change the above point if this is only needed on specific revisions
  • Resetting to factory defaults is NOT needed for V24Final and later.


After carefully following the above sections:

Three (3) options:

  • New Box: Hang a new DD-WRT Device with Chilli, off an existing LAN.
  • One (1) network: Keep both the WLAN & LAN clients on chillspot, or
  • Two (2) networks: Keep the existing LAN clients on normal services while splitting off the WLAN clients to chilli.

Configuration A: New DD-WRT Device, Hotspot Only

Add chilli hotspot services to an existing network.

The existing network is not changed at all.

All existing clients operate as before.

A connection from the existing network is plugged into the WAN port on the DD-WRT device. Besides changing the DD-WRT Device to allow WAN access to SSHd and the Web Interface, the steps are nearly identical to 'One Network Subnet'.

Configuration B: One Network Subnet

Keep your pre-Chilli setup throughout. Move all clients to chilli.

Also known as, 'Separate WLAN from LAN' - Disable.

Chillispot has it's own DHCP Server. If 'Separate WiFi from LAN Bridge' is disabled, the DD-WRT Device's normal DHCP Server must be off.

Your existing LAN subnet was 192.168.1.x and your DD-WRT Device LAN IP was

  1. From the DD-WRT Web Setup page, change the DD-WRT Device LAN IP to another subnet, such as & press Apply.
  2. Reconfigure your LAN client with, and reconnect to the Administration Web Site of the DD-WRT Device on
  3. From the Setup (Main page) of the Web Interface, turn off the DD-WRT DHCP Server.
Now, clients are temporarily no longer receiving a DHCP assignment. After enabling and configuration of Chillispot (covered later), Chillispot will create a virtual LAN Adapter at and provides DHCP Services again on 192.168.1.x for all your Wireless and Wired clients.
Now enable Chillispot options:
    1. With v24: Services, Hotspot - Chillispot section. or
    2. With v23xx: Administration, Hotspot - Chillispot section.
  1. Enable Chillispot
  2. Fill in the information provided by the CSP
  3. Continue on to the next section, "Chillispot setup, detailed options".

Configuration C: Two Networks, WiFi separated from LAN

If you choose to have a Chillispot-managed WiFi, and leave your LAN alone:

The assumption here is your existing DD-WRT setup uses as the IP range and your DD-WRT Device is at Substitute your own numbers if there is a difference.
  1. 'Separate WiFi from the LAN Bridge' - ENABLE
  2. Enable Chillispot
  3. Chillispot DHCP Interface, select WLAN.
These steps do 'Bridge Separation'. It makes ChilliSpot control only your DD-WRT Device's Wireless. The wired LAN continues to connect directly to the Internet without going through Chillispot, as before Chillispot was enabled. Your LAN ports are also inaccessible by the WiFi-connected computers.

Chillispot setup: detailed options

  • RADIUS Server 1 As assigned by CSP. the IP address of your primary RADIUS server.
  • RADIUS Server 2 As assigned by CSP. The IP address of your secondary RADIUS server.
    • If you have only one Radius Server, leave as or specify the same field value of Radius Server 1.
  • DNS IP Your Internet provider's 1st DNS Server. This is available on the DD-WRT Device Status page.
  • Remote Network (1)
  • For One Network, change the default to, or your old subnet.
  • For Two Networks, it's here by default.
  • One could choose something else, like, so long as it is not the existing DD-WRT LAN subnet.
  • Redirect URL As given by your CSP. The address of the UAM Server, the web authentication portal.
  • Shared Key As given by your CSP. It's also called your RADIUS secret password
  • RADIUS NAS ID As given by your CSP. The RADIUS name of your Hotspot
  • UAM Secret is a secret password between the Redirect URL and the Hotspot. Given by the CSP.
  • UAM AnyDNS Allows Clients to use their own DNS servers. Allows ANY traffic through port 53. Only set this to 1 if you know what you are doing, and can reconfigure IPTABLES properly!
  • UAM Allowed is a list of websites that unauthenticated users are allowed to access.
  • MacAUTH Enabled or Disabled. Allows authentication of clients by their WLAN or LAN card MAC (hardware) address. Not used in this guide.
  • Additional Chillispot Options
    • If your local domain is 'local', then
      domain local
    • Your provider may offer another, optional setting for domain.
    • If your second Internet provider's DNS is for example, then for redundancy
    • To tell Chillispot to limit DHCP addresses to be part of the entire subnet:
  • dynip (2)
  • Can be most helpful in a 'one network' subnet setup.
  • Allows fixed IP's to exist from through 127 for your existing devices.
  • Apply Changes/Save, and if needed, reboot your DD-WRT Device.
  • Your Chillispot Hotspot should work now. If you tested your wireless client device before setting up Chillispot, repair the WLAN in XP to get a new Chillispot-provided IP address.

(1) Remote Network is the same as the net command, found on the Internet, elsewhere in references to ChilliSpot configuration and chilli.conf. net defines the Chillispot network. In DD-WRT, the field is called Remote Network, but it is the same setting as net.

(2) dynip configures chillispot to use a limited range of IP's within the net parameter, as the client DHCP pool, instead of using the entire net range. In this example, address assignments from to are assigned to clients. IP's from 2 through 127 are left for fixed assignments, and can be further specified by statip if DHCP clients come on the network which need a specific address from the chilli DHCP service.

Completing Configuration

When enabling chillspot, don't leave httpd running!

  • The Web Interface uses about 3 megabytes of RAM. That's 19% of a typical 16-megabyte DD-WRT Device's RAM.
  • Chilli also uses about 19%, or 3 megabytes.
  • Look below for how to run the Web Interface (httpd) as-needed.


If you are not knowledgeable about your LAN security, or have insecure (i.e. poorly configured XP) devices on your LAN, to reduce possible attacks from wireless clients, you can enable the option: "Separate WiFi from the LAN Bridge" (your LAN won't be visible to wireless clients). If you /know/ your LAN is configured as secure, which it should be anyway, and you want to have access to your LAN equipment from your WiFi, then leave "Separate..." Disabled.

  • Chillispot will not start unless it can see the DNS Server specified the Chillispot settings.
  • Note that after reboot, it can take a certain time before a wireless client receives an IP address. Don't forget to switch back to automatic IP assignment (DHCP) on your client when testing!


Your Client gets a Chillispot IP but no welcome page, or certain websites don't open (MTU Bug)

Maybe you are using a PPPOE modem and you are experiencing the MTU bug?

Add this to your Firewall Commands (Administration tab in the Web Interface, Commands sub-tab): Changes MSS to fit inside Chillispot tunnel. Important so some websites work properly, otherwise 'MTU Bug'

/usr/sbin/iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1421:65535 -j TCPMSS --clamp-mss-to-pmtu

More info in this forum post

Chillispot fails after awhile

This is a common problem when the infrequently-used Web Interface (httpd) is left running.

On a DD-WRT Device with sixteen (16) megabytes of RAM, chilli uses 19%.
The Web Interface process, httpd, uses 19% also. About 3 megabytes!

  1. Turn on SSHd, and turn off Telnet and the HTTP options (uncheck) in the Web Administration.
  2. Make sure WAN access is available to HTTP and SSH if your setup is Configuration A: Hotspot Only.
  3. Save/Apply/Reboot as needed.

To use the Web Interface:

    1. For configuration A, physically plug your laptop into the existing network.
    2. For configuration B or C, physically plug your laptop into a LAN port on the DD-WRT Device.
      1. Log in through the CSP portal, or chill's firewall rules will block your client from connecting to the DD-WRT Device.
  1. Putty (SSH) into the DD-WRT Device.
    1. The command may look like 'putty' or
    2. 'putty -P 60000' if you changed the SSH port.
  2. Input 'httpd'.
  3. Open the Web Interface address on your client's browser.
  4. When you are finished, input 'killall httpd'.
  • Newer builds of Chilli are supposed to use less RAM, but these have not yet been included in DD-WRT.
  • The Web Interface uses a lot of RAM, and in any case, should not be left running on a production router.

DD-WRT Firmware: Administration/Hotspot/Chillispot tab does not show

Make sure you are using a package that includes chillispot. Chillispot is not in the micro and mini versions of dd-wrt (consult this table).

Connection Failed on v23 Firmware

If your client does not recieve a Chillispot IP address you may have changed the Chillispot DHCP Interface. On older versions of DD-WRT Firmware, touching this setting breaks Chillispot. A fix is to reset to factory defaults and re-enter all your settings or use newer firmware.

If the UAM Secret you entered in Chillispot Settings is incorrect, you will have an authentication failure.

If the RADIUS Shared Secret is incorrect, the login process will hang.

More troubleshooting tips

If it does not work, you must connect with ssh or telnet to your router.

login: root 
password: <your password>

First, check that you have internet access:


Worldspot Users: if you don't have any ping return, check the output of "ifconfig", and post it on the WorldSpot forum

If internet works from your router but you don't have chillispot working, check first that the chillispot process is launched with

ps -ef

You should see a "chilli -c /tmp/chilli.conf" process. If not, recheck your chillispot settings. For example, if you put a whitespace in the NAS ID, the chilli process won't launch.

Worldspot Users: If you need more assistance, you can post on the WorldSpot forum

For the FON Hotspot

Please see the FON Hotspot page for a guide and advice on setting up a FON hotspot using DD-WRT and Chillispot.

List of Chillispot Service Providers (CSPs)

A hosted Chillispot portal can be used to speed-up HotSpot setup and Management, and ease payment and other back-end requirements. Only a DD-WRT Device is necessary, the rest is done by third parties listed below.
Disclaimer: NONE of the following links are endorsements. You are Entirely Responsible Solely for your Choices.

Note: has been recommended by many people as having the best support and development. Some of the links are simply ads which were inserted into this Wiki in a badly-organized fashion (HotSpotExpress.In), if this helps inform you about which one to test. Free for free hotspots. Earn 75% in revenue sharing.
Skyrove free for free hotspots only, otherwise a payed account is required. Free sign up with a revenue share based solution for paid hotspots.
Hotspotexpress HotSpot services to use with Chillispot]
Chillifire Free or Fee Hotspots. Earn 80-90% of the revenue created. Immediately receive your revenue into your own PayPal account - no delays, no currency conversion losses, no bank fees.]

Any of these systems linked above are designed to replace both a local radius server and webserver, and bring powerful features. Simply register online and create your hotspot. Then you can get the chillispot configuration setting:

SkyRove Chillispot Page
Setup DD-WRT for WorldSpot to enter in the steps below, and you can get your hotspot working in some minutes.
Chillispot info

News & Updates

11:58, 4 September 2008 (CEST): Chillispot does not play nice with UPnP. Clients are blocked from setting up UPnP mappings. Someone aught to figure out the correct IPTABLES command to unblock the UPnP ports.

Here is what I got from Microsoft's site:
Port numbers for UPnP
1900 UDP port used by SSDP protocol.
5120 TCP port used for UPnP control and eventing.

11:58, 4 September 2008 (CEST): If there is no WLAN signal from the Client for 10 minutes, the Chillispot service sends a 'Lost Carrier' message to the Radius server. What this means is, should a client walk away from their laptop for a triple-latte mocha supreme (or whatever), and the laptop goes to sleep for more than 10 minutes, the Client is pushed back to the splash page to log in. Part of this logic is should the Client fail to log out, before getting up to get his triple-mocha, the system forcibly logs the Client off to save on ticket time, should it be a fee-ticket system.

Problems only seem to occur if the client is using an OpenVPN or SSH connection tunnel for the web access. The Client must disconnect these and setup a direct connection, or have another browser setup for direct Internet access. Refresh the page of the direct browser, and click the Disconnect/Connect button.