LaFonera Software Chilispot

From DD-WRT Wiki

Revision as of 13:27, 19 March 2007 by Pepsimax2k (Talk | contribs)
Jump to: navigation, search

You are here: DD-WRT wiki mainpage / LaFonera / Software / Chilispot

Note: The following guide was written for a WRT54G. Users have reported that it DOES NOT work with a La Fonera, specifically that the Fonera does not yet have the power to run Chilispot & DD-WRT at the same time.

LaFonera Chilispot and second virtual SSID

SCENARIO:

When version 24 of DD-WRT was released in beta, one of the first things I wanted to accomplish was to setup FON on 1 SSID and my internal network on another SSID. It took me a while to find the time to work on it but here is how I set it up. I tested this on a WRT54G v4, WRT54GS v1 and a Buffalo WHR-G54S running WPA and WEP for the internal network security. Please note that for some reasons this not seems to work on LaFonera itself.

STEPS:

1. Install the v.24 dd-wrt standard beta version (we are using the 2006-0911 release) of firmware available HERE -- Instructions for installing DD-WRT on the WRT54G or GS are available HERE

2. Logon to the web management interface in DD-WRT. Click the Wireless tab, under the Virtual Interfaces click the Add button.

3. Set the Physical Interface SSID and the set Virtual Interface SSID to FON_HotSpot. Enable AP Isolation and set the Network Configuration to Unbridged. Scroll to the bottom and select Save Settings.

Image:step3.gif

4. The IP Address and Subnet Mask fields should now be present at the bottom of the form. Enter the IP Address of 192.168.181.1 and a subnet mask of 255.255.255.0. Scroll to the bottom and select Save Settings.

Image:step4.gif

5. Click the Wireless Security sub-tab. Change the Security Mode for the Physical Interface to what ever security you want to use for your LAN. (On the FON interface the the Security Mode should remain at disabled.) Scroll to the bottom and select Save Settings.

Image:step5.gif

6. Click the Administration tab and click the Info Site Password Protection check box. Scroll to the bottom and select Save Settings.

Image:step6.gif

7. Click the Hotspot sub-tab. Verify that Chillispot is set to Disable. Scroll to the bottom and select Save Settings.

Image:step7.gif

8. Click the Commands sub-tab. Select the following text and paste it into the Commands window. Scroll to the bottom and select Save Startup.

#!/bin/sh

# The following lines create /tmp/chilli.conf
echo -n '
dhcpif ath0.1
radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
radiussecret garrafon
# adminuser=chillispot # chillispot: unrecognized option `--adminuser=chillispot hochkomma deleted 
# adminpasswd=chillispot
uamserver https://login.fon.com/cp/index.php # login.fon.com = 213.134.45.152 
uamsecret garrafon
uamallowed www.fon.com,acceso.fon.com,www.paypal.com,www.paypalobjects.com
net 192.168.182.0/24
dynip 192.168.182.0/24
' > /tmp/chilli.conf

echo -n radiusnasid `nvram get ath0.1_hwaddr|sed -e radiusnasid -e s/:/-/g`>>/tmp/chilli.conf

## We need to wait 5 seconds (10sec. for LaFonera) to make sure we have our WAN DHCP lease and DNS info.
sleep 10

## get the first two entries of DNS- Server out of Setup-->Basic Setup-->Network Address Server Settings (DHCP):
echo `nvram get wan_dns` | sed -e 's/[0-9]/=&/' -e 's/ /%/' -e 's/=/\ndns1 /' -e 's/%/\ndns2 /' >> /tmp/chilli.conf

#
### The following statement adds a statement to cron.d that runs a heartbeat to fon each night at 2am.
#echo '00 02 * * * root /usr/bin/wget "http://download.fon.com/heartbeat.php?mac=`nvram get ath0.1_hwaddr|sed s/:/-/g`" -O #/#tmp/inet.html' > /tmp/cron.d/heartbeat
#
### Runs the heartbeat to fon at startup.
#/usr/bin/wget "http://download.fon.com/heartbeat.php?mac=`nvram get ath0.1_hwaddr|sed s/:/-/g`"
#sleep 15
#

## Execute chillispot
/usr/sbin/chilli --conf /tmp/chilli.conf

9. Again, select the following text and paste it into the Commands window. Scroll to the bottom and select Save Firewall. (You can change the DOWNLINK and UPLINK settings in the text below to whatever bandwidth you want to be available to your FON users. Setting is in kbit/s)

#!/bin/sh

iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j logdrop

iptables -A FORWARD -i tun0 -j DROP;
iptables  -t nat -I PREROUTING -i tun0 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -j DROP

DEV="tun0"
DOWNLINK="768"
UPLINK="64"
 
tc qdisc del dev $DEV root
tc qdisc del dev $DEV ingress
 
# limit download
tc qdisc add dev $DEV root handle 1: htb
tc class add dev $DEV parent 1: classid 1:1 htb rate  ${DOWNLINK}kbit burst 6k
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1
 
# limit upload
tc qdisc add dev $DEV ingress handle ffff:
tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1

10. Click the Management sub-tab and scroll to the bottom and click the Reboot Router button.

11. Now connect to your router via the FON ssid and login to fon.com. Login or create your fon.com account. Once your router is registered your setup should be complete.

Good luck! (Don't forget to go to the Management sub-tab and change your routers password.)

  • Just a note... the drivers on some wireless cards handle the multi SSIDs differently. On some cards when connected to 1 of the SSIDs won't display the other SSID. Just disconnect from the currently connected SSID and you should be able to see both SSIDs.

(The text on this Wiki-page was taken from http://www.geek-pages.com/articles/latest/dd-wrt_-_multiple_ssids_-_1_for_fon_-_1_for_private_network.html)


original fon firmware /etc/chili.conf

radiusserver1 radius01.fon.com
radiusserver2 radius02.fon.com
radiussecret garrafon
dhcpif eth1
uamsecret garrafon
uamanydns
uamallowed www.martinvarsavsky.net,www.google.com,www.flickr.com,static.flickr.com,video.google.com,216.239.51.0/24,66.249.81.0/24
uamallowed www.fon.com,www.paypal.com,www.paypalobjects.com,www.skype.com,66.249.93.0/24,72.14.207.0/24,72.14.209.0/24,84.96.67.0/24,213.91.9.0/24,80.118.99.0/24
uamallowed shop.fon.co.kr,secure.nuguya.com,inilite.inicis.com,fon-en.custhelp.com,maps.fon.com,c20.statcounter.com
uamserver https://login.fon.com/51749e3ba302a6c140f50441bb6df951/cp/index.php

original fon firmware /etc/init.d/N50chillispot

#!/bin/sh
. /tmp/network-config

TMP_C=/tmp/chilli.conf
ETC_C=/etc/chilli.conf
PID_F=/var/run/chilli.pid
PID_LOOP_F=/var/run/chilli_loop.pid
LOG_LOOP_F=/var/log/chilli_loop.log
WANIP="$(ifconfig "$wan_ifname" | grep inet | awk -F'[: ]+' '{print $4}')"
MAC=$(ifconfig wifi0 | head -n1 | awk '{print $5}'|sed s/:/-/g)
MAC=${MAC:-fon}
LOOP=true
DELAY=86400
SECONDS=0
DELAY2=10
SECONDS2=0

RADIUSSERVER=radius01.fon.com
RADIUSSECRET=garrafon
RADIUSADMUSR=chillispot
RADIUSADMPWD=chillispot

quit()
{
		LOOP="false"
		circular_log $LOG_LOOP_F "Signal caught. Exiting..."
}

circular_log() {
		echo "chillispot $(date) $2" >> $1
		tail -24 $1 > $1.tmp
		mv $1.tmp $1
}

do_reload() {
		[ -f $PID_F ] && kill -HUP $(cat $PID_F) >/dev/null 2>&1
}

is_alive() {
		if [ ! -f $PID_F ]; then
				echo "dead"
				return 0
		fi
		TEST_PID=$(cat $PID_F)
		if [ ! -d /proc/$TEST_PID ]; then
				rm $PID_F
				echo "dead"
				return 0
		fi
		CANDIDATE=$(cat /proc/$TEST_PID/status | grep Name: | awk '{ print $2 }')
		if [ "$CANDIDATE" = "chilli" ]; then
				echo "alive"
				return 0
		else
				rm $PID_F
				echo "dead"
				return 0
		fi
}

radconfig() {
	/usr/sbin/chilli_radconfig \
		-c /dev/null \
		--radiusserver1="$RADIUSSERVER" \
		--radiussecret="$RADIUSSECRET" \
		--adminuser="$RADIUSADMUSR" \
		--adminpasswd="$RADIUSADMPWD" \
		--radiusnasid="$MAC" \
		--dhcpif $wifi_ifname \
		> $TMP_C
	[ -n "$(cat $TMP_C)" ] && {
		MD5SUM_TMP=$(md5sum $TMP_C | awk '{ print $1 }')
		MD5SUM_ETC=$(md5sum $ETC_C | awk '{ print $1 }')
		if [ ! "$MD5SUM_TMP" = "$MD5SUM_ETC" ]; then
				rm $ETC_C
				mv $TMP_C $ETC_C
				circular_log $LOG_LOOP_F "RELOAD"
				do_reload
		else
				circular_log $LOG_LOOP_F "NO RELOAD"
		fi
		return 0
	}
	circular_log $LOG_LOOP_F "NO RELOAD"
}

case $1 in
	restart)
		ALIVE=$(is_alive)
		if [ $ALIVE = "alive" ]; then
				exit 0
		fi
		/sbin/insmod tun >/dev/null 2>&1
		ifconfig $wifi_ifname 0.0.0.0 # deconfigure the wifi interface
  		/usr/sbin/chilli \
			--dns1="$WANIP" \
			--dns2="$WANIP" \
			--radiusnasid="$MAC" \
			--dhcpif $wifi_ifname \
			--pidfile=$PID_F
		circular_log $LOG_LOOP_F "RESTART"
		;;

	start)
		ALIVE=$(is_alive)
		if [ $ALIVE = "alive" ]; then
				exit 0
		fi
		radconfig

		/sbin/ifup hotspot
		/etc/init.d/S60redirect stop
		/sbin/insmod tun >/dev/null 2>&1
		ifconfig $wifi_ifname 0.0.0.0 # deconfigure the wifi interface
  		/usr/sbin/chilli \
			--dns1="$WANIP" \
			--dns2="$WANIP" \
			--radiusnasid="$MAC" \
			--dhcpif $wifi_ifname \
			--pidfile=$PID_F
		if [ $? -eq 0 ]; then
				$0 loop &
		fi
		circular_log $LOG_LOOP_F "START"
		;;
	radconfig)
		radconfig
		;;

	stop)
		/sbin/ifdown hotspot
		ALIVE=$(is_alive)
		if [ ! $ALIVE = "alive" ]; then
				echo ERROR: chillispot is not running
				[ -f $PID_LOOP_F ] && kill $(cat $PID_LOOP_F) > /dev/null 2>&1
				rm -f $PID_LOOP_F > /dev/null 2>&1
				exit 0
		fi
		[ -f $PID_F ] && kill $(cat $PID_F) >/dev/null 2>&1
		rm -f $PID_F
		[ -f $PID_LOOP_F ] && kill $(cat $PID_LOOP_F) > /dev/null 2>&1
		rm -f $PID_LOOP_F
		circular_log $LOG_LOOP_F "STOP"
		;;

	loop)
		trap quit SIGINT SIGTERM SIGHUP SIGKILL
		echo $$ > $PID_LOOP_F
		while [ $LOOP = "true" ] ; do
				sleep 1
				SECONDS=$(expr $SECONDS + 1)
				if [ "$SECONDS" = "$DELAY" ]; then
						radconfig
				fi
				SECONDS2=$(expr $SECONDS2 + 1)
				if [ "$SECONDS2" = "$DELAY2" ]; then
						$0 restart
						SECONDS2=0
				fi
		done
		exit 0
		;;
	reload)
		do_reload
		exit 0
		;;
	alive)
		ALIVE=$(is_alive)
		echo "chillispot is $ALIVE"
		if [ $ALIVE = "alive" ]; then
				exit 1
		fi
		exit 0
		;;
	*)
		echo "usage: $0 (start|stop|radconfig|reload)"
		exit 1
esac


original fon firmware /tmp/network-config

wan_ifname=eth0
lan_ifname=ath1
wifi_ifname=ath0
config_ifname=eth0



Tests: I have tested the above guide. Private access point is normally working. At first FON_HOTSPOT did not provide an IP to a connected client. But after I have fixed a typo in above script dhcp server is working.




this page was made by wildblue!