FON Hotspot

From DD-WRT Wiki

Revision as of 10:17, 25 August 2007 by Pepsimax2k (Talk | contribs)
Jump to: navigation, search
PLEASE NOTE: The following guide is a work in progress and not guaranteed to work on all dd-wrt versions.

Last Update:
23/08 - note on upcoming method for newer firmware versions
25/06 - heartbeat changed to auto startup script
24/06 - firewall changes, security update, general cleanup
23/06 - pppoe mtu bug fix, general guide updates

22/06 - pppoe mtu bug possible fix, uamallowed sites, heartbeat


This tutorial will guide you through the steps needed to set up a FON hotspot on your DD-WRT router, allowing for a private and encrypted wireless network along with the open FON network. Tips are also given on registering new routers with FON without previously having loaded the official FON firmware, running a heartbeat for the router to appear active on the FON maps and various other configuration options.

Note that the guide only works for routers already registered with FON. If you have not already registered your router, there is an aditional part to the guide at the top with details on how this can be achieved.

If was writen using DD-WRT v24 (06/20/07) and later v24 RC1 on a WRT54GL v1.1 but should work identically on any other Broadcom router with the same DD-WRT version, and probably just as well on any other DD-WRT capable router that can run Chillispot (ie. not the La Fonera). Later DD-WRT versions should also work fine, so long as they have no bugs with dual SSIDs or wireless encryption.


Contents

Foreword

The following is compiled from information from numerous other guides and forum posts around the web, non of which I got working individually but pieced together they're create a long sought masterpiece. Here's a few:

http://www.geek-pages.com/articles/latest/dd-wrt_-_multiple_ssids_-_1_for_fon_-_1_for_private_network.html

http://startu.net/chilli/setup.html

http://fon.freddy.eu.org/heartbeat/

http://boards.fon.com/viewtopic.php?t=1838&postdays=0&postorder=asc&start=20

Quick Start

If you just wanna get the basic facts, you can probably jump through most of the text quite saftely and just take the needed info out of the "Example settings" subheadings, along with the firewall code, so I won;t bother with a real quick start. Feel free to write your own if you miss it.



FON On DD-WRT w/ Chillispot

Test Router: WRT54GL v1.1


Test DD-WRT version: dd-wrt.v24_generic.bin v24 06/20/07 (20th June)

Works using FON Hotspot on WL0, private on WL0.1, chillispot set up through gui.

Known problems: Reboots every few days. Can't use chillispot on WL0.1.


Test DD-WRT version: dd-wrt.v24_generic_nokaid.bin v24 RC1 (08/22/07)

Works using FON Hotspot on WL0.1, private on WL0, chillispot set up manually.

Known problems: Can't use chillispot on WL0.


JFFS

For the RC1 setup, you should use the nokaid version of DD-WRT to free up some JFFS space. If you cannot do this you should find alternate ways included in the guide.

RC1 nokaid users should start by enabling JFFS through the Administration > Management page and setting JJFS Support as follows:

Example JFFS2 Support Settings

JFFS2: Enable
Clean JFFS2: Disable


Registering New Routers

The FON Hotspot created during this guide will only work if the router has already been registered with FON. The easiest way to do this is to have registered it while using the official FON firmware. This is available at http://www.fon.com/en/download for the Linksys WRT54G, GL, GS v1-4, Buffalo WZR-RS-G54, WHR-G54S and HP-G54. If you have one of these routers, you may want to get the unique key mentioned below by just connecting to the router's FON Hotspot and accessing the FON login page. At this point, copy everything in the URL up until the variables starting ?res= and jump to the router setup part of this guide.


There is however another (as yet untested by myself) way to register a new router without using the official firmware, also oppening up the possibility to use any router that will allow Chillispot to be run.

The main aim is to generate a unique key from FON based on your router's MAC address. On official FON routers this is done by running the following code on bootup, where xx-xx-xx-xx-xx-xx is the wlan mac address of your router IN LOWER CASE LETTERS, separated by dashes (if you're unsure of yours, ssh or telnet to your router and run "nvram show | grep wl0_hwaddr"):

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx

Normally this is used to create a customised Chillispot config file, but in this case we just want to create a temporary file containing the custom key needed to register a new router.

Unfortunately the only way I know of running the code at the moment is from a router running the official FON firmware, such as a La Fonera. I'm quite happy to generate the key on my own router if you do not have access to one, just get in touch with me ( pepsi_max2k ) with your MAC address and I'll try help out. Otherwise, log in to your official FON router with SSH or telnet and try the following (replacing xx-xx... with your intended DD-WRT FON router's WLAN mac IN LOWER CASE LETTERS):

cd /tmp

/usr/sbin/chilli_radconfig -c /dev/null --radiusserver1=radius01.fon.com --radiussecret=garrafon --adminuser=chillispot --adminpasswd=chillispot --radiusnasid=xx-xx-xx-xx-xx-xx --dhcpif xx-xx-xx-xx-xx-xx > customkey.txt

more customkey.txt

The thing you're looking for is the very last line starting "uamserver https://www.fon.com/login/gateway/sec/xxx... The long random looking string is the key needed to register your router for the first time. The info contained after the uamallowed lines contains all the web addresses accessible by users connecting to your fonspot before login, including any "homepage" added on the FON configuration pages for pre-registered routers. Some of these are esscential for correct functioning of a FON Hotspot (like paypal) though others aren't so important. You can either add all of these in the Chillispot setup later in this guide, or just use my default esscential URLs.

Anyway, if you haven't already registered your router, you'll want to remember that random key for later. Otherwise, it's not really needed but can still be used if you so wish (I still use mine). Aaaand on with the guide...


Setting Up Your Router's Internet Connection

Starting from default settings, change just enough to get a internet connection accessible on the router. Most likely this is using DHCP or a static IP.


PPPOE USERS PLEASE NOTE: There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore MUST use the following fix to enable Chillispot to function correctly. This does not apply if you have a seperate modem that connects to the net using PPPOE but then connects to the rest of your network (eg. your dd-wrt router) using a regular local IP address.

In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing only any #!/bin/sh text already present and leaving the rest intact.

#!/bin/sh

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu
NOTE: If your MTU is different from 1492, you must replace the 1452 in the above code with your current MTU value, minus 40. Eg: If your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).


The following assumes the router is connected using a local WAN IP such as 192.168.X.X with a 1500 MTU.

The only real change from default settings is having the router's Local IP Address on a subnet other than that of the WAN IP.

Example settings for basic setup tab:

WAN IP is 192.168.1.1.

Connection Type: DHCP
STP: Enable

MTU: Auto

Local IP is 192.168.2.1.
Subnet Mask: 255.255.255.0
Gateway: 0.0.0.0
Local DNS: 0.0.0.0

DHCP Type: DHCP Server
DHCP Server: Enable
Start IP Address: 100
Static DNS: 0.0.0.0

Setting Up Wifi Networks

Testing

To start with, you may want to make sure you have a firmware version / router without any bugs in the virtual interface setup. From default settings, you can just click Add on the Wireless Basic Settings tab to add a single Virtual Interface (wl0.1). All other settings can be left alone, with no encryption on either interface, and both being bridged. If you can then connect to both interfaces seperately and get a connection to the internet, the following should work fine.

Don't bother testing once you've unbridged or isolated the hotspot wlan, it shouldn't work until you get to the end of the guide with chillispot and firewall code running.

FON SSID

06/20

The unencrypted FON Hotspot SSID should be set up on the wireless physical interface ( wl0 / eth0 ) with the encrypted private SSID on the virtual interface. This is due to a problem I encountered using encryption on the physical and an open virtual interface (namely that I could no longer connect to the physical interface). It also makes the setup of Chillispot much easier (you don't need to edit any config files to change eth0 to wl0.1).

You can name the SSIDs anything you like though you should probably name the FON SSID "FON_something" as this is the same naming convention used by FON. I also recommened adding something like "NoEncryption" to the SSID as it may show up at times as being encrypted (an old bug with VAPs and various wireless cards). And obviously leave the broadcast enabled so people see the SSID. Use common sense in the choice of wireless channel (google it).

The FON SSID should be Unbridged and use an IP address other than that of your WAN IP, Local IP or 192.168.182.X as this is used by Chillispot. The Subnet mask should be the same as your router's subnet mask.

RC1

On DD-WRT RC1 version you MUST set up the FON Hotspot on the virtual interface. It can then be changed to isolated, securing it from the rest of the network. Other settings are as above.


Private SSID

06/20

The virtual interface should be bridged, AP Isolation enabled and I strongly recommend that SSID broadcast is enabled too. This is due to problems I experienced getting devices (such as routers in client mode) to automatically connect to a VAP with a hidden SSID. At times, unhiding the SSID, allowing the device to connect, then rehiding it would work, though after a reboot of either router or device the problem would return. Strangely, devices that connected on demand such as adding a profile for the ssid to my laptop and telling it to connect would always work fine. This is probably a bug that will be fixed in later DD-WRT releases, but for now, if anyone other that yourself with on-demand wireless devices are connecting to the virtual SSID, I'd recommend leaving SSID broadcast enabled.

The down side to all that is the FON SSID is much more likely to be uncorrectly recognized as encrypted by other wireless devices, and at times not recognized at all. YMMV, as ever.

RC1

On RC1 you MUST setup the private network on the physical interface. Hiding the SSID seems to have no affect on functionality.

Example settings for Wireless Basic Setup tab:

06/20
Wireless Mode: AP
Wireless Network Mode: Mixed
Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption
Wireless Channel: 11
Wireless SSID Broadcast: Enable
Network Configuration: Unbridged
IP Address: 192.168.10.1
Subnet Mask: 255.255.255.0

Virtual Interface
Wireless Network Name: wrt54gl_wpa2
Wireless SSID Broadcast: Enable
AP Isolation: Enabled
Network Configuration: Bridged
RC1
Wireless Mode: AP
Wireless Network Mode: Mixed
Wireless Network Name: wrt54gl_wpa2
Wireless Channel: 11
Wireless SSID Broadcast: Enable
Network Configuration: Bridged

Virtual Interface
Wireless Network Name: FON_WIFI_HOTSPOT_NoEncryption
Wireless SSID Broadcast: Enable
AP Isolation: Enabled
Network Configuration: Unbridged
IP Address: 192.168.10.1
Subnet Mask: 255.255.255.0

Setting Up Wireless Encryption

Wireless encryption should be left disabled for the FON Hotspot for obvious reasons, and can be changed to whatever you like on the private WLAN, though again for obvious reasons should not be left disabled, otherwise people will just connect to that instead of the FON SSID for free net access.

Example settings for Wireless Security tab:

06/20
Physical Interface wl0
Security Mode: Disabled

Virtual Interface wl0.1
Security Mode: WPA2 Personal Mixed
WPA Algorithms: TKIP+AES
WPA Share Key: XXXXXXXXXXXXX
Key Renewal Interval: 3600
RC1
Physical Interface wl0
Security Mode: WPA2 Personal Mixed
WPA Algorithms: TKIP+AES
WPA Share Key: XXXXXXXXXXXXX
Key Renewal Interval: 3600

Virtual Interface wl0.1
Security Mode: Disabled

Setting Up Chillispot

06/20

You now need to set up Chillispot to enable the hotspot to function correctly. Basically Chillispot takes over the FON SSID and assinged a 192.168.182.X address to anyone connecting to it, then redirects them towards FON's login pages one they try to access any site other than those under the UAM Allowed field.

Much of the information is generic though there's one thing you must change and one where you may need to. If you've not already registered your router with FON the see the informationg at the top of this page. If you have, you only need to know your router's WLAN (Wireless LAN) MAC address, which should be found (among other places) on the Configure Your FON Router page after loging in to Fon.com. You must add this address to the Radius NAS ID field, in UPPERCASE letters, separed in pairs by dashes ( - 's).


Those of you with a router not already registered with FON should put the whole https://www.fon.com/login/gateway/sec/xxx... address (generated from the unique key quide at the top of the page) in the Redirect URL field. This should allow you to register your router with FON when you first connect to it, though note that this HAS NOT YET BEEN TESTED by myself or anyone else that I know of. Registered users can safely use the https://www.fon.com/login/gateway address, but also note that there must be no following slash on either url.


You very likely want to enable the Separate Wifi from the Lan Bridge option, otherwise any devices connected by cable to the router will be sent through the FON Hotspot signin process. Then again, if you're running a Hotspot in a shop you may actually want to provide a row of 4 wired hotspot connections ;o), in which case leave it disabled. YMMV.

DNS IP can either be your regular provider's DNS (see Status tab > DNS1 in web config) or use a DNS address such as one of OpenDNS's ones (see www.opendns.com). The dns2 line in the additional options box is an optional backup DNS address, so should be different from the IP in the DNS IP box.

And finally, you may want to alter URLs in the UAM Allowed field or uamallowed list/s (both do the same thing, they're just separated for ease of reading / editing). Any URL in here will be accessible by FON SSID clients before logging in. A few such as www.fon.com, www.paypal.com, www.paypalobjects.com, www.skype.com and www.google.com should be left there to allow the Hotspot to function as intended (no paypal = no passes sold). Note that addresses in any uamallowed line or the UAM Allowed box should be separated by commas, no spaces, no http://.


Example settings for Services > Hotspot tab:

Sputnik: Disable
Wifidog: Disable

Chillispot: Enable
Seperate Wifi from LAN Bridge: Enable
Primary Radius Server: radius01.fon.com
Backup Radius Server: radius02.fon.com
DNS IP: 208.67.222.222
Remote Network: 192.168.182.0/24
Redirect URL: https://www.fon.com/login/gateway
Shared Key: garrafon
DHCP Interface: WLAN
Radius NAS ID: XX-XX-XX-XX-XX-XX
UAM Secret: garrafon
UAM Any DNS: 1
UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com
MACauth: Disable
Additional Chillispot Options: (copy and paste the following 6 lines into box)

uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com
uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp
uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161
uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp
dns2 208.67.220.220


HTTP Redirect: Disable
NoCatSplash: Disable
SMTP Redirect: Disable


RC1

As RC1 will not let you enable chillispot for the physical interface, you cannot use the web gui to set it up. Luckily it's just as easy to set up without it.

Note: JFFS support must be enabled to use the following. Otherwise you can change /jffs to /tmp and save as startup instead of running.

Browse to Administration > Commands and copy and paste the following in to the commands box, then hit Run Commands.

You'll notice that the info is much the same as above, so you can change DNS server addresses if needed, add your router key to the uamserver address, and add your own websites to a uamallowed line to allow free access.

#!/bin/sh

##

echo -n '
dhcpif wl0.1
radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
macauth
radiussecret garrafon
uamserver https://www.fon.com/login/gateway
uamsecret garrafon
uamallowed  www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com
uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com
uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp
uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161
uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp
dns2 208.67.220.220
uamanydns
net 192.168.182.0/24
dynip 192.168.182.0/24
dns1 208.67.220.220
dns2 208.67.222.222
' > /jffs/chilli.conf

echo -n "radiusnasid `nvram get wl0_hwaddr|sed -e s/:/-/g`" >>/jffs/chilli.conf

You should the copy and paste the following in to the commands box, and click Save Startup.

#!/bin/sh

##

# Execute chillispot.

/usr/sbin/chilli --conf /jffs/chilli.conf

To start chillispot immediately without a reboot, you can copy and paste the code in to the commands box again and click Run Commands.

Creating A Firewall

There's one last, optional, but HIGHLY recommmended thing you should do before advertising the Hotspot. As it stands, anyone connected to the FON SSID will have full access to the whole 192.168.X.X network including your router's web admin page. To stop this you need to add the below code to the firewall. Do this by pasting the into the box on the Admin > Commands page and hitting Save Firewall.

The main lines controlling which addresses are avilable are the "iptables -t nat -I PREROUTING -i tun0 -d xxx.xxx.xxx.xxx/xx -j DROP" lines. The first (with nvram get lines) automatically gets your router's local address and blocks access to that and all it's clients. The others can be removed if you so wish, but as they stand will block access to all privately used IP addresses. You must keep the ...192.168.182.1/32 -j ACCEPT rule in to allow the hotspot clients to access the Chillispot server.


PPPOE users should add the MTU bugfix line below the first two "##"'s. See the Setting Up Your Router's Internet Connection section for more info.


The script will also limit the speed of any uploads or download on the FON SSID. These can be altered by changing the numbers after DOWNLINK and UPLINK, currently set a 1 Mbps down and 256 Kbps up.

Note that any clients connected to the FON SSID will be able to access each others network shares. If you know a solution to this, please update the wiki.

#!/bin/sh

##

iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j logdrop

# secure access to local addresses other than chillispot
iptables -A FORWARD -i tun0 -j DROP;
iptables  -t nat -I PREROUTING -i tun0 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -j DROP
iptables  -t nat -I PREROUTING -i tun0 -d 192.168.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 169.254.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 172.16.0.0/12 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 10.0.0.0/8 -j DROP
iptables  -t nat -I PREROUTING -i tun0 -d 192.168.182.1/32 -j ACCEPT

DEV="tun0"
DOWNLINK="1024"
UPLINK="256"

tc qdisc del dev $DEV root
tc qdisc del dev $DEV ingress
 
# limit download
tc qdisc add dev $DEV root handle 1: htb
tc class add dev $DEV parent 1: classid 1:1 htb rate  ${DOWNLINK}kbit burst 6k
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1
 
# limit upload
tc qdisc add dev $DEV ingress handle ffff:
tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1

If you want to use the hotspot without re-booting the router, you should copy and paste the code in to the commands box again and click Run Commands.


The End

At this point you should now be able to save your settings, reboot the router (NOTE: If you clicked apply after all settings changes, and used the Run Commands button after pasting the chillispot and firewall code, you should not need to reboot) and connect to the encrypted virtual SSID with full, unrestricted access to the net. Connections to the FON SSID will allow unrestricted access to any address in the Chillispot UAM Allowed field and any other address should redirect to the login pages. Users should then be able to login as normal and access all pages.

Hopefully, if all goes as intended, unregistered routers will also now get a page asking them to register their router with fon. You'll probably need to already have an account at fon to register the router to. That's all untested ground though so who knows? ;o)

FON Heartbeat

With JFFS Support

All routers running official FON firmware send a "heartbeat" signal back to fon every few hours once they're connected to the internet, mainly to update the router's online status on maps.fon.com, but also to download updates to the firmware and chillispot configuration. Running an unofficial FON hotspot means you don't need the downloaded updates, but it's still nice to have the router show up as online on the FON maps. To do this, you need to implement the FON Heartbeat in DD-WRT.

The following script was originally created by Freddy - you can read more about it at http://fon.freddy.eu.org/heartbeat/ .

Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Run Commands button.

#!/bin/sh

cd /jffs
wget http://fon.freddy.eu.org/heartbeat/fonkey
wget http://fon.freddy.eu.org/heartbeat/thinclient
chmod 755 /jffs/thinclient
/jffs/thinclient start 2>&1 | logger

Then add the following to Admin > Commands and hit Save Startup to run the script at each boot. Note that you MUST include the chillispot execution code aswell if you want chillispot to run, otherwise you can remove it.

#!/bin/sh

/jffs/thinclient start 2>&1 | logger

# Execute chillispot.
/usr/sbin/chilli --conf /jffs/chilli.conf

Obviously if you want to store the script in /mmc or somewhere else, you'll need to substitute the /jffs in the above code for that folders name. You will also need to modify the thinclient file before running it to replace the /jffs text on lines 6 and 9 with your permanent storage folder. This is exactly what I did with the temporary heartbeat in the main guide, if you ever want / need to download the code from Freddy's site instead of mine.


Without JFFS Support

If you do not have JFFS Support enabled you can still use the heartbeat, just a slightly modified version.

Ensure Cron is enabled on the Admin > Management page. On the Admin > Commands tab, copy and paste the following in to the Commands box and then click the Save Startup button.

#!/bin/sh

# wait until net connection established
sleep 600

# get heartbeat files
cd /tmp
wget http://www.inaudible.co.uk/perm/thinclient
wget http://www.inaudible.co.uk/perm/fonkey
chmod 755 /tmp/thinclient

# start heartbeat script
/tmp/thinclient start 2>&1 | logger

The script will now run at on every boot of the router, so you can either reboot it now or just re-paste the script in to the commands box and click "Run Commands". The script will execute 10 minutes after booting (or running commands) to insure that an internet connection is active (mainly for PPPOE users), and your hotspot should turn active (dark green) on fon maps within a few hours, if not sooner.

Troubleshooting Heartbeat

The main clue to problems with the heartbeat is obviously the router spot on fon maps not going a dark green colour. Here's some things to check:

1. Are you connected to the internet / have you rebooted the router and gone through installing the heartbeat again? Obvious ones, but a simple problem to solve.

2. Has the script downloaded correctly? It's currently hosted on my personal website, so that may have been inaccesible while your router tried downloading files. You can try telneting in to the router and running all the commands from the script following the "sleep" command (and ignoring # comment lines). If you type ls in the /tmp directory you should see both files listed, with thinclient in green text to signify it has been chmod'ed correctly. After hitting enter on the final command there should be a slight pause but nothing more exciting.

2. Has the known_hosts file been downloaded to /tmp/root/.ssh/ ? If not, thinclient could either not connect to the internet, of one of the commands was wrong. Try running just "/tmp/thinclient start" to see if there are any error messages. The most likely thing is that you have either not managed to download fonkey or thinclient to the right place, you have not chmod'ed thinclient correctly or you edited thinclient wrongly.

3. Is your WLAN MAC being selected correctly by thinclient? From your router's ssh or telnet command line, run both "nvram show | grep wl0_hwaddr" and "nvram show | grep il0macaddr". If the first comes back blank, and the second comes back with your WLAN MAC, you need to edit thinclient with vi again to remove the first part of line 26, that's WLMAC="$(/usr/sbin/nvram get wl0_hwaddr)" # original: , and leave just WLMAC="$(nvram get il0macaddr)". Now thinclient should correctly gather your MAC address which may help in showing it as active on fon maps.