FON Hotspot

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:25, 23 June 2007 (edit)
Pepsimax2k (Talk | contribs)
(Setting Up Your Router's Internet Connection)
← Previous diff
Revision as of 20:25, 23 June 2007 (edit) (undo)
Pepsimax2k (Talk | contribs)
(Setting Up Your Router's Internet Connection)
Next diff →
Line 79: Line 79:
-<div style="text-align: left; padding: 5px; background: #FFBE69; border: #000000 1px solid;">'''PPPOE USERSPLEASE NOTE:''' There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore '''MUST''' use the following fix to enable Chillispot to function correctly. This ''does not'' apply if you have a seperate modem that connects using PPPOE but then connects to the rest of your network using a refular local IP address.+<div style="text-align: left; padding: 5px; background: #FFBE69; border: #000000 1px solid;">'''PPPOE USERS PLEASE NOTE:''' There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore '''MUST''' use the following fix to enable Chillispot to function correctly. This ''does not'' apply if you have a seperate modem that connects using PPPOE but then connects to the rest of your network using a refular local IP address.
In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing ''only'' any #!/bin/sh text currently present and leaving the rest intact. In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing ''only'' any #!/bin/sh text currently present and leaving the rest intact.

Revision as of 20:25, 23 June 2007

PLEASE NOTE: The following guide is a work in progress.

Last Update:
23/06 - pppoe mtu bug fix, general guide updates

22/06 - pppoe mtu bug possible fix, uamallowed sites, heartbeat


This tutorial will guide you through the steps needed to set up a [hotspot] on your DD-WRT router, allowing for a private and encrypted wireless network along with the open FON network. Tips are also given on registering new routers with FON without previously having loaded the official FON firmware, running a heartbeat for the router to appear active on the FON maps and various other configuration options.

Note that the guide only works for routers already registered with FON. If you have not already registered your router, there is an aditional part to the guide at the top with details on how this can be achieved.

If was writen using DD-WRT v24 (06/20/07) on a WRT54GL v1.1 but should work identically on any other Broadcom router with the same DD-WRT version,t and probably just as well on any other DD-WRT capable router that can run Chillispot (ie. not the La Fonera). Later DD-WRT versions should also work fine, so long as they have no bugs with dual SSIDs or wireless encryption.


Contents

Foreword

The following is compiled from information from numerous other guides and forum posts around the web, non of which I got working individually but pieced together they're create a long sought masterpiece. Here's a few:

http://www.geek-pages.com/articles/latest/dd-wrt_-_multiple_ssids_-_1_for_fon_-_1_for_private_network.html

http://startu.net/chilli/setup.html

http://fon.freddy.eu.org/heartbeat/

http://boards.fon.com/viewtopic.php?t=1838&postdays=0&postorder=asc&start=20

Quick Start

If you just wanna get the basic facts, you can probably jump through most of the text quite saftely and just take the needed info out of the "Example settings" subheadings, along with the firewall code, so I won;t bother with a real quick start. Feel free to write your own if you miss it.


Notable Quirks

Free Memory

When the following guide is up and running on a WRT54GL v1.1 , you may end up with very high memory usage (between around 91% and 96%). This hasn't been a problem for me so far, and shouldn't cause a problem at all, but you may decide you want to try out either the mini or nokaid firmware version instead of standard to free up memory space. I'm not sure if it'll be much better, and in the case of mini you'll have to enable jffs, install chillispot from a seperate [url=http://www.dd-wrt.com/wiki/index.php/Ipkg]ipkg[/url], then set up the chilli.conf file yourself.

Temporary / Permanent Storage

With the guide having been produced on a WRT54GL v1.1 and the standard-generic firmware, there was no permamnent storage space such as /jffs left to write config files to, and therefore items such as the heartbeat script must be created each time the router is rebooted (hopefully automatically when I get round to writing the correct startup code). If you have a router with larger flash ram space, or are using either the mini (note chillispot not included) or nokaid version of DD-WRT, or even have SD card or external storage available, then you should be able to store some config files in there and negate the need for constant creation of them at boot. An additional guide will be added to the bottom of the page for this situation when I get round to it.


FON On DD-WRT w/ Chillispot

Test Router: WRT54GL v1.1

Test DD-WRT version: dd-wrt.v24_generic.bin v24 06/20/07 (20th June)


Registering New Routers

The FON Hotspot created during this guide will only work if the router has already been registered with FON. The easiest way to do this is to have registered it while using the official FON firmware. This is available at http://www.fon.com/en/download for the Linksys WRT54G, GL, GS v1-4, Buffalo WZR-RS-G54, WHR-G54S and HP-G54. If you have one of these routers, you may want to get the unique key mentioned below by just connecting to the router's FON Hotspot and accessing the FON login page. At this point, copy everything in the URL up until the variables starting ?res= and jump to the router setup part of this guide.


There is however another (as yet untested by myself) way to register a new router without using the official firmware, also oppening up the possibility to use any router that will allow Chillispot to be run.

The main aim is to generate a unique key from FON based on your router's MAC address. On official FON routers this is done by running the following code on bootup, where xx-xx-xx-xx-xx-xx is the wlan mac address of your router IN LOWER CASE LETTERS, separated by dashes (if you're unsure of yours, ssh or telnet to your router and run "nvram show | grep wl0_hwaddr"):

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx

Normally this is used to create a customised Chillispot config file, but in this case we just want to create a temporary file containing the custom key needed to register a new router.

Unfortunately the only way I know of running the code at the moment is from a router running the official FON firmware, such as a La Fonera. I'm quite happy to generate the key on my own router if you do not have access to one, just get in touch with me ( pepsi_max2k ) with your MAC address and I'll try help out. Otherwise, log in to your official FON router with SSH or telnet and try the following (replacing xx-xx... with your intended DD-WRT FON router's WLAN mac IN LOWER CASE LETTERS):

cd /tmp

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx > customkey.txt

more customkey.txt

The thing you're looking for is the very last line starting "uamserver https://www.fon.com/login/gateway/sec/xxx... The long random looking string is the key needed to register your router for the first time. The info contained after the uamallowed lines contains all the web addresses accessible by users connecting to your fonspot before login, including any "homepage" added on the FON configuration pages for pre-registered routers. Some of these are esscential for correct functioning of a FON Hotspot (like paypal) though others aren't so important. You can either add all of these in the Chillispot setup later in this guide, or just use my default esscential URLs.

Anyway, if you haven't already registered your router, you'll want to remember that random key for later. Otherwise, it's not really needed but can still be used if you so wish (I still use mine). Aaaand on with the guide...

Setting Up Your Router's Internet Connection

Starting from default settings, change just enough to get a internet connection accessible on the router. Most likely this is using DHCP or a static IP.


PPPOE USERS PLEASE NOTE: There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore MUST use the following fix to enable Chillispot to function correctly. This does not apply if you have a seperate modem that connects using PPPOE but then connects to the rest of your network using a refular local IP address.

In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing only any #!/bin/sh text currently present and leaving the rest intact.

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu
NOTE: If your MTU is different from 1492, you must replace the 1452 in the above code with your current MTU value, minus 40. Eg: If your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).


The following assumes the router is connected using a local WAN IP such as 192.168.X.X with a 1500 MTU.

The only real change from default settings is having the router's Local IP Address on a subnet other than that of the WAN IP.

Example settings for basic setup tab:

WAN IP is 192.168.1.1.

Connection Type: DHCP
STP: Enable

MTU: Auto

Local IP is 192.168.2.1.
Subnet Mask: 255.255.255.0
Gateway: 0.0.0.0
Local DNS: 0.0.0.0

DHCP Type: DHCP Server
DHCP Server: Enable
Start IP Address: 100
Static DNS: 0.0.0.0[/quote]

Setting Up Wifi Networks

To start with, you may want to make sure you have a firmware version / router without any bugs in the virtual interface setup. From default settings, you can just click Add on the Wireless Basic Settings tab to add a single Virtual Interface (wl0.1). All other settings can be left alone, with no encryption on either interface, and both being bridged. If you can then connect to both interfaces seperately and get a connection to the internet, the following should work fine. If not, try searching the message boards to find a solution until you can access the internet from both SSIDs while bridged and using no encryption and no isolation.

[b]FON SSID[/b]

The unencrypted FON Hotspot SSID should be set up on the wireless physical interface ( wl0 / eth0 ) with the encrypted private SSID on the virtual interface. This is due to a problem I encountered using encryption on the physical and an open virtual interface (namely that I could no longer connect to the physical interface). It also makes the setup of Chillispot much easier (you don't need to edit any config files to change eth0 to wl0.1).

You can name the SSIDs anything you like though you should probably name the FON SSID "FON_something" as this is the same naming convention used by FON. I also recommened adding something like "NoEncryption" to the SSID as it may show up at times as being encrypted (an old bug with VAPs and various wireless cards). And obviously leave the broadcast enabled so people see the SSID. Use common sense in the choice of wireless channel (google it).

The FON SSID should be Unbridged and use an IP address other than that of your WAN IP, Local IP or 192.168.182.X as this is used by Chillispot. The Subnet mask should be the same as your router's subnet mask.

[b]Private SSID[/b]

The virtual interface should be bridged, AP Isolation enabled and I strongly recommend that SSID broadcast is enabled too. This is due to problems I experienced getting devices (such as routers in client mode) to automatically connect to a VAP with a hidden SSID. At times, unhiding the SSID, allowing the device to connect, then rehiding it would work, though after a reboot of either router or device the problem would return. Strangely, devices that connected on demand such as adding a profile for the ssid to my laptop and telling it to connect would always work fine. This is probably a bug that will be fixed in later DD-WRT releases, but for now, if anyone other that yourself with on-demand wireless devices are connecting to the virtual SSID, I'd recommend leaving SSID broadcast enabled.

The down side to all that is the FON SSID is much more likely to be uncorrected recognized as encrypted by other wireless devices, and at times not recognized at all. YMMS, as ever.


Example settings for Wireless Basic Setup tab:

[quote]Wireless Mode: AP Wireless Network Mode: Mixed Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption Wireless Channel: 11 Wireless SSID Broadcast: Enable Network Configuration: Unbridged IP Address: 192.168.10.1 Subnet Mask: 255.255.255.0

Virtual Interface Wireless Network Name: wrt54gl_wpa2 Wireless SSID Broadcast: Enable AP Isolation: Enabled Network Configuration: Bridged[/quote]


Setting Up Wireless Encryption

Wireless encryption should be left disabled for the FON Physical Interface for obvious reasons, and can be changed to whatever you like on the Virtual Interface, though again for obvious reasons should not be left disabled, otherwise people will just connect to that instead of the FON SSID for free net access.


Example settings for Wireless Security tab:

[quote]Physical Interface wl0 Security Mode: Disabled

Virtual Interface wl0.1 Security Mode WPA2 Personal Mixed WPA Algorithms: TKIP+AES WPA Share Key: XXXXXXXXXXXXX Key Renewal Interval: 3600[/quote]


Setting Up Chillispot

You now need to set up Chillispot to enable the hotspot to function correctly. Basically Chillispot takes over the FON SSID and assingd a 192.168.182.X address to anyone connecting to it, then redirects them towards FON's login pages one they try to access any site other than those under the UAM Allowed field.

Much of the information is generic though there's one thing you must change and one where you may need to. If you've not already registered your router with FON the see the informationg at the top of this page. If you have, you only need to know your router's WLAN (Wireless LAN) MAC address, which should be found (among other places) on the Configure Your FON Router page after loging in to Fon.com. You must add this address to the Radius NAS ID field, in UPPERCASE letters, separed in pairs by dashes ( - 's).

Those of you not already registered with FON should put the whole https://www.fon.com/login/gateway/sec/xxx... address (generated from the unique key quide at the top of the page) in the Redirect URL field. This should allow you to register your router with FON when you first connect to it, though note that this HAS NOT YET BEEN TESTED by myself or anyone else that I know of.

You very likely want to enable the Separate Wifi from the Lan Bridge option, otherwise any devices connected by cable to the router will be sent through the FON Hotspot signin process. Then again, if you're running a Hotspot in a shop you may actually want to provide a row of 4 wired hotspot connections ;o), in which case leave it disabled. YMMV.

DNS IP can either be your regular provider's DNS (see Status > DNS1 ) or a set DNS such as one of OpenDNS's ones (see www.opendns.com).

And finally, you may want to alter URLs the UAM Allowed. Any URL in here will be accessible by FON SSID clients before logging in. A few such as www.fon.com, www.paypal.com, www.paypalobjects.com, www.skype.com and www.google.com should be left there to allow the Hotspot to function as intended (no paypal = no passes sold). Note these should be separated by commas, no spaces, no http://.

The following is the current full uamallowed sites used by FON, though I've not used them all yet as it's kinda long, should work fine in one line but you can add / remove sites as needed if not:

www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.martinvarsavsky.net,www.google.com, www.flickr.com,static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com, maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp, 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24, 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161, ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp

Example settings for Services Hotspot tab:

[quote]Sputnik: Disable Wifidog: Disable

Chillispot: Enable Seperate Wifi from LAN Bridge: Enable Primary Radius Server: radius01.fon.com Backup Radius Server: radius02.fon.com DNS IP: 212.159.6.10 Remote Network: 192.168.182.0/24 Redirect URL: https://www.fon.com/login/gateway/sec/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Shared Key: garrafon DHCP Interface: WLAN Radius NAS ID: XX-XX-XX-XX-XX-XX UAM Secret: garrafon UAM Any DNS: 1 UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.dd-wrt.com,www.dd-wrt.org MACauth: Disable Additional Chillispot Options: (blank)

HTTP Redirect: Disable NoCatSplash: Disable SMTP Redirect: Disable[/quote]

Setting Up Firewall

There's one last, optional but HIGHLY recommmended thing you should do before advertising the Hotspot. As it stands, anyone connected to the FON SSID will have full access to the whole 192.168.X.X network including your router's web admin page. To stop this you need to add the below code to the firewall. Do this by [i]pasting it into the box on the Admin > Commands page and hitting Save Firewall[/i].

It will also limit the speed of any uploads or download on the FON SSID. These can be altered by changing the numbers after DOWNLINK and UPLINK, currently set a 1 Mbps down and 256 Kbps up.

NOTE: For now, this only stops access to the main router and any devices connected directly to it. Devices in a seperate subnet (eg. router has 192.168.2.1 ip, other device is 192.168.1.1) will still be accessible for now (until I update this guide). Password protect things as needed.

Also note that any clients connected to the FON SSID will be able to access each others network shares. This appears to be the same for all official FON Hotspots too.

[code]#!/bin/sh

iptables -I INPUT -i tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br0 -o tun0 -j logdrop

iptables -A FORWARD -i tun0 -j DROP; iptables -t nat -I PREROUTING -i tun0 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -j DROP

DEV="tun0" DOWNLINK="1024" UPLINK="256"

tc qdisc del dev $DEV root tc qdisc del dev $DEV ingress

  1. limit download

tc qdisc add dev $DEV root handle 1: htb tc class add dev $DEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbit burst 6k tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1

  1. limit upload

tc qdisc add dev $DEV ingress handle ffff: tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1[/code]


The End

At this point you should now be able to save your settings, reboot the router and connect to the encrypted virtual SSID with full, unrestricted access to the net. Connections to the FON SSID will allow unrestricted access to any address in the Chillispot UAM Allowed field and any other address should redirect to the login pages. Users should then be able to login as normal and access all pages.

Hopefully, if all goes as intended, unregistered routers will also now get a page asking them to register their router with fon. You'll probably need to already have an account at fon to register the router to. That's all untested ground though so who knows? ;o)


FON Heartbeat

All routers running official FON firmware sent a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com, but also to download updates to the firmware and chillispot configuration.

Running an unofficial FON hotspot means you don't need the downloaded updates, but it's still nice to have the router show up as online on the FON maps. To do this, you need to implement the FON Heartbeat in DD-WRT.

As yet I've only had mine running for a total of about 24 hrs before manually rebooting and having to restart the heartbeat, so I'm not 100% sure it works for longer than that, but if you wanna try yourself then here's how I did it, and thanks to Freddy for the original script - you can read more about it at http://fon.freddy.eu.org/heartbeat/ .

Ensure Cron is enabled on the Admin > Management page. Telnet in to the router and run the following commands:

[code]cd /tmp wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient vi thinclient[/code]

You now need to use the vi editor to edit thinclient and replace the "jffs" on lines 6 and 9 with "tmp". It's really just a case of hitting "i", moving the cursor, backspace, writing in tmp, Esc, typing :wq! and that's it. Now type:

[code]/tmp/thinclient start 2>&1 | logger[/code]

After hitting enter there should be a slight pause but nothing more exciting, you should end up back at a regular command prompt. If you cd to /tmp/root/.ssh and ls you should see a file called "known_hosts" there if the script has worked. You can now exit ssh and the router should shortley show as online on maps.fon.com.


Note that this script will dissapear every time the router is re-booted. This is due to the fact that I have to store everything in the volatile /tmp directory on the router as I have no writeable space left on the permanent /jffs partition. Depending on the router you own, you may or may not have space there yourself. If you do, you can use the below, simpler guide and the heartbeat should run at startup every time.

[code]cd /jffs wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient[/code]

And add the following to Admin > Commands and hit Save Startup.

[code]#!/bin/sh

/jffs/thinclient start 2>&1 | logger[/code]

Permanent Storage Available

Coming soon...