OpenWRT: Setup NoDogSplash

From OnnoWiki
Revision as of 05:21, 19 July 2015 by Onnowpurbo (talk | contribs)
Jump to navigation Jump to search

Sumber: http://wiki.openwrt.org/doc/howto/wireless.hotspot.nodogsplash



Nodogsplash

Nodogsplash offers a simple way to open a free Hotspot (Wi-Fi) providing restricted access to an Internet connection. The goal was to use a single wireless router to both provide local secure wifi, and share a portion of our bandwidth as a free hotspot, with a splash page to advertise who is providing the hotspot, and the fact that secure, faster access is available for a small contribution towards costs.

This page describes setting up a simple wireless hotspot with the following features: 

   Open access to the hotspot
   Capture (splash) page
   Port restrictions
   Bandwidth Limit
   Separate, secure wireless access for local use

The secure wireless is bridged to the hard-wired ports, the hotspot is separate and isolated from the local network. IMQ is still in Backfire, but not in Attitude Adjustment any more Installation

opkg

opkg update opkg install nodogsplash

Configuration Network

/etc/config/network

config 'interface' 'lan' option 'type' 'bridge' option 'ifname' 'eth0.0' option 'proto' 'static' option 'ipaddr' '10.10.10.1' option 'netmask' '255.255.255.0'

config 'interface' 'wan' option 'ifname' 'eth0.1' option 'proto' 'dhcp'

config 'interface' 'wifi' option 'ifname' 'eth1.0' option 'proto' 'static' option 'ipaddr' '10.10.15.1' option 'netmask' '255.255.255.0'

Wireless

/etc/config/wireless

config 'wifi-device' 'wlan0' option 'type' 'mac80211' option 'channel' '11' option 'disabled' '0'

config 'wifi-iface' option 'device' 'wlan0' option 'network' 'lan' option 'mode' 'ap' option 'ssid' 'mywifi-secure' option 'encryption' 'psk2' option 'hidden' '0' option 'key' 'your%verylong.andsecure-pskkey'

config 'wifi-iface' option 'device' 'wlan0' option 'network' 'wifi' option 'mode' 'ap' option 'ssid' 'public-hotspot' option 'encryption' 'none' option 'hidden' '0'

dhcpd

/etc/config/dhcp

config 'dhcp' 

       	option 'interface'	'lan'
       	option 'start'	'100'
       	option 'limit'	'150'
       	option 'leasetime'	'12h'

config 'dhcp' 

       	option 'interface'	'wan'
       	option 'ignore'	'1'

config 'dhcp' 

       	option 'interface'	'wifi'
       	option 'start'	'100'
       	option 'limit'	'150'
       	option 'leasetime'	'2h'

Firewall

Because nodogsplash uses iptables to mark/handle packets, you have to turn off the build-in firewall:

/etc/init.d/firewall stop /etc/init.d/firewall disable

Nodogsplash

/etc/nodogsplash/nodogsplash.conf

  2. Nodogsplash Configuration File
  1. Parameter: GatewayInterface
  2. Default: NONE
  4. GatewayInterface is not autodetected, has no default, and must be set here.
  5. Set GatewayInterface to the interface on your router
  6. that is to be managed by Nodogsplash.
  7. Typically br0 for the wired and wireless lan on OpenWrt White Russian.
  8. May be br-lan on OpenWrt Kamikaze.

GatewayInterface wlan0

  1. FirewallRuleSet: authenticated-users
  3. Control access for users after authentication.
  4. These rules are inserted at the beginning of the
  5. FORWARD chain of the router's filter table, and
  6. apply to packets that have come in to the router
  7. over the GatewayInterface from MAC addresses that
  8. have authenticated with Nodogsplash, and that are
  9. destined to be routed through the router. The rules are
  10. considered in order, and the first rule that matches
  11. a packet applies to it.
  12. If there are any rules in this ruleset, an authenticated
  13. packet that does not match any rule is rejected.
  14. N.B.: This ruleset is completely independent of
  15. the preauthenticated-users ruleset.

FirewallRuleSet authenticated-users { 

# You may want to open access to a machine on a local
# subnet that is otherwise blocked (for example, to
# serve a redirect page; see RedirectURL). If so,
# allow that explicitly here, e.g:
# FirewallRule allow tcp port 80 to 192.168.254.254

# Your router may have several interfaces, and you
# probably want to keep them private from the GatewayInterface.
# If so, you should block the entire subnets on those interfaces, e.g.:
   #FirewallRule block to 192.168.0.0/16
   #FirewallRule block to 10.0.0.0/8

# Typical ports you will probably want to open up include
# 53 udp and tcp for DNS,
# 80 for http,
# 443 for https,
# 22 for ssh:
   #FirewallRule allow tcp port 53
   #FirewallRule allow udp port 53
   #FirewallRule allow tcp port 80
   #FirewallRule allow tcp port 443
   #FirewallRule allow tcp port 22
   FirewallRule allow all

}

  1. end FirewallRuleSet authenticated-users


  1. FirewallRuleSet: preauthenticated-users
  3. Control access for users before authentication.
  4. These rules are inserted in the PREROUTING chain
  5. of the router's nat table, and in the
  6. FORWARD chain of the router's filter table.
  7. These rules apply to packets that have come in to the
  8. router over the GatewayInterface from MAC addresses that
  9. are not on the BlockedMACList or TrustedMACList,
  10. are *not* authenticated with Nodogsplash. The rules are
  11. considered in order, and the first rule that matches
  12. a packet applies to it. A packet that does not match
  13. any rule here is rejected.
  14. N.B.: This ruleset is completely independent of
  15. the authenticated-users and users-to-router rulesets.

FirewallRuleSet preauthenticated-users { 

# For preauthenticated users to resolve IP addresses in their initial
# request not using the router itself as a DNS server,
# you probably want to allow port 53 udp and tcp for DNS.
   FirewallRule allow tcp port 53
   FirewallRule allow udp port 53
# For splash page content not hosted on the router, you
# will want to allow port 80 tcp to the remote host here.
# Doing so circumvents the usual capture and redirect of
# any port 80 request to this remote host.
# Note that the remote host's numerical IP address must be known
# and used here.
# FirewallRule allow tcp port 80 to 123.321.123.321

}

  1. end FirewallRuleSet preauthenticated-users


  1. FirewallRuleSet: users-to-router
  3. Control access to the router itself from the GatewayInterface.
  4. These rules are inserted at the beginning of the
  5. INPUT chain of the router's filter table, and
  6. apply to packets that have come in to the router
  7. over the GatewayInterface from MAC addresses that
  8. are not on the TrustedMACList, and are destined for
  9. the router itself. The rules are
  10. considered in order, and the first rule that matches
  11. a packet applies to it.
  12. If there are any rules in this ruleset, a
  13. packet that does not match any rule is rejected.

FirewallRuleSet users-to-router { 

# Nodogsplash automatically allows tcp to GatewayPort,
# at GatewayAddress, to serve the splash page.
# However you may want to open up other ports, e.g.
# 53 for DNS and 67 for DHCP if the router itself is
# providing these services.
   FirewallRule allow udp port 53
   FirewallRule allow tcp port 53
   FirewallRule allow udp port 67
# You may want to allow ssh, http, and https to the router
# for administration from the GatewayInterface. If not,
# comment these out.
   FirewallRule allow tcp port 22
   FirewallRule allow tcp port 23
   FirewallRule allow tcp port 80
   FirewallRule allow tcp port 443

}

  1. end FirewallRuleSet users-to-router
  1. EmptyRuleSetPolicy directives
  2. The FirewallRuleSets that NoDogSplash permits are:
  4. authenticated-users
  5. preauthenticated-users
  6. users-to-router
  7. trusted-users
  8. trusted-users-to-router
  10. For each of these, an EmptyRuleSetPolicy can be specified.
  11. An EmptyRuleSet policy applies to a FirewallRuleSet if the
  12. FirewallRuleSet is missing from this configuration file,
  13. or if it exists but contains no FirewallRules.
  15. The possible values of an EmptyRuleSetPolicy are:
  16. allow -- packets are accepted
  17. block -- packets are rejected
  18. passthrough -- packets are passed through to pre-existing firewall rules
  20. Default EmptyRuleSetPolicies are set as follows:
  21. EmptyRuleSetPolicy authenticated-users passthrough
  22. EmptyRuleSetPolicy preauthenticated-users block
  23. EmptyRuleSetPolicy users-to-router block
  24. EmptyRuleSetPolicy trusted-users allow
  25. EmptyRuleSetPolicy trusted-users-to-router allow


  1. Parameter: GatewayName
  2. Default: NoDogSplash
  4. Set GatewayName to the name of your gateway. This value
  5. will be available as variable $gatewayname in the splash page source
  6. and in status output from ndsctl, but otherwise doesn't matter.
  7. If none is supplied, the value "NoDogSplash" is used.
  9. GatewayName NoDogSplash
  1. Parameter: GatewayAddress
  2. Default: Discovered from GatewayInterface
  4. This should be autodetected on an OpenWRT system, but if not:
  5. Set GatewayAddress to the IP address of the router on
  6. the GatewayInterface. This is the address that the Nodogsplash
  7. server listens on.
  9. GatewayAddress 192.168.1.1
  1. Parameter: ExternalInterface
  2. Default: Autodetected from /proc/net/route
  4. This should be autodetected on a OpenWRT system, but if not:
  5. Set ExtrnalInterface to the 'external' interface on your router,
  6. i.e. the one which provides the default route to the internet.
  7. Typically vlan1 for OpenWRT.
  9. ExternalInterface vlan1
  1. Parameter: RedirectURL
  2. Default: none
  4. After authentication, normally a user is redirected
  5. to their initially requested page.
  6. If RedirectURL is set, the user is redirected to this URL instead.
  8. RedirectURL http://www.ilesansfil.org/
  1. Parameter: GatewayPort
  2. Default: 2050
  4. Nodogsplash's own http server uses GatewayAddress as its IP address.
  5. The port it listens to at that IP can be set here; default is 2050.
  7. GatewayPort 2050
  1. Parameter: MaxClients
  2. Default: 20
  4. Set MaxClients to the maximum number of users allowed to
  5. connect at any time. (Does not include users on the TrustedMACList,
  6. who do not authenticate.)
  8. MaxClients 20
  1. ClientIdleTimeout
  2. Parameter: ClientIdleTimeout
  3. Default: 10
  5. Set ClientIdleTimeout to the desired of number of minutes
  6. of inactivity before a user is automatically 'deauthenticated'.
  8. ClientIdleTimeout 10
  1. Parameter: ClientForceTimeout
  2. Default: 360
  4. Set ClientForceTimeout to the desired number of minutes before
  5. a user is automatically 'deauthenticated', whether active or not
  7. ClientForceTimeout 360
  1. Parameter: AuthenticateImmediately
  2. Default: no
  4. Set to yes (or true or 1), to immediately authenticate users
  5. who make a http port 80 request on the GatewayInterface (that is,
  6. do not serve a splash page, just redirect to the user's request,
  7. or to RedirectURL if set).
  9. AuthenticateImmediately no
  1. Parameter: MACMechanism
  2. Default: block
  4. Either block or allow.
  5. If 'block', MAC addresses on BlockedMACList are blocked from
  6. authenticating, and all others are allowed.
  7. If 'allow', MAC addresses on AllowedMACList are allowed to
  8. authenticate, and all other (non-trusted) MAC's are blocked.
  10. MACMechanism block
  1. Parameter: BlockedMACList
  2. Default: none
  4. Comma-separated list of MAC addresses who will be completely blocked
  5. from the GatewayInterface. Ignored if MACMechanism is allow.
  6. N.B.: weak security, since MAC addresses are easy to spoof.
  8. BlockedMACList 00:00:DE:AD:BE:EF,00:00:C0:1D:F0:0D
  1. Parameter: AllowedMACList
  2. Default: none
  4. Comma-separated list of MAC addresses who will not be completely
  5. blocked from the GatewayInterface. Ignored if MACMechanism is block.
  6. N.B.: weak security, since MAC addresses are easy to spoof.
  8. AllowedMACList 00:00:12:34:56:78
  1. Parameter: TrustedMACList
  2. Default: none
  4. Comma-separated list of MAC addresses who are not subject to
  5. authentication, and are not restricted by any FirewallRuleSet.
  6. N.B.: weak security, since MAC addresses are easy to spoof.
  8. TrustedMACList 00:00:CA:FE:BA:BE, 00:00:C0:01:D0:0D


  1. Parameter: PasswordAuthentication
  2. Default: no
  3. Set to yes (or true or 1), to require a password matching
  4. the Password parameter to be supplied when authenticating.
  7. PasswordAuthentication no
  1. Parameter: Password
  2. Default: none
  3. Whitespace delimited string that is compared to user-supplied
  4. password when authenticating.
  7. Password nodog
  1. Parameter: UsernameAuthentication
  2. Default: no
  3. Set to yes (or true or 1), to require a username matching
  4. the Username parameter to be supplied when authenticating.
  7. UsernameAuthentication no
  1. Parameter: Username
  2. Default: none
  3. Whitespace delimited string that is compared to user-supplied
  4. username when authenticating.
  7. Username guest
  1. Parameter: PasswordAttempts
  2. Default: 5
  3. Integer number of failed password/username entries before
  4. a user is forced to reauthenticate.
  7. PasswordAttempts 5
  1. Parameter: TrafficControl
  2. Default: no
  4. Set to yes (or true or 1), to enable traffic control in Nodogsplash.
  6. TrafficControl no
  1. Parameter: DownloadLimit
  2. Default: 0
  4. If TrafficControl is enabled, this sets the maximum download
  5. speed to the GatewayInterface, in kilobits per second.
  6. For example if you have an ADSL connection with 768 kbit
  7. download speed, and you want to allow about half of that
  8. bandwidth for the GatewayInterface, set this to 384.
  9. A value of 0 means no download limiting is done.
  11. DownloadLimit 384
  1. Parameter: UploadLimit
  2. Default: 0
  4. If TrafficControl is enabled, this sets the maximum upload
  5. speed from the GatewayInterface, in kilobits per second.
  6. For example if you have an ADSL connection with 128 kbit
  7. upload speed, and you want to allow about half of that
  8. bandwidth for the GatewayInterface, set this to 64.
  9. A value of 0 means no upload limiting is done.
  11. UploadLimit 64
  1. Paramter: GatewayIPRange
  2. Default: 0.0.0.0/0
  4. By setting this parameter, you can specify a range of IP addresses
  5. on the GatewayInterface that will be responded to and managed by
  6. Nodogsplash. Addresses outside this range do not have their packets
  7. touched by Nodogsplash at all.
  8. Defaults to 0.0.0.0/0, that is, all addresses.
  10. GatewayIPRange 0.0.0.0/0

Allow access to email:

FirewallRuleSet authenticated-users { ... FirewallRule allow tcp port 995 FirewallRule allow tcp port 993 FirewallRule allow tcp port 465 FirewallRule allow tcp port 110 FirewallRule allow tcp port 143

Restrict access to the gateway from the hotspot side:

FirewallRuleSet users-to-router { ...

  1. FirewallRule allow tcp port 22
  2. FirewallRule allow tcp port 80
  3. FirewallRule allow tcp port 443

Bandwidth Control

You can restrict bandwidth available to hotspot (adjust according to preference):

trafficControl yes ... DownloadLimit 200 ... UploadLimit 100

In backfire 10.03.1rc5 you need to edit /etc/init.d/nodogsplash and uncomment last lines to make bandwidth control to work 

   # if not using traffic control,
   # you can comment out the following 3 lines:
   do_module_tests "imq" "numdevs=2"
   do_module_tests "ipt_IMQ"
   do_module_tests "sch_htb"

Note: ipt_IMQ = xt_IMQ

You also need to install some extra kernel modules: 

   opkg install iptables-mod-imq
   opkg install kmod-ipt-imq
   opkg install kmod-sched

And some utilities 

   opkg install ip
   opkg install tc

NOTE: In Attitude Adjustment 12.09 there is no iptables-mod-imq package and so the above procedure will fail.

For bandwidth control in Attitude Adjustment 12.09 you can install WonderShaper (which also uses tc as its back-end): 

   opkg install wshaper

WonderShaper's UCI config file is stored in /etc/config/wshaper. A simple configuration for a guest network might look like this:

config wshaper 'settings' option network 'public' option downlink '64' option uplink '512'

Note: The downlink and uplink maximum values will usually need to be reversed from what one might, at first glance, expect. Also note that due to overhead, actual speeds will be slightly lower. Check status

Nodogsplash package provides the ndsctl binary to manage it. Run ndsctl without arguments to see the help.

root@openWrt:~# ndsctl Usage: ndsctl [options] command [arguments]

options: 

 -s <path>         Path to the socket
 -h                Print usage

commands: 

 status            View the status of nodogsplash
 clients           Display machine-readable client list
 stop              Stop the running nodogsplash
 auth ip           Authenticate user with specified ip
 deauth mac|ip     Deauthenticate user with specified mac or ip
 block mac         Block the given MAC address
 unblock mac       Unblock the given MAC address
 allow mac         Allow the given MAC address
 unallow mac       Unallow the given MAC address
 trust mac         Trust the given MAC address
 untrust mac       Untrust the given MAC address
 loglevel n        Set logging level to n
 password pass     Set gateway password
 username name     Set gateway username

Customise splash page

Edit these files to customize the "splash page" / "error page": 

   /etc/nodogsplash/htdocs/splash.html
   /etc/nodogsplash/htdocs/infoskel.html

Note, to include an external *.css file, put it in the images directory, and include as so:

@import url("$imagesdir/stylesheet.css");

Somewhere in splash.html you should include a link for the authentication, e.g:

Click <a href="$authtarget"> HERE</a> to start browsing

Restrict access to domains

If you would want to restrict the access to the IP address 20.20.20.20 you can use this netfilter command (supposing 10.20.30.0/24 is your hotspot network and you redirect clients to your nodogsplash webserver) 

 iptables -t nat -I ndsOUT -p tcp -s 10.20.30.0/24 -d 20.20.20.20 --dport 80 -j DNAT --to 10.20.30.1:2050

Restrict access to multiple domains

Some domains resolve to multiple different ip addresses so you need to ban all of them. 

   Create /root/banned.txt with the domains to ban (do not add domains with www):

   root@openWrt:~# head /root/banned.txt 
   alice.cc
   malware.ru
   sersnkis.com
   superdupertorrent.com
   ultraload.com
   downloadmuch.com

   Create following script /root/ban-domains.sh:

   #!/bin/sh
    
   for domain in `cat /root/banned.txt`; do
   	dig @8.8.8.8 $domain | egrep [0-9] | grep IN| awk {'print $5'} >> /tmp/ips.txt
   	done
    
   for ip in `cat /tmp/ips.txt`; do
   	iptables -t nat -I ndsOUT -p tcp -s 10.20.30.0/24 -d $ip --dport 80 -j DNAT --to 10.20.30.1:80
   	done
    
   rm -fr /tmp/ips.txt

   run

   chmod +x /root/ban-domains.sh"

   install dig package:

   opkg install bind-dig

   add /root/ban-domains.sh to your /etc/rc.local file.

after executing the script you can check if it works ok running "iptables -t nat -L -n" and you should get something like this:

Chain ndsOUT (1 references) target prot opt source destination DNAT tcp -- 10.20.30.0/24 199.58.211.41 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 69.163.39.214 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 78.140.135.6 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 74.117.114.96 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 88.85.73.158 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 216.69.227.108 tcp dpt:80 to:10.20.30.1:80 DNAT tcp -- 10.20.30.0/24 72.8.129.153 tcp dpt:80 to:10.20.30.1:80

External links 

   Original Nodogsplash project homepage
   Current Nodogsplash source repository
   Nodogsplash OpenWrt package

Misc.

If your configuration does NOT use NAT, you need to check "force connection tracking" in the firewall configuration of the zone nodogsplash is handling. Without connection tracking, the NAT tables of will not run and redirecting to the splash page does not work. NoDogSplash on OpenWRT 12.09+ Access Point

The following instructions are touching NoDogSplash configuration on the OpenWRT 12.09 and later firmwares with "router" configured as a switch or Access Point (AP). OpenWrt is not configured as a router here! This is a common setup where users want to add additional AP to extend their home WiFi coverage and do not want to mess with router from their Internet providers. Example setup: 

   Non OpenWRT router for intranet with address 192.168.1.1
   OpenWRT AP with static address 192.168.1.3
   Clients get DHCP subnet range 192.168.1.200-250 by router
   Clients can connect to AP WiFi within secure SSID
   Guest hotspot SSID are getting their own 192.168.15.0/24 subnet and DHCP on isolated segment

Configuration of the AP is as usual except that AP needs to have NAT for the hotspot segment only. To achieve this one needs to add custom iptables rule

iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.1.3

and delete all provided firewall rules fy using OpenWRT web interface.

Detailed configuration for AP only OpenWRT is: 

   Install package nodogsplash
   With web interface Network→WiFi create: additional ESSID named hotstpot and create additional network hotstpot along with existing lan and unused wan.
   Edit Network→Interfaces→HOTSPOT and select Protocol: Static address with IPv4 address 192.168.5.1 and Netmask: 255.255.255.0. Leave gateway, broadcast and DNS servers empty. Add DHCP server for this interface with default settings. This HOTSPOT interface is internally named as wlan0-1 and will be used as NoDogSplash gateway address.
   Edit Network→DHCP and DNS-Forwarder by unchecking Authoritative and add DNS forwardings: 192.168.1.1 to router DNS masquerading and/or external DNS servers from your internet provider.
   Remove all Network→Firewall Zones and add Network→Firewall→Custom Rules by adding iptables rule described above.
   Change /etc/nodogsplash/nodogsplash.conf affected lines to

       GatewayInterface wlan0-1
       ExternalInterface br-lan

FirewallRuleSet authenticated-users can remain unchanged. You can also start iptables SNAT command manually if not rebooted meanwhile. Check the presence of this rule by iptables -t nat -v -n -L. Enable and start NoDogSplash. After above setup everything should work. Trafic shapping due to the lack of IMQ currently does not work on OpenWrt 12.09 (Attitude Adjustment). One possibility is to install qos-scripts and luci-app-qos. Adding additional interface HOTSPOT to QOS configuration cannot separate between WAN and HOTSPOT bandwidth limit. One can choose to limit NoDogSplash and secure WiFi together to certain Upload and Download rate, but not separate! Quick NoDogSplash Setup Example

This is a quick setup for Nodogsplash. It shows a splash page for any web acccess comming from br-lan.

/etc/nodogsplash/nodogsplash.conf

GatewayInterface br-lan

FirewallRuleSet preauthenticated-users { 

FirewallRule allow tcp port 53
FirewallRule allow udp port 53
FirewallRule allow icmp

}

EmptyRuleSetPolicy authenticated-users passthrough EmptyRuleSetPolicy users-to-router passthrough EmptyRuleSetPolicy trusted-users allow EmptyRuleSetPolicy trusted-users-to-router passthrough

MaxClients 30 ClientIdleTimeout 10 ClientForceTimeout 240

For the actual splash site place these example files as follows:

/etc/nodogsplash/htdocs/splash.html /etc/nodogsplash/htdocs/infoskel.html /etc/nodogsplash/htdocs/images/splash.jpg



Referensi

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=OpenWRT:_Setup_NoDogSplash&oldid=43890"