FON Hotspot
From DD-WRT Wiki
Revision as of 11:47, 5 September 2007 (edit) Pepsimax2k (Talk | contribs) (→Enable FON Heartbeat) ← Previous diff |
Revision as of 11:50, 5 September 2007 (edit) (undo) Pepsimax2k (Talk | contribs) (→Admin > Commands (Startup)) Next diff → |
||
Line 433: | Line 433: | ||
## | ## | ||
- | # wait for net connection at boot (in secs, alter if it takes longer for you) | + | # wait for net connection at boot (in secs, alter if it takes longer for you) |
sleep 360 | sleep 360 | ||
Revision as of 11:50, 5 September 2007
Last Update:
04/09 - Startup commands sleep increased incase of longer connection time.
03/09 - Undergoing full re-write to fix numerous issues and make easier to follow.
29/08 - RC1 chilli no web access note
27/08 - fix manual chilli.conf 2x dns2 bug
25/08 - update instructions for RC1 usage
Welcome to the DD-WRT Fon Hotspot setup guide. If you have tried previous DD-WRT FON setup guides without success then fear not; the following guide has been tried and tested on three seperate routers with identicle success on each. It should be simple enough for anyone to walk through the guide so you don't need to know anything about coding or command line editing.
At the end of the guide you should end up with a registered FON hostpot using two wireless SSIDs, one private encrypted network and a seperate open FON hotspot network, and the original FON heartbeat function is included to show your hotspot as active on maps.fon.com. FON's online router personalization setup will still work, though any changes to the free website, router name, friends & family and wi-fi bandwith share settings won't work via the website although you can still change all of these (other that f&f) in the following setup guide.
References
The information used in the guide was compiled from various sources along with including original info. If you want to know more about the setup, or have a problem with some specific parts, the next few links may help you out.
http://startu.net/chilli/setup.html
http://fon.freddy.eu.org/heartbeat/
http://boards.fon.com/viewtopic.php?t=1838&postdays=0&postorder=asc&start=20
FON On DD-WRT w/ Chillispot
Requirements
Router: WRT54G, WRT54GL, WRT54GS, or any DD-WRT router capable of running Chillispot.
The guide has been tested on a WRT54GL 1.0, 1.1 and WRT54G 2.0.
Firmware: DD-WRT v24 RC1 NoKaid ( dd-wrt.v24_generic_nokaid.bin v24 RC1 (08/22/07) ).
Other versions allowing dual SSID and chillispot support should work depending on bugs, and versions without JJFS2 space (eg. Standard) can also be used but see Differing Firmware Tips at the end of the guide for slight changes in setup. RC1 NoKaid is the only version fully tested and supported in the following guide.
FON: Registered user with pre-registered router or router's unique key.
You must be a registered FON user to setup a FON Hotspot. Non-registered routers can be registered using the following guide, though see the Registering New Routers section for more.
Registering New Routers
The FON Hotspot created during this guide will only work if the router has already been registered with FON. This can be done either by registering the router while it is running the official FON firmware, or by having access to a seperate FON router for which you have SSH access. Pre-registered routers need no further input, but fron non-registered routers you need to access a uniquely generated key to register the router.
If you do not have access to either of these, send a PM to pepsi_max2k on boards.fon.com or contact me any other way, provide your WLAN MAC address and I will generate the key for you.
The official firmware is available at www.fon.com/en/download for the Linksys WRT54G, GL, GS v1-4, Buffalo WZR-RS-G54, WHR-G54S and HP-G54. If you have one of these routers you may want to get the unique key by just connecting to the router's FON Hotspot and accessing the FON login page. At this point, copy everything in the URL up until the variables starting ?res= and jump to the router setup part of this guide.
Otherwise you must generate the key manually using a seperate FON router. The main aim is to generate a unique key from FON based on your router's MAC address. On official FON routers this is done by running the following code on bootup, where xx-xx-xx-xx-xx-xx is the wlan mac address of your router in lower case letters, separated by dashes (if you're unsure of yours, check the Status > Sys-Info page on your intended DD-WRT FON router for the Wireless MAC address).
You need to log in to your official FON router with SSH or telnet (see stefans.datenbruch.de/lafonera/#kolofonium for details on how, and use putty for SSH) and copy / paste the following code (replacing xx-xx... with your intended DD-WRT FON router's WLAN mac address in lower case letters):
/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx
As soon as you press enter, around 20 lines of code will be printed out, ending in something that looks like the following:
uamserver https://www.fon.com/login/gateway/sec/9c3370131faaxxxxxxxxxxxxxxxxxxxx net 192.168.182.0/24 dynip 192.168.182.0/24 dns1 208.67.222.222 dns2 208.67.220.220
The thing you're looking for is the very last line starting "uamserver https://www.fon.com/login/gateway/sec/...". The long random looking 32 digit string after /sec/ is the key needed to register your router for the first time (I've added x's to the end of mine above to avoid you copying it ;o). Make a note of this exact key (copy and paste if you can) as you'll need it to register your router for the first time.
Router Settings
The following should generally be followed in the order written so as to avoid any more reboots than needed or any complications with settings. Many settings are meant as a guide and can be changed to suit your own needs (IP, passwords, etc) but may cause unforseen problems as they're untested. Settings not mentioned can also be changed when needed (NAT, QoS, other services) but bear in mind that the router will not have much free memory left with the given settings so you may experience problems if you enable too many other services.
You should start with etiher a fresh install of v24 RC1, or reset to defaults using the reset button on the router.
Administration > Management
The first settings you should change are those in the Admin > Management tab, specifically the password and enabling JFFS2.
Router Password Router Username: yourusername Router Password: yourpassword Change this to avoid unathorised access from hotspot users. Re-enter to confirm: yourpassword Web Access Protocol: HTTP Auto-Refresh (in seconds): 3 Enable Info Site: Enable Info Site Password Protection: Enabled Tick to avoid hotspot users seeing the info site. Info Site MAC Masking: Enable Remote Access Web GUI Management: Enable Disable if you don't need remote web access. Web GUI Port: 8080 Boot Wait Boot Wait: Enable Cron Cron: Enable This MUST be enabled for the Hotspot to work. Loopback Loopback: Enable 802.1x 802.1x: Enable Reset Button Reset Button: Enable Routing Routing: Enable JFFS2 Support JFFS2: Enable Clean JFFS2: Enable Enabled at this point incase JFFS space is not free. Language Selection Language: english MMC/SD Card Support MMC/SD Card Support: Disable IP Filter Settings (adjust these for P2P) Maximum Ports: 2048 Max ports should be kept as low as possible to free memory. TCP Timeout (in seconds): 190 UDP Timeout (in seconds): 120 Overclocking Frequency: 200 MHz CIFS Automount Common Internet File System: Disable
You should now click the apply button and then the reboot router button in order to clear the JFFS2 space properly.
Once rebooted, refresh this tab and check that the JFFS2 Total / Free Size contains a second value greater than 0, eg 384.00 KB / 60.00 KB. This confirms that 60 kilobytes of JFFS space has been freed. If this value reads 0, either try to clean the JFFS again or you may need to use a further stripped down version (you did use nokaid, right?), a router with greater RAM available, or check the section in this guide titled Without JFFS Support.
Setup > Basic Setup
Once the router has rebooted, browse to the Setup > Basic Setup tab and change the settings in order to get your internet connection active. Take note of your (automatic) MTU setting (specifically if using PPPOE) as if it differs from 1500 then you'll need to fix a bug with chillispot later on. The following settings assume a DHCP connection.
WAN Connection Type Connection Type: Automatic configuration : DHCP STP: Enable Optional Settings Router Name: DD-WRT Host Name: Domain Name: MTU: Auto 1500 Router IP Local IP is 192.168.1.1. Subnet Mask: 255.255.255.0 Gateway: 0.0.0.0 Local DNS: 0.0.0.0 Network Address Server Settings (DHCP) DHCP Type: DHCP Server DHCP Server: Enable Start IP Address: 192.168.1.100 Maximum DHCP Users: 50 Client Lease Time: 1440 Minutes Static DNS 1: 208.67.222.222 You can leave these blank to use your ISPs DNS, Static DNS 2: 208.67.220.220 but I use OpenDNS.org's DNS servers. Static DNS 3: 0.0.0.0 WINS: 0.0.0.0 Use DNSMasq for DHCP: Ticked Use DNSMasq for DNS: Ticked DHCP-Authoritative: Ticked Time Settings NTP Client: Disable Disabled to free memory, only enable if really needed.
Now press the apply button to save and enable these settings.
Setup > DDNS / Other
If you wish to setup a DDNS service then you should do so now (remember to click apply once you're done).
If you wish to change any other settings under the Setup tab you should also do this now, though I don't advise this as it may cause unforseen problems with the hotspot.
Wireless > Basic Setup
Due to problems running chillispot on the physical wireless interface, interfaces must be set up as follows with the private on physical and hotspot on virtual. You should also not alter anything other than the SSID names and wireless channel to suit your circumstances, with the SSID Broadcast setting being left enabled for at least the virtual (hotspot) interface and NoEncryption added to the hotspot name to assure people that it's not really encrypted incase they see it as such (we'll go over that later when we test).
First click the Add button under Virtual Interfaces to add one VI, then fill in the following details.
Physical Interface wl0 Wireless Mode: AP Wireless Network Mode: Mixed Allows as many people as possible to connect to hotspot. Wireless Network Name (SSID): wrt54gl_wpa2 Change to suit your needs. Wireless Channel: 1 Change to suit your needs. Wireless SSID Broadcast: Enable Network Configuration: Bridged Virtual Interfaces wl0.1 Wireless Network Name (SSID): FON_WIFI_HOTSPOT_NoEncryption Recommended, but change to suit. Wireless SSID Broadcast: Enable You want people to know it's there, don't you? AP Isolation: Enable Network Configuration: Unbridged IP Address: 192.168.10.1 Subnet Mask: 255.255.255.0
Now click the apply button to save and enable these settings.
Wireless > Wireless Security
Wireless encryption should be left disabled for the FON Hotspot for obvious reasons, and can be changed to whatever you like on the private WLAN though again for obvious reasons should not be left disabled otherwise people will just connect to that instead of the FON SSID for free net access.
Physical Interface wl0 Security Mode: WPA2 Personal Mixed WPA Algorithms: TKIP+AES WPA Share Key: xxxxxxxxxxxxx I use a 13 digit key, change to whatever you like. Key Renewal Interval: 3600 Virtual Interface wl0.1 Security Mode: Disabled Don't be silly by enabling it :oP
Now click the apply button to save and enable these settings.
Wireless > Other
If you wish to change any other settings under the Wireless tab you should also do this now, though I don't advise this as it may cause unforseen problems with the hotspot.
Administration > Commands (Firewall)
The following code is used to create a firewall on your router blocking access to the private network from the hotspot and how fast a connection hotspot users can get; a number of these rules can be added or changed. It also includes a very important bug fix for those of you with an MTU other than 1500 (mostly PPPOE users) so pay attention!
The main lines blocking access to the network are the "iptables -t nat -I PREROUTING -i tun0 -d xxx.xxx.xxx.xxx/xx -j DROP" lines. The first of these should be changed to your router's own Local IP Address and Subnet Mask (see [#Setup > Basic Setup| Setup > Basic Setup]). The others can be removed if you so wish, but as they stand will block access to all privately used IP addresses. You must keep the ...192.168.182.1/32 -j ACCEPT rule in to allow the hotspot clients to access the Chillispot server.
The DOWNLINK and UPLINK values (in Kbps) limit the speed of any uploads or downloads by FON Hotspot users and can be changed as you see fit; currently they're set to 1 Mbps down and 256 Kbps up.
NOTE: If your MTU is different from 1492 (PPPOE default), you must replace the 1452 in the line with your current MTU value minus 40. Eg, if your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).
#!/bin/sh ## # IF USING MTU OTHER THAN 1500 (PPPOE), uncomment following line and change 1452 to your mtu minus forty # iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu iptables -I INPUT -i tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br0 -o tun0 -j logdrop # secure access to local addresses other than chillispot iptables -A FORWARD -i tun0 -j DROP; # change the following line's IP and Subnet to that of your routers (if not identicle) iptables -t nat -I PREROUTING -i tun0 -d 192.168.1.1/255.255.255.0 iptables -t nat -I PREROUTING -i tun0 -d 192.168.0.0/16 -j DROP iptables -t nat -I PREROUTING -i tun0 -d 169.254.0.0/16 -j DROP iptables -t nat -I PREROUTING -i tun0 -d 172.16.0.0/12 -j DROP iptables -t nat -I PREROUTING -i tun0 -d 10.0.0.0/8 -j DROP iptables -t nat -I PREROUTING -i tun0 -d 192.168.182.1/32 -j ACCEPT DEV="tun0" # change UP/DOWNLINK values (in kbps) to alter hotspot users up/download speeds DOWNLINK="1024" UPLINK="256" tc qdisc del dev $DEV root tc qdisc del dev $DEV ingress # limit download tc qdisc add dev $DEV root handle 1: htb tc class add dev $DEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbit burst 6k tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1 # limit upload tc qdisc add dev $DEV ingress handle ffff: tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1
Copy and paste the above code in to the commands box and click the save firewall button.
Telnet
Unfortunately as the commands box does not execute commands correctly in RC1, you now need to log in to the router by telnet to continue. Don't worry if you're unfarmiliar with this, I'll include step by step instructions.
Start by opening a command prompt in Windows (Start > Run > type cmd then hit OK) or Linux (you may need to install telnet). Type "telnet 192.168.1.1" minus the quotes, where 192.168.1.1 is your router's IP address if not ...1.1. You should now be asked for a login name; regardless of what you've set in the router this will be "root" without the quotes. The password will be the same as you've set on your router, in my guide this is "yourpassword".
When I ask you to enter code below, enter it line by line and hit enter at the end of each line to run the command before moving to the next line. You can paste copied lines in to telnet by a simple right mouse button click.
Disable Rstats
An optional but recommended step unless you know better, is to make sure Rstats is disabled to ensure as much memoy as possible is free. Enter the following in to the telnet prompt:
nvram set rstats_enable=0 nvram commit
A single line, nvram commit(): end, should print out to confirm this once done.
Check JFFS Space
Type the following to ensure that your JFFS space has been cleared correctly. You should see a blue "tmp" listed if it has, otherwise you should ensure that you are using the NoKaid firmware version and have enabled JFFS2 and Clean JFFS2 in the Admin web tab then clicked the apply then reboot buttons.
cd /jffs ls
Enable FON Heartbeat
All routers running official FON firmware send a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com and let FON know you're part of their community. To do this, you need to implement the FON Heartbeat in DD-WRT by downloading the heartbeat code originally created by Freddy. You can read more about this code at http://fon.freddy.eu.org/heartbeat/ .
Ensure Cron is enabled on the Admin > Management web page and then type (or paste) the following into the telnet prompt to download the files.
cd /jffs wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient chmod 755 /jffs/thinclient ls
After the ls, ensure that you see both the fonkey and thinclient files listed, the latter being a light green colour.
Now start the heartbeat script by typing the following code into telnet:
/jffs/thinclient start
After a minute or two wait, the following line should be printed out, but with your own Wireless and LAN MAC addresses listed.
sent: mode='start' wlmac='00:18:39:xx:xx:xx' mac='00:18:39:XX:XX:XX' fonrev='3' firmware='0.6.6' chillver='1.0-1' thclver='1.0' Something is wrong, /tmp/.thinclient.sh is empty
Ignore the final warning; the heartbeat should now be up and running and appear active on maps.fon.com. If not, check the troubleshooting section below for more help.
Create Chillispot Config File
The most important part of the whole hotspot; Chillispot controls the FON hotspot functionality including login details and "free" website access.
When creating the chilli.conf file, a number of things are customisable including DNS addresses and additional uamallowed lines or addresses, though keep in mind that much of the information is critical to the currect functioning or the hotspot.
If you have not already registered your router with FON, you'll need to know your router's unique key as detailed in the [#Registering New Routers| Registering New Routers] section of this guide.
Start off by creating the chilli.conf file in /jffs. We'll be using vi to edit stuff but if you have no idea what vi is, don't worry, just do what I say. Type the following in to telnet:
cd /jffs vi chilli.conf
The vi editor will now be showing, so now you need to type or copy and paste the following in to the telnet screen (copy, then just right click to paste). You will need to edit this code in a second, so keep reading.
radiusserver1 radius01.fon.com radiusserver2 radius02.fon.com radiussecret garrafon macauth dhcpif wl0.1 uamsecret garrafon uamanydns uamallowed www.martinvarsavsky.net,www.google.com,www.flickr.com,static.flickr.com,video.google.com,216.239.51.0/24,66.249.81.0/24 uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24 uamallowed shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com,maps.fon.com,c20.statcounter.com uamallowed www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp,202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159 uamallowed 202.47.18.161,202.47.19.159,202.47.19.161,ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp,gringo.fon.com uamallowed labs.fon.com,213.134.44.0/23,www.fonshop.com.tw,shop.hk.fon.com,maps.naver.com uamserver https://www.fon.com/login/gateway net 192.168.182.0/24 dynip 192.168.182.0/24 dns1 208.67.222.222 dns2 208.67.220.220
Firstly, if you did copy and paste, the text "radius" at the start of the file will be missing, so move the cursor to the start using the arrow keys and type "radius" in (without quotes) so that the code is identicle to above.
If you have not registered your router, add /sec/ and your unique key to the end of the uamserver line so that it looks a little like this:
uamserver https://www.fon.com/login/gateway/sec/9c3370131f....
If you wish to change the dns server addresses you can (the backspace or delete key should help), though I use OpenDNS.org's servers.
If you wish to add your own website to the "freely" accessible ones for hotspot users, add them to the end of the last uamallowed line without the http:// but with a , at the beginning so that it looks a little like so:
uamallowed labs.fon.com,213.134.44.0/23,www.fonshop.com.tw,shop.hk.fon.com,maps.naver.com,www.mywebsite.com,www.myothersite.co.uk
Once you have done editing the file, you should exit the edit mode by hitting the Esc key, enter command mode by hitting the : key (shift plus ;) and then save it by typing the following:
!wq
If you mess anything up, you can quite without saving by just typing !q and start again.
Once the chilli.conf file has been saved, you need to add another line to it ("radiusnasid XX-XX-XX-XX-XX-XX", that's your WLAN MAC in capitals separated by commas) but this time you don't need to edit anything yourself, just type the following line in to telnet and hit enter:
echo -n "radiusnasid `nvram get wl0_hwaddr|sed -e s/:/-/g`" >>/jffs/chilli.conf
Now type "more /jffs/chilli.conf" (and enter to continue to end) and check that the chilli.conf file is identicle to the above code (bar edits) and contains the correct radiusnasid line at the end (including your WLAN MAC in capitals separated by commas, v. important). If so, we shall continue. Otherwise you can delete the chilli.conf file by typing "rm /jffs/chilli.conf" (careful, rm is powerful) and start again.
Enable Chillispot
You can now start chillispot by typing the following command in telnet:
/usr/sbin/chilli --conf /jffs/chilli.conf
You shouldn't see any errors, but if you do it's probably because you typed out the chilli.conf file wrong. Just go back to the above and start again. Now type the following:
top
and, assuming your router is connected to the internet, you should see a chilli and possibly thinclient service running, chilli taking up ungodly amounts of memory. If so, all is well and you can exit top by hitting Ctrl-C, and exit telnet by typing "exit" (or just close the command window).
Test Wireless Connections / Register Router
You can now test out your new Wi-Fi private and hotspot networks, but you should bear in mind that differing makes of wi-fi recievers will see the encryption and broadcast settings differently regardless of setitngs. In my experience, the hotspot will at times be recognized as encrypted (when it's not) and you may never see the private physical SSID in a wireless network search, so you may need to provide correct details manually when connecting to either SSID.
So, start with the private interface and as I say you may have to enter details manually into your laptop / PC's wifi settings. You should recieve an IP in the range of your router's Local IP and have full access to the net. If so, on to the hotspot...
Again, if you're seeing the hotspot as encrypted, you may need to manually change the encryption to none and open to connect properly. Once you do, you should gain an IP address in the 192.168.182.X range so long as chillispot is running. Once you do, open a browser and you should be redirected to the FON login page when you try to access any page other than those in the "free" uamallowed lines in chilli.conf. Once you login, if this is an unregistered router and you added your unique key correctly you will be asked to register this router to your account. Otherwise you will just see the normal FON user page and now have full access to the web.
If anything goes wrong with the FON Hotspot connection, go through the above guide again paying attention specifically to the FON virtual interface settings, MTU/PPPOE bugfix in the firewall code, chilli.conf setup and starting the chillispot service.
Optional: Free More Memory
At this point you may be seeing a rather low amount of free memory on the status tab. This can cause unforseen problems, especially on routers with heavy traffic, such as reboots every 3 days or so. Because of this you will likely a) not want to use the hotspot on any critical routers and b) free up as much memory as possible in order to limit the amount of problems it could cause. Here's a few optional but recommended things you can do to achieve this:
Admin > Commands (Startup)
Once you're satisfied that your Hotspot is functioning correctly, you now need to add the following code to your router's startup commands in order to run chillispot and the heartbeat every time it is turned on / rebooted. You may wish to alter the sleep value (in seconds) if you think it'll take longer that 6 minutes for your router to establish a full internet connection. This is important as chillispot may not run correctly if it is started without an internet connection, although once running it will stop and start at will whenever the connection is dropped for a short time.
#!/bin/sh ## # wait for net connection at boot (in secs, alter if it takes longer for you) sleep 360 # start heartbeat /jffs/thinclient start 2>&1 | logger # start chillispot /usr/sbin/chilli --conf /jffs/chilli.conf
Copy the above code in to the commands box and click the Save Startup button.
Services > Services
Scroll down the services tab to the bottom and Disable the Telnet service along with any other unneeded services (preferably all but DNSMasq) to free up as much memory as posible. You can re-enable Telnet here whenever needed but you shouldn't need it any longer for this guide.
Now click apply to save and alter the settings.
Final Reboot
Now click the Reboot Router button. If all goes well the router will restart and automatically run the heartbeat and chillispot once an internet connection is established. Watch the Memory section on the Status tab, specifically the Free and Buffers section for a significant drop once chillispot kicks in (usually around 7 mins after boot depending on startup sleep value). They should drop to between 300 and 800 kB, quite low which is why you should have disabled as many unneeded services as possible.
You should also be able to connect to both the private and hotspot networks as normal, and continue to do so unless the JFFS2 space is disabled (removing the heartbeat and chillispot files) which should only happen if you upgrade the firmware (in which case all settings will likely be reset anyway).
Also, if the internet connection is ever dropped by the router, chillispot will automatically stop until the connection is regained, at which point it will start right back up again on it's own.
Now, if you had problems or want to do stuff differently, read on. Otherwise, Happy Hotspot running!
Setting Up Chillispot
06/20
You now need to set up Chillispot to enable the hotspot to function correctly. Basically Chillispot takes over the FON SSID and assinged a 192.168.182.X address to anyone connecting to it, then redirects them towards FON's login pages one they try to access any site other than those under the UAM Allowed field.
Much of the information is generic though there's one thing you must change and one where you may need to. If you've not already registered your router with FON the see the informationg at the top of this page. If you have, you only need to know your router's WLAN (Wireless LAN) MAC address, which should be found (among other places) on the Configure Your FON Router page after loging in to Fon.com. You must add this address to the Radius NAS ID field, in UPPERCASE letters, separed in pairs by dashes ( - 's).
You very likely want to enable the Separate Wifi from the Lan Bridge option, otherwise any devices connected by cable to the router will be sent through the FON Hotspot signin process. Then again, if you're running a Hotspot in a shop you may actually want to provide a row of 4 wired hotspot connections ;o), in which case leave it disabled. YMMV.
DNS IP can either be your regular provider's DNS (see Status tab > DNS1 in web config) or use a DNS address such as one of OpenDNS's ones (see www.opendns.com). The dns2 line in the additional options box is an optional backup DNS address, so should be different from the IP in the DNS IP box.
And finally, you may want to alter URLs in the UAM Allowed field or uamallowed list/s (both do the same thing, they're just separated for ease of reading / editing). Any URL in here will be accessible by FON SSID clients before logging in. A few such as www.fon.com, www.paypal.com, www.paypalobjects.com, www.skype.com and www.google.com should be left there to allow the Hotspot to function as intended (no paypal = no passes sold). Note that addresses in any uamallowed line or the UAM Allowed box should be separated by commas, no spaces, no http://.
Example settings for Services > Hotspot tab:
Sputnik: Disable Wifidog: Disable Chillispot: Enable Seperate Wifi from LAN Bridge: Enable Primary Radius Server: radius01.fon.com Backup Radius Server: radius02.fon.com DNS IP: 208.67.222.222 Remote Network: 192.168.182.0/24 Redirect URL: https://www.fon.com/login/gateway Shared Key: garrafon DHCP Interface: WLAN Radius NAS ID: XX-XX-XX-XX-XX-XX UAM Secret: garrafon UAM Any DNS: 1 UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com MACauth: Disable Additional Chillispot Options: (copy and paste the following 6 lines into box) uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24 uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161 uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp dns2 208.67.220.220 HTTP Redirect: Disable NoCatSplash: Disable SMTP Redirect: Disable
RC1
As RC1 will not let you enable chillispot for the physical interface, you cannot use the web gui to set it up. Luckily it's just as easy to set up without it.
Note: JFFS support must be enabled to use the following. Otherwise you can change /jffs to /tmp and save as startup instead of running.
Browse to Administration > Commands and copy and paste the following in to the commands box, then hit Run Commands. Note: Run Commands may not work, either save as startup or telnet in and paste everything after ## .
You'll notice that the info is much the same as above, so you can change DNS server addresses if needed, add your router key to the uamserver address, and add your own websites to a uamallowed line to allow free access. IF you have problems, you may want to change the text `nvram get wl0_hwaddr|sed -e s/:/-/g` to just your known WLAN Mac address in the above format for the Radius NAS ID.
#!/bin/sh ## echo -n ' dhcpif wl0.1 radiusserver1 radius01.fon.com radiusserver2 radius02.fon.com macauth radiussecret garrafon uamserver https://www.fon.com/login/gateway uamsecret garrafon uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24 uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161 uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp uamanydns net 192.168.182.0/24 dynip 192.168.182.0/24 dns1 208.67.222.222 dns2 208.67.220.220 ' > /jffs/chilli.conf echo -n "radiusnasid `nvram get wl0_hwaddr|sed -e s/:/-/g`" >>/jffs/chilli.conf
You should the copy and paste the following in to the commands box, and click Save Startup.
#!/bin/sh ## # Execute chillispot. /usr/sbin/chilli --conf /jffs/chilli.conf
To start chillispot immediately without a reboot, you can copy and paste the code in to the commands box again and click Run Commands.
The End
At this point you should now be able to save your settings, reboot the router (NOTE: If you clicked apply after all settings changes, and used the Run Commands button after pasting the chillispot and firewall code, you should not need to reboot) and connect to the encrypted virtual SSID with full, unrestricted access to the net. Connections to the FON SSID will allow unrestricted access to any address in the Chillispot UAM Allowed field and any other address should redirect to the login pages. Users should then be able to login as normal and access all pages.
Hopefully, if all goes as intended, unregistered routers will also now get a page asking them to register their router with fon. You'll probably need to already have an account at fon to register the router to. That's all untested ground though so who knows? ;o)
FON Heartbeat
With JFFS Support
All routers running official FON firmware send a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com, but also to download updates to the firmware and chillispot configuration. Running an unofficial FON hotspot means you don't need the downloaded updates, but it's still nice to have the router show up as online on the FON maps. To do this, you need to implement the FON Heartbeat in DD-WRT.
The following script was originally created by Freddy - you can read more about it at http://fon.freddy.eu.org/heartbeat/ .
Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Run Commands button.
#!/bin/sh cd /jffs wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient chmod 755 /jffs/thinclient /jffs/thinclient start 2>&1 | logger
Then add the following to Admin > Commands and hit Save Startup to run the script at each boot. Note that you MUST include the chillispot execution code aswell if you want chillispot to run, otherwise you can remove it.
#!/bin/sh /jffs/thinclient start 2>&1 | logger # Execute chillispot. /usr/sbin/chilli --conf /jffs/chilli.conf
Obviously if you want to store the script in /mmc or somewhere else, you'll need to substitute the /jffs in the above code for that folders name. You will also need to modify the thinclient file before running it to replace the /jffs text on lines 6 and 9 with your permanent storage folder. This is exactly what I did with the temporary heartbeat in the main guide, if you ever want / need to download the code from Freddy's site instead of mine.
Post-setup Changes
The virtual SSID (FON_WIFI_HOTSPOT...) is the equivalent of FON's online "Configure your FON Router - Router name" setting. It will not be changed if you alter it online, but instead you can change it here whenever needed, although I don't recommened removing the first FON_ part as it may confuse people.
Differing Firmware Tips
Without JFFS Support
If you do not have JFFS Support enabled you can still use the heartbeat, just a slightly modified version.
Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Save Startup button.
#!/bin/sh # wait until net connection established sleep 600 # get heartbeat files cd /tmp wget http://www.inaudible.co.uk/perm/thinclient wget http://www.inaudible.co.uk/perm/fonkey chmod 755 /tmp/thinclient # start heartbeat script /tmp/thinclient start 2>&1 | logger
The script will now run at on every boot of the router, so you can either reboot it now or just re-paste the script in to the commands box and click "Run Commands". The script will execute 10 minutes after booting (or running commands) to insure that an internet connection is active (mainly for PPPOE users), and your hotspot should turn active (dark green) on fon maps within a few hours, if not sooner.
Troubleshooting
Troubleshooting Heartbeat
The main clue to problems with the heartbeat is obviously the router spot on fon maps not going a dark green colour. Here's some things to check:
1. Are you connected to the internet / have you rebooted the router and gone through installing the heartbeat again? Obvious ones, but a simple problem to solve.
2. Has the script downloaded correctly? It's currently hosted on my personal website, so that may have been inaccesible while your router tried downloading files. You can try telneting in to the router and running all the commands from the script following the "sleep" command (and ignoring # comment lines). If you type ls in the /tmp directory you should see both files listed, with thinclient in green text to signify it has been chmod'ed correctly. After hitting enter on the final command there should be a slight pause but nothing more exciting.
2. Has the known_hosts file been downloaded to /tmp/root/.ssh/ ? If not, thinclient could either not connect to the internet, of one of the commands was wrong. Try running just "/tmp/thinclient start" to see if there are any error messages. The most likely thing is that you have either not managed to download fonkey or thinclient to the right place, you have not chmod'ed thinclient correctly or you edited thinclient wrongly.
3. Is your WLAN MAC being selected correctly by thinclient? From your router's ssh or telnet command line, run both "nvram show | grep wl0_hwaddr" and "nvram show | grep il0macaddr". If the first comes back blank, and the second comes back with your WLAN MAC, you need to edit thinclient with vi again to remove the first part of line 26, that's WLMAC="$(/usr/sbin/nvram get wl0_hwaddr)" # original: , and leave just WLMAC="$(nvram get il0macaddr)". Now thinclient should correctly gather your MAC address which may help in showing it as active on fon maps.
- old ##########
In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing only any #!/bin/sh text already present and leaving the rest intact.
#!/bin/sh iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtuNOTE: If your MTU is different from 1492, you must replace the 1452 in the above code with your current MTU value, minus 40. Eg: If your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).
FON SSID
06/20
The unencrypted FON Hotspot SSID should be set up on the wireless physical interface ( wl0 / eth0 ) with the encrypted private SSID on the virtual interface. This is due to a problem I encountered using encryption on the physical and an open virtual interface (namely that I could no longer connect to the physical interface). It also makes the setup of Chillispot much easier (you don't need to edit any config files to change eth0 to wl0.1).
You can name the SSIDs anything you like though you should probably name the FON SSID "FON_something" as this is the same naming convention used by FON. I also recommened adding something like "NoEncryption" to the SSID as it may show up at times as being encrypted (an old bug with VAPs and various wireless cards). And obviously leave the broadcast enabled so people see the SSID. Use common sense in the choice of wireless channel (google it).
The FON SSID should be Unbridged and use an IP address other than that of your WAN IP, Local IP or 192.168.182.X as this is used by Chillispot. The Subnet mask should be the same as your router's subnet mask.
RC1
On DD-WRT RC1 version you MUST set up the FON Hotspot on the virtual interface. It can then be changed to isolated, securing it from the rest of the network. Other settings are as above.
Private SSID
06/20
The virtual interface should be bridged, AP Isolation enabled and I strongly recommend that SSID broadcast is enabled too. This is due to problems I experienced getting devices (such as routers in client mode) to automatically connect to a VAP with a hidden SSID. At times, unhiding the SSID, allowing the device to connect, then rehiding it would work, though after a reboot of either router or device the problem would return. Strangely, devices that connected on demand such as adding a profile for the ssid to my laptop and telling it to connect would always work fine. This is probably a bug that will be fixed in later DD-WRT releases, but for now, if anyone other that yourself with on-demand wireless devices are connecting to the virtual SSID, I'd recommend leaving SSID broadcast enabled.
The down side to all that is the FON SSID is much more likely to be uncorrectly recognized as encrypted by other wireless devices, and at times not recognized at all. YMMV, as ever.
RC1
On RC1 you MUST setup the private network on the physical interface. Hiding the SSID seems to have no affect on functionality.
Example settings for Wireless Basic Setup tab:
06/20 Wireless Mode: AP Wireless Network Mode: Mixed Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption Wireless Channel: 11 Wireless SSID Broadcast: Enable Network Configuration: Unbridged IP Address: 192.168.10.1 Subnet Mask: 255.255.255.0 Virtual Interface Wireless Network Name: wrt54gl_wpa2 Wireless SSID Broadcast: Enable AP Isolation: Enabled Network Configuration: Bridged
RC1 Wireless Mode: AP Wireless Network Mode: Mixed Wireless Network Name: wrt54gl_wpa2 Wireless Channel: 11 Wireless SSID Broadcast: Enable Network Configuration: Bridged Virtual Interface Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption Wireless SSID Broadcast: Enable AP Isolation: Enabled Network Configuration: Unbridged IP Address: 192.168.10.1 Subnet Mask: 255.255.255.0
- /old ########