FON Hotspot

From DD-WRT Wiki

Revision as of 19:37, 23 June 2007 by Pepsimax2k (Talk | contribs)
(diff) ←Older revision | Current revision (diff) | Newer revision→ (diff)
Jump to: navigation, search

PLEASE NOTE: The following guide is a work in progress. [b]Last Update: 22/06 - pppoe mtu bug possible fix, uamallowed sites, heartbeat[/b]

This tutorial will guide you through the steps needed to set up a FON hotspot on your DD-WRT router, allowing for a private and encrypted wireless network along with the open FON network. Tips are also given on registering new routers with FON without previously having loaded the official FON firmware, running a heartbeat for the router to appear active on the FON maps and various other configuration options.

If was writen using DD-WRT v24 (06/20/07) on a WRT54GL v1.1 but should work identically on any other Broadcom router with the same DD-WRT version,t and probably just as well on any other DD-WRT capable router that can run Chillispot (ie. not the La Fonera). Later DD-WRT versions should also work fine, so long as they have no bugs with dual SSIDs or wireless encryption.


Contents

Foreword

The following is compiled from information from numerous other guides and forum posts around the web, non of which I got working individually but together they're pretty good. Here's a few:

http://www.geek-pages.com/articles/latest/dd-wrt_-_multiple_ssids_-_1_for_fon_-_1_for_private_network.html http://startu.net/chilli/setup.html http://fon.freddy.eu.org/heartbeat/ http://boards.fon.com/viewtopic.php?t=1838&postdays=0&postorder=asc&start=20


Also, when the following is up and running on a WRT54GL v1.1 , you'll end up with very high memory usage (between around 91% and 96%). This hasn't been a problem for me so far but... You may wanna try out the mini firmware version instead of standard. I'm not sure if it'll be much better, and you'll have to enable jffs, install chillispot from a seperate [url=http://www.dd-wrt.com/wiki/index.php/Ipkg]ipkg[/url] (then likely set up the chilli.conf file yourself), but the upside is the jffs heartbeat method will work  :D ... :(



FON On DD-WRT w/ Chillispot

Router: WRT54GL v1.1 DD-WRT: v24 06/20/07 (20th June)


Registering New Routers

Before starting this guide, bear in mind that a FON Hotspot will only work if the router has been registered with FON. The easiest way to do this is to have registered it while using the official FON firmware. This is available at http://www.fon.com/en/download for the Linksys WRT54G, GL, GS v1-4, Buffalo WZR-RS-G54, WHR-G54S and HP-G54. If you have one of these routers, you may want to get the unique key mentioned below by just connecting to the router's FON Hotspot and accessing the FON login page. At this point, copy everything in the URL up until the variables starting ?res= and jump to the router setup part of this guide.


There is however another (as yet untested by myself) way to register a new router without using the official firmware, also oppening up the possibility to use any router that will allow Chillispot to be run.

The main aim is to generate a unique key from FON based on your router's MAC address. On official FON routers this is done by running the following code on bootup, where xx-xx-xx-xx-xx-xx is the wlan mac address of your router IN LOWER CASE LETTERS, separated by dashes (if you're unsure of yours, ssh or telnet to your router and run "nvram show | grep wl0_hwaddr"):

[code]/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx[/code]

Normally this is used to create a customised Chillispot config file, but in this case we just want to create a temporary file containing the custom key needed to register a new router.

Unfortunately the only way I know of running the code at the moment is from a router running the official FON firmware, such as a La Fonera. I'm quite happy to generate the key on my own router if you do not have access to one, just get in touch with me ( pepsi_max2k ) with your MAC address and I'll try help out. Otherwise, log in to your official FON router with SSH or telnet and try the following (replacing xx-xx... with your intended DD-WRT FON router's WLAN mac IN LOWER CASE LETTERS):

[code]cd /tmp

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx > customkey.txt

more customkey.txt[/code]

The thing you're looking for is the very last line starting "uamserver https://www.fon.com/login/gateway/sec/xxx... The long random looking string is the key needed to register your router for the first time. The info contained after the uamallowed lines contains all the web addresses accessible by users connecting to your fonspot before login, including any "homepage" added on the FON configuration pages for pre-registered routers. Some of these are esscential for correct functioning of a FON Hotspot (like paypal) though others aren't so important. You can either add all of these in the Chillispot setup later in this guide, or just use my default esscential URLs.

Anyway, if you haven't already registered your router, you'll want to remember that random key for later. Otherwise, it's not really needed but can still be used if you so wish (I still use mine). Aaaand on with the guide...


Setting Up Your Router's Internet Connection

Starting from default settings, change just enough to get a internet connection accessible on the router. Most likely this is using DHCP or a static IP.

[color=red]PLEASE NOTE: There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using an MTU other than the default 1500. This will mainly affect routers set up to connect directly to the internet using a PPPOE connection, so it is strongly recommended that you do not continue with the following if you must use a PPPOE connection with an MTU other than 1500 on the router you wish to set up a FON hotspot on. You can find your current MTU setting by telneting or sshing into the router and typing "nvram show | grep wan_mtu".

The following is a possible, but untested fix to the problem - paste and save as firewall in admin > commands.[/color]

[code]#!/bin/sh

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1421:65535 -j TCPMSS --clamp-mss-to-pmtu[/code]

[color=red]The following may also work as a fix:

Paste the following in Admin > Commands and click Save Firewall.[/color]

[code]#!/bin/sh

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1452[/code]

[color=red]Reboot, then login to the router over telnet or ssh and enter the following:[/color]

[code]ifconfig tun0 mtu 1492[/code]


The following assumes the router is connected using a local WAN IP such as 192.168.X.X with a 1500 MTU.

Change the router's Local IP Address to a subnet other than that of the WAN IP.

Example settings for basic setup tab:

[quote]WAN IP is 192.168.1.1.

Connection Type: DHCP STP: Enable

MTU: Auto

Local IP is 192.168.2.1. Subnet Mask: 255.255.255.0 Gateway: 0.0.0.0 Local DNS: 0.0.0.0

DHCP Type: DHCP Server DHCP Server: Enable Start IP Address: 100 Static DNS: 0.0.0.0[/quote]

Setting Up Wifi Networks

To start with, you may want to make sure you have a firmware version / router without any bugs in the virtual interface setup. From default settings, you can just click Add on the Wireless Basic Settings tab to add a single Virtual Interface (wl0.1). All other settings can be left alone, with no encryption on either interface, and both being bridged. If you can then connect to both interfaces seperately and get a connection to the internet, the following should work fine. If not, try searching the message boards to find a solution until you can access the internet from both SSIDs while bridged and using no encryption and no isolation.

[b]FON SSID[/b]

The unencrypted FON Hotspot SSID should be set up on the wireless physical interface ( wl0 / eth0 ) with the encrypted private SSID on the virtual interface. This is due to a problem I encountered using encryption on the physical and an open virtual interface (namely that I could no longer connect to the physical interface). It also makes the setup of Chillispot much easier (you don't need to edit any config files to change eth0 to wl0.1).

You can name the SSIDs anything you like though you should probably name the FON SSID "FON_something" as this is the same naming convention used by FON. I also recommened adding something like "NoEncryption" to the SSID as it may show up at times as being encrypted (an old bug with VAPs and various wireless cards). And obviously leave the broadcast enabled so people see the SSID. Use common sense in the choice of wireless channel (google it).

The FON SSID should be Unbridged and use an IP address other than that of your WAN IP, Local IP or 192.168.182.X as this is used by Chillispot. The Subnet mask should be the same as your router's subnet mask.

[b]Private SSID[/b]

The virtual interface should be bridged, AP Isolation enabled and I strongly recommend that SSID broadcast is enabled too. This is due to problems I experienced getting devices (such as routers in client mode) to automatically connect to a VAP with a hidden SSID. At times, unhiding the SSID, allowing the device to connect, then rehiding it would work, though after a reboot of either router or device the problem would return. Strangely, devices that connected on demand such as adding a profile for the ssid to my laptop and telling it to connect would always work fine. This is probably a bug that will be fixed in later DD-WRT releases, but for now, if anyone other that yourself with on-demand wireless devices are connecting to the virtual SSID, I'd recommend leaving SSID broadcast enabled.

The down side to all that is the FON SSID is much more likely to be uncorrected recognized as encrypted by other wireless devices, and at times not recognized at all. YMMS, as ever.


Example settings for Wireless Basic Setup tab:

[quote]Wireless Mode: AP Wireless Network Mode: Mixed Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption Wireless Channel: 11 Wireless SSID Broadcast: Enable Network Configuration: Unbridged IP Address: 192.168.10.1 Subnet Mask: 255.255.255.0

Virtual Interface Wireless Network Name: wrt54gl_wpa2 Wireless SSID Broadcast: Enable AP Isolation: Enabled Network Configuration: Bridged[/quote]


Setting Up Wireless Encryption

Wireless encryption should be left disabled for the FON Physical Interface for obvious reasons, and can be changed to whatever you like on the Virtual Interface, though again for obvious reasons should not be left disabled, otherwise people will just connect to that instead of the FON SSID for free net access.


Example settings for Wireless Security tab:

[quote]Physical Interface wl0 Security Mode: Disabled

Virtual Interface wl0.1 Security Mode WPA2 Personal Mixed WPA Algorithms: TKIP+AES WPA Share Key: XXXXXXXXXXXXX Key Renewal Interval: 3600[/quote]


Setting Up Chillispot

You now need to set up Chillispot to enable the hotspot to function correctly. Basically Chillispot takes over the FON SSID and assingd a 192.168.182.X address to anyone connecting to it, then redirects them towards FON's login pages one they try to access any site other than those under the UAM Allowed field.

Much of the information is generic though there's one thing you must change and one where you may need to. If you've not already registered your router with FON the see the informationg at the top of this page. If you have, you only need to know your router's WLAN (Wireless LAN) MAC address, which should be found (among other places) on the Configure Your FON Router page after loging in to Fon.com. You must add this address to the Radius NAS ID field, in UPPERCASE letters, separed in pairs by dashes ( - 's).

Those of you not already registered with FON should put the whole https://www.fon.com/login/gateway/sec/xxx... address (generated from the unique key quide at the top of the page) in the Redirect URL field. This should allow you to register your router with FON when you first connect to it, though note that this HAS NOT YET BEEN TESTED by myself or anyone else that I know of.

You very likely want to enable the Separate Wifi from the Lan Bridge option, otherwise any devices connected by cable to the router will be sent through the FON Hotspot signin process. Then again, if you're running a Hotspot in a shop you may actually want to provide a row of 4 wired hotspot connections ;o), in which case leave it disabled. YMMV.

DNS IP can either be your regular provider's DNS (see Status > DNS1 ) or a set DNS such as one of OpenDNS's ones (see www.opendns.com).

And finally, you may want to alter URLs the UAM Allowed. Any URL in here will be accessible by FON SSID clients before logging in. A few such as www.fon.com, www.paypal.com, www.paypalobjects.com, www.skype.com and www.google.com should be left there to allow the Hotspot to function as intended (no paypal = no passes sold). Note these should be separated by commas, no spaces, no http://.

The following is the current full uamallowed sites used by FON, though I've not used them all yet as it's kinda long, should work fine in one line but you can add / remove sites as needed if not:

www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.martinvarsavsky.net,www.google.com, www.flickr.com,static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com, maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp, 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24, 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161, ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp

Example settings for Services Hotspot tab:

[quote]Sputnik: Disable Wifidog: Disable

Chillispot: Enable Seperate Wifi from LAN Bridge: Enable Primary Radius Server: radius01.fon.com Backup Radius Server: radius02.fon.com DNS IP: 212.159.6.10 Remote Network: 192.168.182.0/24 Redirect URL: https://www.fon.com/login/gateway/sec/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Shared Key: garrafon DHCP Interface: WLAN Radius NAS ID: XX-XX-XX-XX-XX-XX UAM Secret: garrafon UAM Any DNS: 1 UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.dd-wrt.com,www.dd-wrt.org MACauth: Disable Additional Chillispot Options: (blank)

HTTP Redirect: Disable NoCatSplash: Disable SMTP Redirect: Disable[/quote]

Setting Up Firewall

There's one last, optional but HIGHLY recommmended thing you should do before advertising the Hotspot. As it stands, anyone connected to the FON SSID will have full access to the whole 192.168.X.X network including your router's web admin page. To stop this you need to add the below code to the firewall. Do this by [i]pasting it into the box on the Admin > Commands page and hitting Save Firewall[/i].

It will also limit the speed of any uploads or download on the FON SSID. These can be altered by changing the numbers after DOWNLINK and UPLINK, currently set a 1 Mbps down and 256 Kbps up.

NOTE: For now, this only stops access to the main router and any devices connected directly to it. Devices in a seperate subnet (eg. router has 192.168.2.1 ip, other device is 192.168.1.1) will still be accessible for now (until I update this guide). Password protect things as needed.

Also note that any clients connected to the FON SSID will be able to access each others network shares. This appears to be the same for all official FON Hotspots too.

[code]#!/bin/sh

iptables -I INPUT -i tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br0 -o tun0 -j logdrop

iptables -A FORWARD -i tun0 -j DROP; iptables -t nat -I PREROUTING -i tun0 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -j DROP

DEV="tun0" DOWNLINK="1024" UPLINK="256"

tc qdisc del dev $DEV root tc qdisc del dev $DEV ingress

  1. limit download

tc qdisc add dev $DEV root handle 1: htb tc class add dev $DEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbit burst 6k tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1

  1. limit upload

tc qdisc add dev $DEV ingress handle ffff: tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1[/code]


The End

At this point you should now be able to save your settings, reboot the router and connect to the encrypted virtual SSID with full, unrestricted access to the net. Connections to the FON SSID will allow unrestricted access to any address in the Chillispot UAM Allowed field and any other address should redirect to the login pages. Users should then be able to login as normal and access all pages.

Hopefully, if all goes as intended, unregistered routers will also now get a page asking them to register their router with fon. You'll probably need to already have an account at fon to register the router to. That's all untested ground though so who knows? ;o)


FON Heartbeat

All routers running official FON firmware sent a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com, but also to download updates to the firmware and chillispot configuration.

Running an unofficial FON hotspot means you don't need the downloaded updates, but it's still nice to have the router show up as online on the FON maps. To do this, you need to implement the FON Heartbeat in DD-WRT.

As yet I've only had mine running for a total of about 24 hrs before manually rebooting and having to restart the heartbeat, so I'm not 100% sure it works for longer than that, but if you wanna try yourself then here's how I did it, and thanks to Freddy for the original script - you can read more about it at http://fon.freddy.eu.org/heartbeat/ .

Ensure Cron is enabled on the Admin > Management page. Telnet in to the router and run the following commands:

[code]cd /tmp wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient vi thinclient[/code]

You now need to use the vi editor to edit thinclient and replace the "jffs" on lines 6 and 9 with "tmp". It's really just a case of hitting "i", moving the cursor, backspace, writing in tmp, Esc, typing :wq! and that's it. Now type:

[code]/tmp/thinclient start 2>&1 | logger[/code]

After hitting enter there should be a slight pause but nothing more exciting, you should end up back at a regular command prompt. If you cd to /tmp/root/.ssh and ls you should see a file called "known_hosts" there if the script has worked. You can now exit ssh and the router should shortley show as online on maps.fon.com.


Note that this script will dissapear every time the router is re-booted. This is due to the fact that I have to store everything in the volatile /tmp directory on the router as I have no writeable space left on the permanent /jffs partition. Depending on the router you own, you may or may not have space there yourself. If you do, you can use the below, simpler guide and the heartbeat should run at startup every time.

[code]cd /jffs wget http://fon.freddy.eu.org/heartbeat/fonkey wget http://fon.freddy.eu.org/heartbeat/thinclient[/code]

And add the following to Admin > Commands and hit Save Startup.

[code]#!/bin/sh

/jffs/thinclient start 2>&1 | logger[/code]