OpenWRT使用wifidog实现强制认证的WIFI热点

最新推荐文章于 2023-02-21 10:58:03 发布

clyao_123456

最新推荐文章于 2023-02-21 10:58:03 发布

阅读量2k

点赞数 2

分类专栏： wifidog 文章标签： wifidog openwrt authpuppy

wifidog 专栏收录该内容

0 篇文章 0 订阅

订阅专栏

首先安装wifidog到OpenWRT的路由器：

opkg update

opkg install wifidog

wifidog依赖下面这些模块：

iptables-mod-extra

iptables-mod-ipopt

kmod-ipt-nat

iptables-mod-nat-extra

libpthread

由于trunk的固件更新会比较频繁，会导致直接opkg install wifidog安装不了，如果你凑巧又没有备份与固件对应的Packages的话，就需要到http://downloads.openwrt.org/snapshots/trunk升级固件，然后再安装wifidog。我备份了一个2013年7月份(kernel =3.10.3-1-9da5017d589c0594e545ab00a51eecea)的版本的Packages，需要的话拿去用:

http://openwrt.sinapp.net

如果你的路由器不是openwrt官方支持的版本的话，那就需要自己编译固件。make menuconfig后，在Network–>Captive Portals中选择wifidog.

id="iframe_0.8154030340301319" src="data:text/html;charset=utf8,%3Cimg%20id=%22img%22%20src=%22http://files.sinappel.com/2013/12/wifidog1.png?w=630&h=486&_=4248967%22%20style=%22border:none;max-width:905px%22%3E%3Cscript%3Ewindow.onload%20=%20function%20()%20%7Bvar%20img%20=%20document.getElementById('img');%20window.parent.postMessage(%7BiframeId:'iframe_0.8154030340301319',width:img.width,height:img.height%7D,%20'http://www.cnblogs.com');%7D%3C/script%3E" frameborder="0" scrolling="no" style="margin: 0px; padding: 0px; border-width: initial; border-style: none; width: 630px; height: 486px;">

安装完成后，

/etc/init.d/wifidog enable

/etc/init.d/wifidog start

这时会抛出一个错误，因为我们还没有设置AuthServer的信息。关于安装wifidog更多的信息可以参考：http://wiki.openwrt.org/doc/howto/wireless.hotspot.wifidog

下面安装Auth Server，按照官方的说法：

AuthPuppy is the next generation authentication server for Wifidog networks.

源文档 <http://www.authpuppy.org/>

不过貌似这wifidog和Authpuppy都已经N久没更新了。。。

AuthPutty是需要安装apache2, php5和MySQL。详细介绍在这里：http://www.authpuppy.org/doc/Getting_Started (Windows版点这里)。

安装成功后，访问AuthPuppy会要求设置一些数据库信息，全部设置完成后能看到首页：

id="iframe_0.3607860315275957" src="data:text/html;charset=utf8,%3Cimg%20id=%22img%22%20src=%22http://files.sinappel.com/2013/12/wifidog2.jpg?w=576&h=184&_=4248967%22%20style=%22border:none;max-width:905px%22%3E%3Cscript%3Ewindow.onload%20=%20function%20()%20%7Bvar%20img%20=%20document.getElementById('img');%20window.parent.postMessage(%7BiframeId:'iframe_0.3607860315275957',width:img.width,height:img.height%7D,%20'http://www.cnblogs.com');%7D%3C/script%3E" frameborder="0" scrolling="no" style="margin: 0px; padding: 0px; border-width: initial; border-style: none; width: 576px; height: 184px;">

当然了，我们还需要设置管理员的账号。

进入Manage plugins，Install apAuthLocalUserPlugin，记得要enable这个插件。

id="iframe_0.45902583924921236" src="data:text/html;charset=utf8,%3Cimg%20id=%22img%22%20src=%22http://files.sinappel.com/2013/12/wifidog3.png?w=630&h=412&_=4248967%22%20style=%22border:none;max-width:905px%22%3E%3Cscript%3Ewindow.onload%20=%20function%20()%20%7Bvar%20img%20=%20document.getElementById('img');%20window.parent.postMessage(%7BiframeId:'iframe_0.45902583924921236',width:img.width,height:img.height%7D,%20'http://www.cnblogs.com');%7D%3C/script%3E" frameborder="0" scrolling="no" style="margin: 0px; padding: 0px; border-width: initial; border-style: none; width: 630px; height: 412px;">

然后，点击Manage Nodes，把默认节点的status改成deployed。这个GW(Gateway) ID default后面配置wifidog.conf的时候需要使用。

id="iframe_0.4395669225296521" src="data:text/html;charset=utf8,%3Cimg%20id=%22img%22%20src=%22http://files.sinappel.com/2013/12/wifidog4.png?w=630&h=537&_=4248967%22%20style=%22border:none;max-width:905px%22%3E%3Cscript%3Ewindow.onload%20=%20function%20()%20%7Bvar%20img%20=%20document.getElementById('img');%20window.parent.postMessage(%7BiframeId:'iframe_0.4395669225296521',width:img.width,height:img.height%7D,%20'http://www.cnblogs.com');%7D%3C/script%3E" frameborder="0" scrolling="no" style="margin: 0px; padding: 0px; border-width: initial; border-style: none; width: 630px; height: 537px;">

到这里，AuthPuppy就基本配置完毕了。

下面回到路由器，编辑wifidog.conf，一般情况下，我们之后配置ExternalInterface，GatewayInterface和AuthServer这三项就可以，其他默认。下面是我的配置：

GatewayIDdefault #注意这个ID必须跟AuthPuppy的GW ID一致

# Parameter: ExternalInterface

# Default: NONE

# Optional

# Set this to the external interface (the one going out to the Inernet or your larger LAN).

# Typically vlan1 for OpenWrt, and eth0 or ppp0 otherwise,

# Normally autodetected

ExternalInterface eth0 #路由器外网的物理接口

# Parameter: GatewayInterface

# Default: NONE

# Mandatory

# Set this to the internal interface (typically your wifi interface).

# Typically br-lan for OpenWrt, and eth1, wlan0, ath0, etc. otherwise

GatewayInterface wlan0 #路由器内网的物理接口

AuthServer {

Hostname 192.170.1.104

SSLAvailable no

Path /

CheckInterval 60

ClientTimeout 5

FirewallRuleSet global {

}

FirewallRuleSet validating-users {

FirewallRule allow to 0.0.0.0/0

}

FirewallRuleSet known-users {

FirewallRule allow to 0.0.0.0/0

}

FirewallRuleSet unknown-users {

FirewallRule allow udp port 53

FirewallRule allow tcp port 53

FirewallRule allow udp port 67

FirewallRule allow tcp port 67

}

FirewallRuleSet locked-users {

FirewallRule block to 0.0.0.0/0

}

注意这个Interface是物理接口，而不是下面OpenWRT web界面中看到的interface。注意不是下面这个：

id="iframe_0.5985106708234036" src="data:text/html;charset=utf8,%3Cimg%20id=%22img%22%20src=%22http://files.sinappel.com/2013/12/wifidog5.png?w=573&h=364&_=4248967%22%20style=%22border:none;max-width:905px%22%3E%3Cscript%3Ewindow.onload%20=%20function%20()%20%7Bvar%20img%20=%20document.getElementById('img');%20window.parent.postMessage(%7BiframeId:'iframe_0.5985106708234036',width:img.width,height:img.height%7D,%20'http://www.cnblogs.com');%7D%3C/script%3E" frameborder="0" scrolling="no" style="margin: 0px; padding: 0px; border-width: initial; border-style: none; width: 573px; height: 364px;">

可以看到我的Interface里面没有wlan0之类的选项，/etc/config/network里面也看不到。

root@OpenWrt:~# cat /etc/config/network

config interface ‘loopback’

option ifname ‘lo’

option proto ‘static’

option ipaddr ‘127.0.0.1’

option netmask ‘255.0.0.0’

config globals ‘globals’

option ula_prefix ‘fd09:fd03:490d::/48′

config interface ‘lan’

option proto ‘static’

option ipaddr ‘192.168.1.1’