I need to setup an access point to only allow users through if they first accept an EULA. To make things slightly simpler, I'm looking into doing this with a unix machine that shares the connection from ethernet to people on wifi. What would be the best way to approach this ?

I was thinking at

  • redirecting all new http connections to the EULA page and once the user clicks ACCEPT, adding ip+mac in a table and filtering everything else
  • Redirecting with dnsmasq (though I have no idea how to make it stop redirecting once the user clicks accept)

Any advices ?


1 Answer 1


I agree with your approach. Until the user MAC address is in the whitelist, every packet coming from him must be discarded, except for HTTP requests. Those must be redirected to your apache IP:port (here is an example). As soon as the user clicks "accept" on your EULA you have to trigger a procedure that whitelists his MAC address adding an exception inside iptables and stops the discard of his packets. I don't say it'll be easy, but at least it's feasible.

  • You almost certainly need to do something with the DNS results. May 16, 2012 at 15:08
  • Yeah, after poking at it for a while, I think I'll PREROUTING everyone to a webserver serving the EULA and when someone clicks "accept", a script adds the mac address to the whitelist and PREROUTING that ip address to ACCEPT. With twists and tweaks like polling the list of ARPs in order to remove clients and so on..
    – Jay
    May 16, 2012 at 15:20
  • Yes, you are right. If you want the user to be automatically redirected to your EULA page, DNS has to be manipulated. Actually, also ARP requests must not be discarded by router.
    – Avio
    May 16, 2012 at 15:21
  • 1
    Manipulating DNS won't help if the user directly uses IPs, as rare as that might be in reality. May 16, 2012 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .