Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I need to setup an access point to only allow users through if they first accept an EULA. To make things slightly simpler, I'm looking into doing this with a unix machine that shares the connection from ethernet to people on wifi. What would be the best way to approach this ?

I was thinking at

  • redirecting all new http connections to the EULA page and once the user clicks ACCEPT, adding ip+mac in a table and filtering everything else
  • Redirecting with dnsmasq (though I have no idea how to make it stop redirecting once the user clicks accept)

Any advices ?

share|improve this question
2  
There are various ways and some ready-made software solutions to implement a captive portal. (Maybe a low-fi way would be to have them sign some paper to get the passphrase.) – sr_ May 16 '12 at 11:06

1 Answer

up vote 1 down vote

I agree with your approach. Until the user MAC address is in the whitelist, every packet coming from him must be discarded, except for HTTP requests. Those must be redirected to your apache IP:port (here is an example). As soon as the user clicks "accept" on your EULA you have to trigger a procedure that whitelists his MAC address adding an exception inside iptables and stops the discard of his packets. I don't say it'll be easy, but at least it's feasible.

share|improve this answer
You almost certainly need to do something with the DNS results. – James Youngman May 16 '12 at 15:08
Yeah, after poking at it for a while, I think I'll PREROUTING everyone to a webserver serving the EULA and when someone clicks "accept", a script adds the mac address to the whitelist and PREROUTING that ip address to ACCEPT. With twists and tweaks like polling the list of ARPs in order to remove clients and so on.. – Jay May 16 '12 at 15:20
Yes, you are right. If you want the user to be automatically redirected to your EULA page, DNS has to be manipulated. Actually, also ARP requests must not be discarded by router. – Avio May 16 '12 at 15:21
1  
Manipulating DNS won't help if the user directly uses IPs, as rare as that might be in reality. – Ulrich Schwarz May 16 '12 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.