FON Hotspot

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:22, 3 September 2007 (edit)
Pepsimax2k (Talk | contribs)
(Final Reboot)
← Previous diff
Revision as of 17:23, 3 September 2007 (edit) (undo)
Pepsimax2k (Talk | contribs)
(Final Reboot)
Next diff →
Line 450: Line 450:
==Final Reboot== ==Final Reboot==
-Now click the '''Reboot Router''' button. If all goes well the router will restart and automatically run the heartbeat and chillispot once an internet connection is established (usually around 3 mins). Watch the Memory section on the Status tab, specifically the Free and Buffers section for a significant drop once chillispot kicks in. They should drop to between 300 and 800 kB, quite low which is why you should have disabled as many unneeded services as possible.+Now click the '''Reboot Router''' button. If all goes well the router will restart and automatically run the heartbeat and chillispot once an internet connection is established. Watch the Memory section on the Status tab, specifically the Free and Buffers section for a significant drop once chillispot kicks in (usually around 3 mins after boot). They should drop to between 300 and 800 kB, quite low which is why you should have disabled as many unneeded services as possible.
You should also be able to connect to both the private and hotspot networks as normal, and continue to do so unless the JFFS2 space is disabled (removing the heartbeat and chillispot files) which should only happen if you upgrade the firmware (in which case all settings will likely be reset anyway). You should also be able to connect to both the private and hotspot networks as normal, and continue to do so unless the JFFS2 space is disabled (removing the heartbeat and chillispot files) which should only happen if you upgrade the firmware (in which case all settings will likely be reset anyway).

Revision as of 17:23, 3 September 2007

PLEASE NOTE: The following guide is a work in progress and not guaranteed to work on all dd-wrt versions.

Last Update:
03/09 - Undergoing full re-write to fix numerous issues and make easier to follow.
29/08 - RC1 chilli no web access note
27/08 - fix manual chilli.conf 2x dns2 bug
25/08 - update instructions for RC1 usage
23/08 - note on upcoming method for newer firmware versions

25/06 - heartbeat changed to auto startup script


Welcome to the DD-WRT Fon Hotspot setup guide. If you have tried previous DD-WRT FON setup guides without success then fear not; the following guide has been tried and tested on three seperate routers with identicle success on each. It should be simple enough for anyone to walk through the guide so you don't need to know anything about coding or command line editing.

At the end of the guide you should end up with a registered FON hostpot using two wireless SSIDs, one private encrypted network and a seperate open FON hotspot network, and the original FON heartbeat function is included to show your hotspot as active on maps.fon.com. FON's online router personalization setup will still work, though any changes to the free website, router name, friends & family and wi-fi bandwith share settings won't work via the website although you can still change all of these (other that f&f) in the following setup guide.


Contents

References

The information used in the guide was compiled from various sources along with including original info. If you want to know more about the setup, or have a problem with some specific parts, the next few links may help you out.

http://www.geek-pages.com/articles/latest/dd-wrt_-_multiple_ssids_-_1_for_fon_-_1_for_private_network.html

http://startu.net/chilli/setup.html

http://fon.freddy.eu.org/heartbeat/

http://boards.fon.com/viewtopic.php?t=1838&postdays=0&postorder=asc&start=20


FON On DD-WRT w/ Chillispot

Requirements

Router: WRT54G, WRT54GL, WRT54GS, or any DD-WRT router capable of running Chillispot.

The guide has been tested on a WRT54GL 1.0, 1.1 and WRT54G 2.0.


Firmware: DD-WRT v24 RC1 NoKaid ( dd-wrt.v24_generic_nokaid.bin v24 RC1 (08/22/07) ).

Other versions allowing dual SSID and chillispot support should work depending on bugs, and versions without JJFS2 space (eg. Standard) can also be used but see Differing Firmware Tips at the end of the guide for slight changes in setup. RC1 NoKaid is the only version fully tested and supported in the following guide.


FON: Registered user with pre-registered router or router's unique key.

You must be a registered FON user to setup a FON Hotspot. Non-registered routers can be registered using the following guide, though see the Registering New Routers section for more.

Registering New Routers

The FON Hotspot created during this guide will only work if the router has already been registered with FON. This can be done either by registering the router while it is running the official FON firmware, or by having access to a seperate FON router for which you have SSH access. Pre-registered routers need no further input, but fron non-registered routers you need to access a uniquely generated key to register the router.

If you do not have access to either of these, send a PM to pepsi_max2k on boards.fon.com or contact me any other way, provide your WLAN MAC address and I will generate the key for you.

The official firmware is available at www.fon.com/en/download for the Linksys WRT54G, GL, GS v1-4, Buffalo WZR-RS-G54, WHR-G54S and HP-G54. If you have one of these routers you may want to get the unique key by just connecting to the router's FON Hotspot and accessing the FON login page. At this point, copy everything in the URL up until the variables starting ?res= and jump to the router setup part of this guide.

Otherwise you must generate the key manually using a seperate FON router. The main aim is to generate a unique key from FON based on your router's MAC address. On official FON routers this is done by running the following code on bootup, where xx-xx-xx-xx-xx-xx is the wlan mac address of your router in lower case letters, separated by dashes (if you're unsure of yours, check the Status > Sys-Info page on your intended DD-WRT FON router for the Wireless MAC address).

You need to log in to your official FON router with SSH or telnet (see stefans.datenbruch.de/lafonera/#kolofonium for details on how, and use putty for SSH) and copy / paste the following code (replacing xx-xx... with your intended DD-WRT FON router's WLAN mac address in lower case letters):

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx

As soon as you press enter, around 20 lines of code will be printed out, ending in something that looks like the following:

uamserver https://www.fon.com/login/gateway/sec/9c3370131faaxxxxxxxxxxxxxxxxxxxx
net 192.168.182.0/24
dynip 192.168.182.0/24
dns1 208.67.222.222
dns2 208.67.220.220

The thing you're looking for is the very last line starting "uamserver https://www.fon.com/login/gateway/sec/...". The long random looking 32 digit string after /sec/ is the key needed to register your router for the first time (I've added x's to the end of mine above to avoid you copying it ;o). Make a note of this exact key (copy and paste if you can) as you'll need it to register your router for the first time.

Router Settings

The following should generally be followed in the order written so as to avoid any more reboots than needed or any complications with settings. Many settings are meant as a guide and can be changed to suit your own needs (IP, passwords, etc) but may cause unforseen problems as they're untested. Settings not mentioned can also be changed when needed (NAT, QoS, other services) but bear in mind that the router will not have much free memory left with the given settings so you may experience problems if you enable too many other services.

You should start with etiher a fresh install of v24 RC1, or reset to defaults using the reset button on the router.

Administration > Management

The first settings you should change are those in the Admin > Management tab, specifically the password and enabling JFFS2.

Router Password
Router Username: yourusername
Router Password: yourpassword          Change this to avoid unathorised access from hotspot users.
Re-enter to confirm: yourpassword

Web Access
Protocol: HTTP
Auto-Refresh (in seconds): 3
Enable Info Site: Enable
Info Site Password Protection: Enabled  Tick to avoid hotspot users seeing the info site.
Info Site MAC Masking: Enable

Remote Access
Web GUI Management: Enable              Disable if you don't need remote web access.
Web GUI Port: 8080

Boot Wait
Boot Wait: Enable

Cron
Cron: Enable                            This MUST be enabled for the Hotspot to work.

Loopback
Loopback: Enable

802.1x
802.1x: Enable

Reset Button
Reset Button: Enable

Routing
Routing: Enable

JFFS2 Support
JFFS2: Enable
Clean JFFS2: Enable                     Enabled at this point incase JFFS space is not free.

Language Selection
Language: english

MMC/SD Card Support
MMC/SD Card Support: Disable

IP Filter Settings (adjust these for P2P)
Maximum Ports: 2048                     Max ports should be kept as low as possible to free memory.
TCP Timeout (in seconds): 190
UDP Timeout (in seconds): 120

Overclocking
Frequency: 200 MHz 

CIFS Automount
Common Internet File System: Disable

You should now click the apply button and then the reboot router button in order to clear the JFFS2 space properly.


Setup > Basic Setup

Once the router has rebooted, browse to the Setup > Basic Setup tab and change the settings in order to get your internet connection active. Take note of your (automatic) MTU setting (specifically if using PPPOE) as if it differs from 1500 then you'll need to fix a bug with chillispot later on. The following settings assume a DHCP connection.

WAN Connection Type
Connection Type: Automatic configuration : DHCP
STP: Enable

Optional Settings
Router Name: DD-WRT
Host Name:
Domain Name: 
MTU: Auto 1500

Router IP
Local IP is 192.168.1.1.
Subnet Mask: 255.255.255.0
Gateway: 0.0.0.0
Local DNS: 0.0.0.0

Network Address Server Settings (DHCP)
DHCP Type: DHCP Server
DHCP Server: Enable
Start IP Address: 192.168.1.100
Maximum DHCP Users: 50
Client Lease Time: 1440 Minutes
Static DNS 1: 208.67.222.222                You can leave these blank to use your ISPs DNS,
Static DNS 2: 208.67.220.220                but I use OpenDNS.org's DNS servers.
Static DNS 3: 0.0.0.0
WINS: 0.0.0.0
Use DNSMasq for DHCP: Ticked
Use DNSMasq for DNS: Ticked
DHCP-Authoritative: Ticked

Time Settings
NTP Client: Disable                         Disabled to free memory, only enable if really needed.

Now press the apply button to save and enable these settings.


Setup > DDNS / Other

If you wish to setup a DDNS service then you should do so now (remember to click apply once you're done).

If you wish to change any other settings under the Setup tab you should also do this now, though I don't advise this as it may cause unforseen problems with the hotspot.


Wireless > Basic Setup

Due to problems running chillispot on the physical wireless interface, interfaces must be set up as follows with the private on physical and hotspot on virtual. You should also not alter anything other than the SSID names and wireless channel to suit your circumstances, with the SSID Broadcast setting being left enabled for at least the virtual (hotspot) interface and NoEncryption added to the hotspot name to assure people that it's not really encrypted incase they see it as such (we'll go over that later when we test).


Physical Interface wl0
Wireless Mode: AP
Wireless Network Mode: Mixed                 Allows as many people as possible to connect to hotspot.
Wireless Network Name (SSID): wrt54gl_wpa2   Change to suit your needs.
Wireless Channel: 1                          Change to suit your needs.
Wireless SSID Broadcast: Enable
Network Configuration: Bridged

Virtual Interfaces wl0.1
Wireless Network Name (SSID): FON_WIFI_HOTSPOT_NoEncryption      Recommended, but change to suit.
Wireless SSID Broadcast: Enable              You want people to know it's there, don't you?
AP Isolation: Enable
Network Configuration: Unbridged
IP Address: 192.168.10.1
Subnet Mask: 255.255.255.0

Now click the apply button to save and enable these settings.


Wireless > Wireless Security

Wireless encryption should be left disabled for the FON Hotspot for obvious reasons, and can be changed to whatever you like on the private WLAN though again for obvious reasons should not be left disabled otherwise people will just connect to that instead of the FON SSID for free net access.

Physical Interface wl0
Security Mode: WPA2 Personal Mixed
WPA Algorithms: TKIP+AES
WPA Share Key: xxxxxxxxxxxxx           I use a 13 digit key, change to whatever you like.
Key Renewal Interval: 3600

Virtual Interface wl0.1
Security Mode: Disabled                Don't be silly by enabling it :oP

Now click the apply button to save and enable these settings.


Wireless > Other

If you wish to change any other settings under the Wireless tab you should also do this now, though I don't advise this as it may cause unforseen problems with the hotspot.


Administration > Commands (Firewall)

The following code is used to create a firewall on your router blocking access to the private network from the hotspot and how fast a connection hotspot users can get; a number of these rules can be added or changed. It also includes a very important bug fix for those of you with an MTU other than 1500 (mostly PPPOE users) so pay attention!

The main lines blocking access to the network are the "iptables -t nat -I PREROUTING -i tun0 -d xxx.xxx.xxx.xxx/xx -j DROP" lines. The first of these should be changed to your router's own Local IP Address and Subnet Mask (see [#Setup > Basic Setup| Setup > Basic Setup]). The others can be removed if you so wish, but as they stand will block access to all privately used IP addresses. You must keep the ...192.168.182.1/32 -j ACCEPT rule in to allow the hotspot clients to access the Chillispot server.

The DOWNLINK and UPLINK values (in Kbps) limit the speed of any uploads or downloads by FON Hotspot users and can be changed as you see fit; currently they're set to 1 Mbps down and 256 Kbps up.

A bug in Chillispot causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. Therefore, if using such an MTU value, you MUST un-comment (remove the leading # from) the first iptables line in the firewall code to enable Chillispot to function correctly. This does not apply if you have a seperate modem that connects to the net using PPPOE but then connects to the rest of your network (eg. your dd-wrt router) using a regular local IP address.

NOTE: If your MTU is different from 1492 (PPPOE default), you must replace the 1452 in the line with your current MTU value minus 40. Eg, if your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).
#!/bin/sh

##

# IF USING MTU OTHER THAN 1500 (PPPOE), uncomment following line and change 1452 to your mtu minus forty
# iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu

iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j logdrop

# secure access to local addresses other than chillispot
iptables -A FORWARD -i tun0 -j DROP;

# change the following line's IP and Subnet to that of your routers (if not identicle)
iptables  -t nat -I PREROUTING -i tun0 -d 192.168.1.1/255.255.255.0

iptables  -t nat -I PREROUTING -i tun0 -d 192.168.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 169.254.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 172.16.0.0/12 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 10.0.0.0/8 -j DROP
iptables  -t nat -I PREROUTING -i tun0 -d 192.168.182.1/32 -j ACCEPT

DEV="tun0"
# change UP/DOWNLINK values (in kbps) to alter hotspot users up/download speeds
DOWNLINK="1024"
UPLINK="256"

tc qdisc del dev $DEV root
tc qdisc del dev $DEV ingress
 
# limit download
tc qdisc add dev $DEV root handle 1: htb
tc class add dev $DEV parent 1: classid 1:1 htb rate  ${DOWNLINK}kbit burst 6k
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1
 
# limit upload
tc qdisc add dev $DEV ingress handle ffff:
tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1

Copy and paste the above code in to the commands box and click the save firewall button.


Telnet

Unfortunately as the commands box does not execute commands correctly in RC1, you now need to log in to the router by telnet to continue. Don't worry if you're unfarmiliar with this, I'll include step by step instructions.

Start by opening a command prompt in Windows (Start > Run > type cmd then hit OK) or Linux (you may need to install telnet). Type "telnet 192.168.1.1" minus the quotes, where 192.168.1.1 is your router's IP address if not ...1.1. You should now be asked for a login name; regardless of what you've set in the router this will be "root" without the quotes. The password will be the same as you've set on your router, in my guide this is "yourpassword".

When I ask you to enter code below, enter it line by line and hit enter at the end of each line to run the command before moving to the next line. You can paste copied lines in to telnet by a simple right mouse button click.


Disable Rstats

An optional but recommended step unless you know better, is to make sure Rstats is disabled to ensure as much memoy as possible is free. Enter the following in to the telnet prompt:

nvram set rstats_enable=0 
nvram commit

A single line (starting "nvram") should print out to confirm this once done.


Check JFFS Space

Type the following to ensure that your JFFS space has been cleared correctly. You should see a blue "tmp" listed if it has, otherwise you should ensure that you are using the NoKaid firmware version and have enabled JFFS2 and Clean JFFS2 in the Admin web tab then clicked the apply then reboot buttons.

cd /jffs
ls


Enable FON Heartbeat

All routers running official FON firmware send a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com and let FON know you're part of their community. To do this, you need to implement the FON Heartbeat in DD-WRT by downloading the heartbeat code originally created by Freddy. You can read more about this code at http://fon.freddy.eu.org/heartbeat/ .

Ensure Cron is enabled on the Admin > Management web page and then type (or paste) the following into the telnet prompt to download the files.

cd /jffs
wget http://fon.freddy.eu.org/heartbeat/fonkey
wget http://fon.freddy.eu.org/heartbeat/thinclient
chmod 755 /jffs/thinclient
ls

After the ls, ensure that you see both the fonkey and thinclient files listed, the latter being a light green colour.

Now start the heartbeat script by typing the following code into telnet:

/jffs/thinclient start

After a minute or two you should something similar to the following printed out, with your own Wireless and LAN MAC addresses listed.

sent: mode='start' wlmac='00:18:39:xx:xx:xx' mac='00:18:39:XX:XX:XX' fonrev='3' firmware='0.6.6' chillver='1.0-1' thclver='1.0'
Something is wrong, /tmp/.thinclient.sh is empty

Ignore the final warning; the heartbeat should now be up and running and appear active on maps.fon.com. If not, check the troubleshooting section below for more help.


Create Chillispot Config File

The most important part of the whole hotspot; Chillispot controls the FON hotspot functionality including login details and "free" website access.

When creating the chilli.conf file, a number of things are customisable including DNS addresses and additional uamallowed lines or addresses, though keep in mind that much of the information is critical to the currect functioning or the hotspot.

If you have not already registered your router with FON, you'll need to know your router's unique key as detailed in the [#Registering New Routers| Registering New Routers] section of this guide.

Start off by creating the chilli.conf file in /jffs. We'll be using vi to edit stuff but if you have no idea what vi is, don't worry, just do what I say. Type the following in to telnet:

cd /jffs
vi chilli.conf

The vi editor will now be showing, so now you need to type or copy and paste the following in to the telnet screen (copy, then just right click to paste). You will need to edit this code in a second, so keep reading.

radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
radiussecret garrafon
macauth
dhcpif wl0.1
uamsecret garrafon
uamanydns
uamallowed www.martinvarsavsky.net,www.google.com,www.flickr.com,static.flickr.com,video.google.com,216.239.51.0/24,66.249.81.0/24
uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com,maps.fon.com,c20.statcounter.com
uamallowed www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp,202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159
uamallowed 202.47.18.161,202.47.19.159,202.47.19.161,ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp,gringo.fon.com
uamallowed labs.fon.com,213.134.44.0/23,www.fonshop.com.tw,shop.hk.fon.com,maps.naver.com
uamserver https://www.fon.com/login/gateway
net 192.168.182.0/24
dynip 192.168.182.0/24
dns1 208.67.222.222
dns2 208.67.220.220

Firstly, if you did copy and paste, the text "radius" at the start of the file will be missing, so move the cursor to the start using the arrow keys and type "radius" in (without quotes) so that the code is identicle to above.

If you have not registered your router, add /sec/ and your unique key to the end of the uamserver line so that it looks a little like this:

uamserver https://www.fon.com/login/gateway/sec/9c3370131f....

If you wish to change the dns server addresses you can (the backspace or delete key should help), though I use OpenDNS.org's servers.

If you wish to add your own website to the "freely" accessible ones for hotspot users, add them to the end of the last uamallowed line without the http:// but with a , at the beginning so that it looks a little like so:

uamallowed labs.fon.com,213.134.44.0/23,www.fonshop.com.tw,shop.hk.fon.com,maps.naver.com,www.mywebsite.com,www.myothersite.co.uk

Once you have done editing the file, you should exit the edit mode by hitting the Esc key, enter command mode by hitting the : key (shift plus ;) and then save it by typing the following:

!wq

If you mess anything up, you can quite without saving by just typing !q and start again.

Once the chilli.conf file has been saved, you need to add another line to it ("radiusnasid XX-XX-XX-XX-XX-XX", that's your WLAN MAC in capitals separated by commas) but this time you don't need to edit anything yourself, just type the following line in to telnet and hit enter:

echo -n "radiusnasid `nvram get wl0_hwaddr|sed -e s/:/-/g`" >>/jffs/chilli.conf

Now type "more /jffs/chilli.conf" (and enter to continue to end) and check that the chilli.conf file is identicle to the above code (bar edits) and contains the correct radiusnasid line at the end (including your WLAN MAC in capitals separated by commas, v. important). If so, we shall continue. Otherwise you can delete the chilli.conf file by typing "rm /jffs/chilli.conf" (careful, rm is powerful) and start again.


Enable Chillispot

You can now start chillispot by typing the following command in telnet:

/usr/sbin/chilli --conf /jffs/chilli.conf

You shouldn't see any errors, but if you do it's probably because you typed out the chilli.conf file wrong. Just go back to the above and start again. Now type the following:

top

and, assuming your router is connected to the internet, you should see a chilli and possibly thinclient service running, chilli taking up ungodly amounts of memory. If so, all is well and you can exit top by hitting Ctrl-C, and exit telnet by typing "exit" (or just close the command window).


Test Wireless Connections / Register Router

You can now test out your new Wi-Fi private and hotspot networks, but you should bear in mind that differing makes of wi-fi recievers will see the encryption and broadcast settings differently regardless of setitngs. In my experience, the hotspot will at times be recognized as encrypted (when it's not) and you may never see the private physical SSID in a wireless network search, so you may need to provide correct details manually when connecting to either SSID.

So, start with the private interface and as I say you may have to enter details manually into your laptop / PC's wifi settings. You should recieve an IP in the range of your router's Local IP and have full access to the net. If so, on to the hotspot...

Again, if you're seeing the hotspot as encrypted, you may need to manually change the encryption to none and open to connect properly. Once you do, you should gain an IP address in the 192.168.182.X range so long as chillispot is running. Once you do, open a browser and you should be redirected to the FON login page when you try to access any page other than those in the "free" uamallowed lines in chilli.conf. Once you login, if this is an unregistered router and you added your unique key correctly you will be asked to register this router to your account. Otherwise you will just see the normal FON user page and now have full access to the web.

If anything goes wrong with the FON Hotspot connection, go through the above guide again paying attention specifically to the FON virtual interface settings, MTU/PPPOE bugfix in the firewall code, chilli.conf setup and starting the chillispot service.


Admin > Commands (Startup)

Once you're satisfied that your Hotspot is functioning correctly, you now need to add the following code to your router's startup commands in order to run chillispot and the heartbeat every time it is turned on / rebooted. You may wish to alter the sleep value (in seconds) if you think it'll take longer that 2 minutes for your router to establish a full internet connection, though this is not too critical.

#!/bin/sh

##

# wait for net connection at boot (in secs, alter if it takes longer for you) 
sleep 120

# start heartbeat
/jffs/thinclient start 2>&1 | logger

# start chillispot
/usr/sbin/chilli --conf /jffs/chilli.conf

Copy the above code in to the commands box and click the Save Startup button.

Services > Services

Scroll down the services tab to the bottom and Disable the Telnet service along with any other unneeded services (preferably all but DNSMasq) to free up as much memory as posible. You can re-enable Telnet here whenever needed but you shouldn't need it any longer for this guide.

Now click apply to save and alter the settings.


Final Reboot

Now click the Reboot Router button. If all goes well the router will restart and automatically run the heartbeat and chillispot once an internet connection is established. Watch the Memory section on the Status tab, specifically the Free and Buffers section for a significant drop once chillispot kicks in (usually around 3 mins after boot). They should drop to between 300 and 800 kB, quite low which is why you should have disabled as many unneeded services as possible.

You should also be able to connect to both the private and hotspot networks as normal, and continue to do so unless the JFFS2 space is disabled (removing the heartbeat and chillispot files) which should only happen if you upgrade the firmware (in which case all settings will likely be reset anyway).

Also, if the internet connection is ever dropped by the router, chillispot will automatically stop until the connection is regained, at which point it will start right back up again on it's own.

Now, if you had problems or want to do stuff differently, read on. Otherwise, Happy Hotspot running!

Setting Up Chillispot

06/20

You now need to set up Chillispot to enable the hotspot to function correctly. Basically Chillispot takes over the FON SSID and assinged a 192.168.182.X address to anyone connecting to it, then redirects them towards FON's login pages one they try to access any site other than those under the UAM Allowed field.

Much of the information is generic though there's one thing you must change and one where you may need to. If you've not already registered your router with FON the see the informationg at the top of this page. If you have, you only need to know your router's WLAN (Wireless LAN) MAC address, which should be found (among other places) on the Configure Your FON Router page after loging in to Fon.com. You must add this address to the Radius NAS ID field, in UPPERCASE letters, separed in pairs by dashes ( - 's).


Those of you with a router not already registered with FON should put the whole https://www.fon.com/login/gateway/sec/xxx... address (generated from the unique key quide at the top of the page) in the Redirect URL field. This should allow you to register your router with FON when you first connect to it, though note that this HAS NOT YET BEEN TESTED by myself or anyone else that I know of. Registered users can safely use the https://www.fon.com/login/gateway address, but also note that there must be no following slash on either url.


You very likely want to enable the Separate Wifi from the Lan Bridge option, otherwise any devices connected by cable to the router will be sent through the FON Hotspot signin process. Then again, if you're running a Hotspot in a shop you may actually want to provide a row of 4 wired hotspot connections ;o), in which case leave it disabled. YMMV.

DNS IP can either be your regular provider's DNS (see Status tab > DNS1 in web config) or use a DNS address such as one of OpenDNS's ones (see www.opendns.com). The dns2 line in the additional options box is an optional backup DNS address, so should be different from the IP in the DNS IP box.

And finally, you may want to alter URLs in the UAM Allowed field or uamallowed list/s (both do the same thing, they're just separated for ease of reading / editing). Any URL in here will be accessible by FON SSID clients before logging in. A few such as www.fon.com, www.paypal.com, www.paypalobjects.com, www.skype.com and www.google.com should be left there to allow the Hotspot to function as intended (no paypal = no passes sold). Note that addresses in any uamallowed line or the UAM Allowed box should be separated by commas, no spaces, no http://.


Example settings for Services > Hotspot tab:

Sputnik: Disable
Wifidog: Disable

Chillispot: Enable
Seperate Wifi from LAN Bridge: Enable
Primary Radius Server: radius01.fon.com
Backup Radius Server: radius02.fon.com
DNS IP: 208.67.222.222
Remote Network: 192.168.182.0/24
Redirect URL: https://www.fon.com/login/gateway
Shared Key: garrafon
DHCP Interface: WLAN
Radius NAS ID: XX-XX-XX-XX-XX-XX
UAM Secret: garrafon
UAM Any DNS: 1
UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com
MACauth: Disable
Additional Chillispot Options: (copy and paste the following 6 lines into box)

uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com
uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp
uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161
uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp
dns2 208.67.220.220


HTTP Redirect: Disable
NoCatSplash: Disable
SMTP Redirect: Disable


RC1

As RC1 will not let you enable chillispot for the physical interface, you cannot use the web gui to set it up. Luckily it's just as easy to set up without it.

Note: JFFS support must be enabled to use the following. Otherwise you can change /jffs to /tmp and save as startup instead of running.

Browse to Administration > Commands and copy and paste the following in to the commands box, then hit Run Commands. Note: Run Commands may not work, either save as startup or telnet in and paste everything after ## .

You'll notice that the info is much the same as above, so you can change DNS server addresses if needed, add your router key to the uamserver address, and add your own websites to a uamallowed line to allow free access. IF you have problems, you may want to change the text `nvram get wl0_hwaddr|sed -e s/:/-/g` to just your known WLAN Mac address in the above format for the Radius NAS ID.

#!/bin/sh

##

echo -n '
dhcpif wl0.1
radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
macauth
radiussecret garrafon
uamserver https://www.fon.com/login/gateway
uamsecret garrafon
uamallowed  www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com
uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com
uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp
uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161
uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp
uamanydns
net 192.168.182.0/24
dynip 192.168.182.0/24
dns1 208.67.222.222
dns2 208.67.220.220
' > /jffs/chilli.conf

echo -n "radiusnasid `nvram get wl0_hwaddr|sed -e s/:/-/g`" >>/jffs/chilli.conf

You should the copy and paste the following in to the commands box, and click Save Startup.

#!/bin/sh

##

# Execute chillispot.

/usr/sbin/chilli --conf /jffs/chilli.conf

To start chillispot immediately without a reboot, you can copy and paste the code in to the commands box again and click Run Commands.


The End

At this point you should now be able to save your settings, reboot the router (NOTE: If you clicked apply after all settings changes, and used the Run Commands button after pasting the chillispot and firewall code, you should not need to reboot) and connect to the encrypted virtual SSID with full, unrestricted access to the net. Connections to the FON SSID will allow unrestricted access to any address in the Chillispot UAM Allowed field and any other address should redirect to the login pages. Users should then be able to login as normal and access all pages.

Hopefully, if all goes as intended, unregistered routers will also now get a page asking them to register their router with fon. You'll probably need to already have an account at fon to register the router to. That's all untested ground though so who knows? ;o)

FON Heartbeat

With JFFS Support

All routers running official FON firmware send a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com, but also to download updates to the firmware and chillispot configuration. Running an unofficial FON hotspot means you don't need the downloaded updates, but it's still nice to have the router show up as online on the FON maps. To do this, you need to implement the FON Heartbeat in DD-WRT.

The following script was originally created by Freddy - you can read more about it at http://fon.freddy.eu.org/heartbeat/ .

Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Run Commands button.

#!/bin/sh

cd /jffs
wget http://fon.freddy.eu.org/heartbeat/fonkey
wget http://fon.freddy.eu.org/heartbeat/thinclient
chmod 755 /jffs/thinclient
/jffs/thinclient start 2>&1 | logger

Then add the following to Admin > Commands and hit Save Startup to run the script at each boot. Note that you MUST include the chillispot execution code aswell if you want chillispot to run, otherwise you can remove it.

#!/bin/sh

/jffs/thinclient start 2>&1 | logger

# Execute chillispot.
/usr/sbin/chilli --conf /jffs/chilli.conf

Obviously if you want to store the script in /mmc or somewhere else, you'll need to substitute the /jffs in the above code for that folders name. You will also need to modify the thinclient file before running it to replace the /jffs text on lines 6 and 9 with your permanent storage folder. This is exactly what I did with the temporary heartbeat in the main guide, if you ever want / need to download the code from Freddy's site instead of mine.


Post-setup Changes

The virtual SSID (FON_WIFI_HOTSPOT...) is the equivalent of FON's online "Configure your FON Router - Router name" setting. It will not be changed if you alter it online, but instead you can change it here whenever needed, although I don't recommened removing the first FON_ part as it may confuse people.


Differing Firmware Tips

Without JFFS Support

If you do not have JFFS Support enabled you can still use the heartbeat, just a slightly modified version.

Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Save Startup button.

#!/bin/sh

# wait until net connection established
sleep 600

# get heartbeat files
cd /tmp
wget http://www.inaudible.co.uk/perm/thinclient
wget http://www.inaudible.co.uk/perm/fonkey
chmod 755 /tmp/thinclient

# start heartbeat script
/tmp/thinclient start 2>&1 | logger

The script will now run at on every boot of the router, so you can either reboot it now or just re-paste the script in to the commands box and click "Run Commands". The script will execute 10 minutes after booting (or running commands) to insure that an internet connection is active (mainly for PPPOE users), and your hotspot should turn active (dark green) on fon maps within a few hours, if not sooner.


Troubleshooting

Troubleshooting Heartbeat

The main clue to problems with the heartbeat is obviously the router spot on fon maps not going a dark green colour. Here's some things to check:

1. Are you connected to the internet / have you rebooted the router and gone through installing the heartbeat again? Obvious ones, but a simple problem to solve.

2. Has the script downloaded correctly? It's currently hosted on my personal website, so that may have been inaccesible while your router tried downloading files. You can try telneting in to the router and running all the commands from the script following the "sleep" command (and ignoring # comment lines). If you type ls in the /tmp directory you should see both files listed, with thinclient in green text to signify it has been chmod'ed correctly. After hitting enter on the final command there should be a slight pause but nothing more exciting.

2. Has the known_hosts file been downloaded to /tmp/root/.ssh/ ? If not, thinclient could either not connect to the internet, of one of the commands was wrong. Try running just "/tmp/thinclient start" to see if there are any error messages. The most likely thing is that you have either not managed to download fonkey or thinclient to the right place, you have not chmod'ed thinclient correctly or you edited thinclient wrongly.

3. Is your WLAN MAC being selected correctly by thinclient? From your router's ssh or telnet command line, run both "nvram show | grep wl0_hwaddr" and "nvram show | grep il0macaddr". If the first comes back blank, and the second comes back with your WLAN MAC, you need to edit thinclient with vi again to remove the first part of line 26, that's WLMAC="$(/usr/sbin/nvram get wl0_hwaddr)" # original: , and leave just WLMAC="$(nvram get il0macaddr)". Now thinclient should correctly gather your MAC address which may help in showing it as active on fon maps.






                1. old ##########


PPPOE USERS PLEASE NOTE: There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore MUST use the following fix to enable Chillispot to function correctly. This does not apply if you have a seperate modem that connects to the net using PPPOE but then connects to the rest of your network (eg. your dd-wrt router) using a regular local IP address.

In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing only any #!/bin/sh text already present and leaving the rest intact.

#!/bin/sh

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu
NOTE: If your MTU is different from 1492, you must replace the 1452 in the above code with your current MTU value, minus 40. Eg: If your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).





FON SSID

06/20

The unencrypted FON Hotspot SSID should be set up on the wireless physical interface ( wl0 / eth0 ) with the encrypted private SSID on the virtual interface. This is due to a problem I encountered using encryption on the physical and an open virtual interface (namely that I could no longer connect to the physical interface). It also makes the setup of Chillispot much easier (you don't need to edit any config files to change eth0 to wl0.1).

You can name the SSIDs anything you like though you should probably name the FON SSID "FON_something" as this is the same naming convention used by FON. I also recommened adding something like "NoEncryption" to the SSID as it may show up at times as being encrypted (an old bug with VAPs and various wireless cards). And obviously leave the broadcast enabled so people see the SSID. Use common sense in the choice of wireless channel (google it).

The FON SSID should be Unbridged and use an IP address other than that of your WAN IP, Local IP or 192.168.182.X as this is used by Chillispot. The Subnet mask should be the same as your router's subnet mask.

RC1

On DD-WRT RC1 version you MUST set up the FON Hotspot on the virtual interface. It can then be changed to isolated, securing it from the rest of the network. Other settings are as above.


Private SSID

06/20

The virtual interface should be bridged, AP Isolation enabled and I strongly recommend that SSID broadcast is enabled too. This is due to problems I experienced getting devices (such as routers in client mode) to automatically connect to a VAP with a hidden SSID. At times, unhiding the SSID, allowing the device to connect, then rehiding it would work, though after a reboot of either router or device the problem would return. Strangely, devices that connected on demand such as adding a profile for the ssid to my laptop and telling it to connect would always work fine. This is probably a bug that will be fixed in later DD-WRT releases, but for now, if anyone other that yourself with on-demand wireless devices are connecting to the virtual SSID, I'd recommend leaving SSID broadcast enabled.

The down side to all that is the FON SSID is much more likely to be uncorrectly recognized as encrypted by other wireless devices, and at times not recognized at all. YMMV, as ever.

RC1

On RC1 you MUST setup the private network on the physical interface. Hiding the SSID seems to have no affect on functionality.

Example settings for Wireless Basic Setup tab:

06/20
Wireless Mode: AP
Wireless Network Mode: Mixed
Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption
Wireless Channel: 11
Wireless SSID Broadcast: Enable
Network Configuration: Unbridged
IP Address: 192.168.10.1
Subnet Mask: 255.255.255.0

Virtual Interface
Wireless Network Name: wrt54gl_wpa2
Wireless SSID Broadcast: Enable
AP Isolation: Enabled
Network Configuration: Bridged
RC1
Wireless Mode: AP
Wireless Network Mode: Mixed
Wireless Network Name: wrt54gl_wpa2
Wireless Channel: 11
Wireless SSID Broadcast: Enable
Network Configuration: Bridged

Virtual Interface
Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption
Wireless SSID Broadcast: Enable
AP Isolation: Enabled
Network Configuration: Unbridged
IP Address: 192.168.10.1
Subnet Mask: 255.255.255.0
                  1. /old ########