• Typical Setup
• Dan's Suggested Development Roadmap
• After version 0.8.1...
• Solve double-NAT issue
• Simple Config option
• Ready for Beta users.
• Hotspot
• Disclaimer
• How it works
• What is involved
• Firewall
• Platforms
• OpenWrt package
• Other Linux
• CVS access
• Non-Linux
• Customization and configuration
• 1. Select Zones
• 2. Configure Zone
• 3. Manage ACL
• 4. Configure ports
• Moving capture httpd to non standard port
• Problems
• Internet connection
• Limited set of ports able to be opened for members and public users
• Beta testing comments & questions

-----------
| DHCP    |
| Client  |
| (Laptop)|
|         |
-----------
     |
     |-WiFi - 'melbournewireless.org.au' Adhoc SSID (Behind NAT)
     |-10.10.x.x
     |
------------
| Melb     |
| Wireless |
| Node     |
| running  |
| MWHotspot|
------------
     |
     |-Node Owner's wired LAN (Behind NAT)
     |-192.168.x.x
     |
------------
| Node     |
| Owner's  |
| Internet |
| NAT      |
| Router   |
------------
     |
     |-Broadband ISP connection
     |-To Node Owner's Premesis
     |
\/\/\/\/\/\/
/          \
\ Internet /
/          \
\          /
/\/\/\/\/\/\
     |
     |-Authentication between Hotspot node and wireless.org.au server
     |
-----------
| WoA     |
| Server  |
| running |
| MW User |
| Database|
-----------

• Most Hotspot routers will not be directly connectedto the Internet - they will be on a LAN behind a NAT router. To complete authentication, the WoA server must communicate with the Hotspot router. If the Hotspot router is behind NAT, the WoA server can't reach it. The Node Owner must set up port-forwarding on their Internet Router to allow the the WoA server access. This requirement is undesirable as it detracts from the "plug-and-playability" of the Hotspot router. To make a MW Node as easy as possible to install, it is important be able to "drop-in" the Hotspot onto any Internet-connected LAN without any configuration. We could do this two ways:
• Implement an unencrypted IP tunnel between Hotspot node and WoA Server. CIPE or OpenVPN seem good options but the Linux kernels on the node and WoA server will need support compiled in.
• Set up the Hotspot so it initiates all connections with the WoA server - after the username and password have been sent by the DHCP Client, the Hotspot contacts the WoA server with the Client's MAC address and asks if it has been authenticated.

• When used with the Melbourne Wireless Firmware - at the download stage and also inside the firmware itself, there should be a simple Yes/No question: "Do you want to share your Internet Access with Melbourne Wireless members?".
• If YES:
• OLSR Dynamic Gateway plugin is activated
• If Internet is really available:
• Hotspot prompts DHCP clients with username/password
• If Internet not actually available:
• Hotspot displays Internet Not Available page
• If NO:
• OLSR Dynamic Gateway plugin is deactivated
• Hotspot displays Internet Not Available page
• Node owner can still manually add entries to the Access Control List to allow specified DHCP Clients access to the Internet
• Obviously we would need to include one or two pre-packaged configurations and answering Yes or No activates the appropriate config
• At all times (if Internet is available or not), a Guest Access option should be available - this allows a DHCP client to browse the Melbourne Wireless network. The Hotspot should only enforce this upon local DHCP clients. Routed traffic from other nodes with a 10.10.x.x destination should be allowed to pass without any splash page being displayed to them - this stops people being multi-splashed on multihop paths.

• Use of MW website sign-on to authenticate users, so you do need to have a route to the Intenet.
• Interception of incoming http requests from connected but not-signed-on users
• Modification of web server to return a 301 (redirect) instead of a 404 (Not Found) messages to "capture" a user trying to access a web page that they cannot get to because of the Node firewall.

• Simple init script to set up the firewall
• Some commands for adding and removing users from iptables
• Some web pages and some cgi-scripts
• A modified (tiny) httpd to handle the captured users
• You will need the ip-tables mac module in your Linux distribution. There are two parts of this, 1) the kernel module ipt_mac.o and 2) the iptables loadable module

 ipkg install http://melbournewireless.org.au/files/wrt54/Packages/mwhotspot_0.8.1_mipsel.ipk

ipkg update
ipkg mwhotspot

   $ export CVSROOT=:pserver:anoncvs@wireless.org.au:/var/cvs
   $ cvs checkout mwrp

• /etc/hotspot/hotspot.cfg, configuration env vars used by S45firewall
• /etc/hotspot/hotspot.acl, pre-defined mac addresses and their acess groups
• /etc/hotspot/hotspot.ports, open ports for member and public groups

Melbourne Wireless hotspot

Configuration Menu
------------------
1. Select Zones
2. Configure Zone
3. Manage ACL
4. Configure ports
5. Exit, Save changes
6. Quit Don't save
-------------------

make selection (1-6)

• LAN, the public zone your hotspot will expose
• WAN, the zone of the Internet connection if connected directly
• PRI, your private LAN zone if the node is connected to one
• DMZ, your DMZ segment if you have one ( this is not coded out yet)

 <mac address>        <hostname>   <group>  <access>
 00:03:23:d3:b1:34    myhotspot1    owner    allow
 00:30:45:ea:2d:f7    badguy        public   deny

$IPT -t nat -A PREROUTING -p tcp --destport 80 
     -j DNAT --to ${NETIP}:${HS_LAN_CAPTURE_PORT:-80}

grr- example here breaks wiki page formatting

• Another thing - the scripts are in /bin/hotspot, but the package does not append /bin/hostpot to the $PATH, so the menuconfig script fails unless you modify $PATH manually. I was wondering if they should just be in /bin or /usr/bin to avoid this issue
• With the Select Zones bit - perhaps have preset defaults already set, and display these zones at the top menu. once you have runit the first timethere are default values for each parameter. Perhaps I should include a default/example hotspot.cfg so there are defaults the first time through
• With Configure Zones - everything I select says "XXX zone not configured" - do I need to do something else before configuring zones? Other than that, I like the submenu structure here. You need to select the zones under option 1. first, then you can configure the ones you selected
• What does ACL mean? Access Control List I suppose, but this might be intimidating for some users - perhaps some docs here . Also, when you display this page, show the existing ACL entries - or maybe even on a "status" page that displays all the current settings. once you have configured some then you get walked through the list with a keep/discard choice. May be able to make this clearer
• Can we have a menu option to change the IP address/web address that the user is redirected to? At the moment it wants to go to 10.10.1.65 and it's hard-coded into index.html. The address is in index.html but that should get patched during the install. In the postinstall script as part of ipkg your lan_addr should be set from the nvram variable. I probably need to run this patch each time you run the configuration script