NON WORKING Hotspot validation. WHY?

Ibersystems · October 6, 2009, 10:05am

Hi all,

################
EDITED
################

RB493+ROS3.30.
PROBLEM: The hotspot login page is not displayed automatically and when I use 192.168.10.1/login to login manually, the users logged don’t have Internet.

I configured the system with PCC, LAN users without validation and hotspot users with validation.

The LAN users (ether9) can use internet without problems and with the PCC (ether2 and 3) working fine.
The Hotspot users (ether8) ONLY can use internet if I make a binding with the IP/MAc of the user. If I try to validate the user with MAC, the user is validated (log show it, YOU CAN SEE THE ATTACHMENT) but no internet. I’m trying this using only 1 PC connected directly to ether8. If I make a IP binding for the same MAC, it has internet without problems. SAME RESULTS validating it with user/password, but the hotspot login is not working automatically, but If I access to 192.168.10.1/login, I can login but no Internet. Why the WEB don’t work automatically? It could be a problem with the NAT? DNS are OK.

/ip address
add address=192.168.0.1/24 broadcast=192.168.0.255 comment="LAN USERS WITHOUT VALIDATION" disabled=no interface=ether9-LAN network=192.168.0.0
add address=192.168.0.2/24 broadcast=192.168.0.255 comment="LAN USERS WITHOUT VALIDATION" disabled=no interface=ether9-LAN network=192.168.0.0
add address=192.168.10.1/24 broadcast=192.168.10.255 comment="hotspot network" disabled=no interface=ether8-WIFI network=192.168.10.0
add address=192.168.4.2/24 broadcast=192.168.4.255 comment="LAN WITH dedicated ADSL" disabled=no interface=ether7-RED4 network=192.168.4.0
add address=192.168.101.2/24 broadcast=192.168.101.255 comment="PCC ROUTER1" disabled=no interface=ether2-router1bal network=192.168.101.0
add address=192.168.102.2/24 broadcast=192.168.102.255 comment="PCC ROUTER2" disabled=no interface=ether3-router2bal network=192.168.102.0
add address=192.168.103.2/24 broadcast=192.168.103.255 comment="DIDICATED ADSL TO LAN 4.x" disabled=no interface=ether4-router3libre network=192.168.103.0

/ip route
add check-gateway=ping comment="PCC ROUTER1 default" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.101.1 scope=30 target-scope=10
add check-gateway=ping comment="PCC ROUTER2 default" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.102.1 scope=30 target-scope=10
add check-gateway=ping comment="PCC ROUTER1" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.101.1 routing-mark=to_router1 scope=30 target-scope=10
add check-gateway=ping comment="PCC ROUTER2" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.102.1 routing-mark=to_router2 scope=30 target-scope=10
add comment="ADSL dedicated router" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.103.1 routing-mark=router3 scope=30 target-scope=10

/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="GATEWAY 192.168.4.0/24 ADSL dedicated" disabled=no out-interface=ether4-router3libre src-address-list=ProfesLibre
add action=masquerade chain=srcnat comment="GATEWAY 192.168.101.0/24 BALANCED" disabled=no out-interface=ether2-router1bal
add action=masquerade chain=srcnat comment="GATEWAY 192.168.102.0/24 BALANCED" disabled=no out-interface=ether3-router2bal
add action=masquerade chain=srcnat comment="masquerade hotspot network" disabled=no src-address=192.168.10.0/24

/ip firewall mangle
add action=mark-routing chain=prerouting comment="LAN 4.x routed to router 3." disabled=yes new-routing-mark=router3 passthrough=no src-address-list=ProfesLibre
add action=mark-connection chain=input comment="INPUTS ROUTER1" disabled=no in-interface=ether2-router1bal new-connection-mark=router1_conn passthrough=yes
add action=mark-connection chain=input comment="INPUTS ROUTER2" disabled=no in-interface=ether3-router2bal new-connection-mark=router2_conn passthrough=yes
add action=mark-connection chain=input comment="INPUTS ROUTER3" disabled=no in-interface=ether4-router3libre new-connection-mark=router3_conn passthrough=yes
add action=mark-routing chain=output comment="router1 to router1" connection-mark=router1_conn disabled=no new-routing-mark=to_router1 passthrough=yes
add action=mark-routing chain=output comment="router2 to router2" connection-mark=router2_conn disabled=no new-routing-mark=to_router2 passthrough=yes
add action=mark-routing chain=output comment="router3 to router3" connection-mark=router3_conn disabled=no new-routing-mark=router3 passthrough=yes
add action=accept chain=prerouting comment="4 rules to send WiFi and LAN to PCC routers" disabled=no dst-address=192.168.101.0/24 in-interface=ether9-LAN
add action=accept chain=prerouting comment="" disabled=no dst-address=192.168.101.0/24 in-interface=ether8-WIFI
add action=accept chain=prerouting comment="" disabled=no dst-address=192.168.102.0/24 in-interface=ether9-LAN
add action=accept chain=prerouting comment="" disabled=no dst-address=192.168.102.0/24 in-interface=ether8-WIFI
add action=mark-connection chain=prerouting comment="LOOP prevention for local packets" disabled=no dst-address-type=!local in-interface=ether9-LAN new-connection-mark=router1_conn passthrough=yes \
    per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=ether9-LAN new-connection-mark=router2_conn passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=ether8-WIFI new-connection-mark=router1_conn passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=ether8-WIFI new-connection-mark=router2_conn passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting comment="Routes to routers 1 and 2 - LAN y WIFI" connection-mark=router1_conn disabled=no in-interface=ether9-LAN new-routing-mark=to_router1 \
    passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=router2_conn disabled=no in-interface=ether9-LAN new-routing-mark=to_router2 passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=router1_conn disabled=no in-interface=ether8-WIFI new-routing-mark=to_router1 passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=router2_conn disabled=no in-interface=ether8-WIFI new-routing-mark=to_router2 passthrough=yes

/ip firewall address-list
add address=192.168.4.0/24 comment="" disabled=no list=ProfesLibre
add address=192.168.10.0/24 comment="" disabled=no list=Alumnes
add address=192.168.0.0/24 comment="" disabled=no list=Alumnes

I CREATED THE HOTSPOT WITH THE WIZARD, and make html reset.

Thanks,

Ibersystems · October 6, 2009, 2:22pm

Hi,

I enabled the DNS Allow remote request and now, when the users are validated they have internet.

Now, the problem is that the login page is not displayed automatically. Anyone can help me whit this?

I NOTICED THAT IF I DISABLE 1 PCC Ethernet, Hotspot Validation works ok. How to fix this?

Thanks,

fewi · October 6, 2009, 7:31pm

I’m currently trying to figure out how to best make PCC and Hotspot work together, but for a quick fix:

add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=ether8-WIFI new-connection-mark=router1_conn passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=ether8-WIFI new-connection-mark=router2_conn passthrough=yes per-connection-classifier=both-addresses:2/1

Add “hotspot=auth” to those two lines to only load balance authenticated Hotspot traffic via PCC. That should get you up and running for now.

Ibersystems · October 6, 2009, 8:11pm

let’s try!

thanks for the reply. I was trying to accept dns traffic in NAT, before the dynamic rules.. and it seams that work too, but I don’t know why.

Ibersystems · October 6, 2009, 8:23pm

Hi,

this seams to work.

Now the users use default “PCC route” until they enter the user/password. Then they use the PCC load balancing.

add action=mark-connection chain=prerouting comment="" disabled=no \
    dst-address-type=!local hotspot=auth in-interface=ether8-WIFI \
    new-connection-mark=router1_conn passthrough=yes \
    per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting comment="" disabled=no \
    dst-address-type=!local hotspot=auth in-interface=ether8-WIFI \
    new-connection-mark=router2_conn passthrough=yes \
    per-connection-classifier=both-addresses:2/1

Fewi, thanks for your time reading the laaaarge code.