FON Hotspot on La Fonera
From DD-WRT Wiki
Revision as of 01:54, 11 September 2010 (edit) Magick777 (Talk | contribs) (→Secure your LAN) ← Previous diff |
Revision as of 01:54, 11 September 2010 (edit) (undo) Magick777 (Talk | contribs) (→Secure your LAN) Next diff → |
||
Line 76: | Line 76: | ||
As a bare minimum, change that line that accepts everything from tun0 going out of br0 to accept anything going out of br0 that '''isn't''' destined for the LAN. The following is sufficient for my situation: | As a bare minimum, change that line that accepts everything from tun0 going out of br0 to accept anything going out of br0 that '''isn't''' destined for the LAN. The following is sufficient for my situation: | ||
- | iptables -I FORWARD -i tun0 -o br0 -j DROP | + | iptables -I FORWARD -i tun0 -o br0 -j DROP |
- | iptables -I FORWARD -i br0 -o tun0 -j ACCEPT | + | iptables -I FORWARD -i br0 -o tun0 -j ACCEPT |
- | iptables -I FORWARD -i tun0 -o br0 -d ! 10.0.0.0/24 -j ACCEPT | + | iptables -I FORWARD -i tun0 -o br0 -d ! 10.0.0.0/24 -j ACCEPT |
and means that ChilliSpot clients can contact anything outside of my network via the WAN gateway (subject to firewalling and QoS on that gateway), but any attempt to contact anything in my LAN stops dead. This assumes that clients are using OpenDNS; if you rely on DNS or Web servers on your LAN then make exceptions accordingly. | and means that ChilliSpot clients can contact anything outside of my network via the WAN gateway (subject to firewalling and QoS on that gateway), but any attempt to contact anything in my LAN stops dead. This assumes that clients are using OpenDNS; if you rely on DNS or Web servers on your LAN then make exceptions accordingly. |
Revision as of 01:54, 11 September 2010
Contents |
Running a FON Hotspot with DD-WRT on La Fonera
The existing FON Hotspot guide apparently doesn't apply to the original La Fonera; this page documents setting a La Fonera up as a FON Hotspot, using the latest DD-WRT firmware as of September 2010. It is presently a work in progress.
Since that guide was written, there have been many updates to the DD-WRT firmware
Assumptions
Configure wireless interfaces
Set up the public FON SSID on the physical interface ath0 and put your private SSID on ath0.1; it needs to be this way around thanks to a 'gotcha' in ChilliSpot - when we tell it to separate WiFi from the LAN bridge, that means it takes the physical interface ath0 out of the LAN bridge br0 every time ChilliSpot starts, so you can't have your private network on ath0 without ChilliSpot breaking it. So, we'll put the public SSID on ath0 and the private SSID on ath0.1; that way we can keep the private network bridged to eth0 and unbridge the public one.
Configure bridged networking
Using Wifi in unbridged mode is not recommended, and using ChilliSpot in bridged mode will not achieve what we want, so the answer is a system of two bridges. Under Setup -> Networking, create a new bridge 'br1' and assign ath0 to it, then assign eth0 and ath0.1 to the existing bridge br0.
This now means that br0 holds our LAN/WLAN interfaces (including the private WLAN), while ChilliSpot can take charge of br1 and use it to provide public WLAN to Foneros.
Configure private WLAN
We don't need a separate subnet for the private WLAN; instead, it should provide bridged access to our existing wired network (which, presumably, already has a DHCP server). So, we already configured the bridging, the only thing remaining is to configure a DHCP forwarder via the GUI (Setup -> Basic Setup). Enter the IP address of your main router / gateway / DHCP server. Strictly speaking, bridged networking should be bridging everything including DHCP, so this setting might be superfluous, but it works for me.
At this point, a client connecting to the private SSID should be treated just as though they were a client on the wired network; the IP address will be obtained from the main WAN router / gateway and clients on this network will get full, bridged access to the LAN. This would be a good time to make sure you've set up wireless security on the private SSID.
Configure ChilliSpot via DD-WRT GUI
With the private WLAN working, we can go about setting up the hotspot. Settings here are shamelessly stolen from the FON Hotspot guide. Note that the Radius NAS ID must be your WLAN Mac address in upper case letters separated by dashes.
Sputnik: Disable Wifidog: Disable Chillispot: Enable Seperate Wifi from LAN Bridge: Enable DHCP Interface: br1 Primary Radius Server: radius01.fon.com Backup Radius Server: radius02.fon.com DNS IP: 208.67.222.222 Remote Network: 192.168.182.0/24 Redirect URL: https://www.fon.com/login/gateway Shared Key: garrafon Radius NAS ID: XX-XX-XX-XX-XX-XX UAM Secret: garrafon UAM Any DNS: 1 UAM Allowed: www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,www.google.com,www.flickr.com MACauth: Disable Additional Chillispot Options: (copy and paste the following 6 lines into box) uamallowed static.flickr.com,video.google.com,shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com uamallowed maps.fon.com,c20.statcounter.com,fon-en.custhelp.com,www.excite.co.jp,image.excite.co.jp,adimp.excite.co.jp uamallowed 216.239.51.0/24,66.249.81.0/24,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24 uamallowed 202.47.16.159,202.47.16.161,202.47.17.159,202.47.17.161,202.47.18.159,202.47.18.161,202.47.19.159,202.47.19.161 uamallowed ssl.google-analytics.com,c26.statcounter.com,www.fonshop.jp dns2 208.67.220.220 HTTP Redirect: Disable NoCatSplash: Disable SMTP Redirect: Disable
Once that's done (and you've verified via SSH that ChilliSpot is started successfully), you should be able to connect to the public SSID and get an IP address in 192.168.182.x. You probably won't be able to ping anything yet, thanks to the stock firewall configuration, but check that both public and private WLANs work as expected and that the client is assigned a correct IP address in both cases.
Configure firewall & test access
By this point, DHCP will be working but DNS and ping will not; the culprit seems to be a couple of rules in the FORWARD chain that drop traffic from br0 and accept only new traffic from tun0. The quick way to preempt these and get everything working (I don't claim that it's secure) is
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -o br0 -i tun0 -j ACCEPT
adding these under Administration -> Commands and clicking Save Firewall to make your changes persistent. Once it works, go back and add a proper firewall so that clients on the public LAN can't contact anything they shouldn't.
Note that you just created a gaping hole in your network security; unsecured wireless clients can now contact anything in your LAN until you lock it down. You have been warned.
Now test your access via the public WLAN; you should now be able to resolve DNS and to ping hosts both on and off your local network. When that works, you have ChilliSpot working correctly and should also be able to test the redirect to the FON login page.
Secure your LAN
As a bare minimum, change that line that accepts everything from tun0 going out of br0 to accept anything going out of br0 that isn't destined for the LAN. The following is sufficient for my situation:
iptables -I FORWARD -i tun0 -o br0 -j DROP iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -d ! 10.0.0.0/24 -j ACCEPT
and means that ChilliSpot clients can contact anything outside of my network via the WAN gateway (subject to firewalling and QoS on that gateway), but any attempt to contact anything in my LAN stops dead. This assumes that clients are using OpenDNS; if you rely on DNS or Web servers on your LAN then make exceptions accordingly.
Another gotcha: Note that because we're using -I to insert rules at the top of the FORWARD chain, we insert each rule on top of the last, so effectively the list of rules above should be read from bottom upwards. The author wondered for an hour or more why he was dropping everything at the start of the FORWARD chain until this dawned upon him.