A Simple Wi-Fi Hotspot Gateway

What is a Wi-Fi Hotspot?

2010-06-15T20:26:00.000-07:00

A Wi-Fi hotspot is usually deployed at business places such as cafeterias, swimming pools, hotel lounges and transport hubs; it is a wireless Internet access service provided by the operator for the purpose of either generating an income or as a free service with the intention to attract customers to the premises.

A typical Wi-Fi Hotspot Scenario

Extending Wireless Network Range

2010-06-14T09:35:00.000-07:00

Extending the wireless hotspot to a big area or spanning multiple floors of the premises can be done quite easily.

Method 1: Wired (recommended)
One can connect up to four access points or wireless routers to the four fast ethernet ports on the SBHG router to help extend the wireless network. For a farther network range, you can consider using the high performance Wireless-N devices which typically reach 150m~300m.

Configuring the access points or routers should be straight-forward. The bottom line is to give it the same SSID (network name) as the SBHG. However, the channel should be different from that of the SBHG to avoid any overlap; for example, set one on channel 1 and the other on channel 11. If there is a dhcp server built-in, it should be disabled so that it will not conflict with the SBHG's dhcp server.

Method 2: Wireless or WDS (not recommended)
Multiple access points which support WDS (Wireless Distribution System) can be connected wirelessly to form a large wireless hotspot. However, as these devices are repeaters functioning like "relay stations", half of the wifi bandwidth is used to "talk" to the relaying stations while the other half is used to broadcast to the client computers. Also, the distribution topology requires careful planning to prevent undesirable loops in the network.

Screenshots - Client

2010-06-14T07:22:00.000-07:00

Default Welcome Screen (Customizable)

Login Successful

Login Denied

User Checks Login Status

How to Install Your Linksys Router

2010-06-13T05:09:00.000-07:00

Who Uses It?

2010-06-13T03:40:00.000-07:00

Sylvia, a university hostelite says: "All utility bills are in my name and my roommate has not paid for cable or Internet services because she claims she rarely uses them. We have been living together for 18 months. Ever since I started using this hotspot gateway, there is proof that she uses quite a substantial amount of the cable. The volume of data transmitted between the Internet and both our computers are recorded. I can show her the portion she used in terms of a percentage of total usage. She now agrees to pay for her share."

Tom of Riverside Cafe says: "I got a bunch of the wifi tickets ready everyday, 12 hours free access...not really a concern. Customers who walk in to my cafe happily receive one ticket each. You know what? Now I do not have to worry about passer-by's who stand outside my cafe and 'steal' the Internet bandwidth. Without the ticket, they just can't use my wi-fi. Before, my wireless network was really an open hell."

Kumar says: "My captive portal page announces 'special offers of the day' everyday. This advertising technique brings me customers who will otherwise walk away and visit the neighboring shops."

One PC, Multiple Concurrent Users

2010-06-09T01:48:00.000-07:00

Here is an easy way to allow a second or more users to use the same computer, concurrently!

With this method, you can have a self-service kiosk and an administrator console running on the same PC but on two different terminals!

Self-service Kiosk

2010-06-08T21:52:00.000-07:00

Nothing is more convenient than a "touch and go" setup in your cafe or business location. What more when this service is reserved for only in-house visitors, they will feel so privileged and happy that they are tempted to stay longer at your premises.

Here is how you can setup a simple self-service kiosk:

Use a low-end pc with a touchscreen monitor or a tablet netbook with at least an Internet browser. This PC can be the same admin PC used for monitoring user sessions.
Hang it on the wall or place it on the countertop.
Connect it to SBHG via the wifi connection and bring up the Internet browser.
Log on to the URL: http://10.0.0.1/cgi-bin/self_svc/self.html.
Press the F11 key to enable full screen view. Hide the keyboard and mouse.

In addition, it will be nice to have a screensaver that runs when the PC is idle. The screensaver doubles as an advertising signage which showcases your merchandises, products or services, and presents a brief note to remind visitors to touch the screen for a free passcode.

Touch Me!

Get Your Code!

Captive Portal Engine

2010-05-18T05:34:00.000-07:00

IPTABLES rule!
It is so simple that you can do it yourself.

First initialize the firewall in a custom file which can be called from /etc/init.d:

# Allow DHCP and DNS requests from any user:

iptables -t nat -A prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -p udp --dport 67 -j ACCEPT

iptables -t nat -A prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -p tcp --dport 67 -j ACCEPT

iptables -t nat -A prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -p udp --dport 53 -j ACCEPT

iptables -t nat -A prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -p tcp --dport 53 -j ACCEPT

# All other traffic goes to the portal page:

iptables -t nat -A prerouting_rule -p tcp -j DNAT --to 10.0.0.1:80

iptables -t nat -A prerouting_rule -p udp -j DNAT --to 10.0.0.1:80

# Create a captive NET where approved users will go and we have full control of how they behave:

iptables -t nat -N NET

iptables -t nat -A PREROUTING -j NET

iptables -t nat -A NET -j ACCEPT

Done!

Now the controlling of NET access.

# Add a user with MAC address of 00:90:4B:B1:5A:75.
iptables -t nat -I prerouting_rule -m mac --mac-source 00:90:4B:B1:5A:75 -j NET

# Remove a user with MAC address of 00:90:4B:B1:5A:75.

iptables -t nat -D prerouting_rule -m mac --mac-source 00:90:4B:B1:5A:75 -j NET

# Add a website (e.g. www.google.com) to walled garden
iptables -t nat -I prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -d "www.google.com" -j ACCEPT

# Remove a website (e.g. www.google.com) from walled garden

iptables -t nat -D prerouting_rule -m state --state NEW,ESTABLISHED,RELATED,INVALID -d "www.google.com" -j ACCEPT

There ya go! That's how it works.

Of course, additional to the IPTABLEs rules, you need to devise a web interface which handles users' logins, registrations and tracks usage. Lighttpd is chosen as the web server because of its ability to re-write visitor's URL and force the visitor to visit the portal page instead.

Order

2010-05-17T21:25:00.000-07:00

Please order at Twinson On-line Store.

User Manual

2010-05-17T21:23:00.000-07:00

Download ==> User Manual (PDF)

Screenshots - Operate

2010-05-17T20:01:00.001-07:00

Check Who's On Line

Generate Code and Print Ticket

....and more tickets

Inspect Logged-out Sessions

Screenshots - Setup

2010-05-17T19:45:00.001-07:00

Change Administrator Passwords, one for Administrator Console, one for Self-service Kiosk

Configure Network

Set Ticket Plans

Customize Welcome Screen

Setup Walled Garden

White List Users

Black List Users

What is SBHG?

2010-05-17T07:43:00.001-07:00

SBHG is a wi-fi hotspot controller with a simple and intuitive web-based management and billing system.

You can control the wi-fi users starting from the time they log in to your network and to the time they log out.

It has a code access system that authenticates users before they can use your Internet service. Codes for authentication are generated by the system. They can be printed in the form of tickets and be sold to the users for a profit, or given to them for free. Why free? Some may ask. Well, that is to attract customers to visit your premises. They use your Internet and stay longer with you and hence spend more money.

You can build a walled garden where only certain websites are available for access by unpaid users. These sites may be your advertising sites to promote your business.

SBHG Features

Secure captive portal. Only registered guests can gain access to the network. Nevertheless, the router isolates the guests and protects your existing computer network.
A flexible codes and tickets mechanism sells Internet access by hours or minutes.
Tickets can be pre-printed in bulk and codes be uploaded to the router. When the quantity of a ticket falls below a preset number, the system sends an alert email to the administrator automatically. Administrator can then print new tickets and upload the codes to the system.
Customizable client login page, or upload your own designer page.
Customizable ticket design, or upload your own design.
Built-in WYSIWYG html editor.
Self-service kiosk feature allows users to obtain codes by themselves.
Easy monitoring of current user sessions. Sessions can be terminated as required.
Traffic volume and time spent by each user are recorded for accounting purposes
User can check on-line usage and the time remaining of his access.
SMTP re-direct service allows clients to send emails through your ISP SMTP server. This function can be enabled or disabled.
Walled garden allows free access to sites providing extra advertising opportunities
Whitelist allows privileged users free access while Blacklist completely blocks rogue users from entering the network.

The Building Blocks

The heart of SBHG is the OpenWRT firmware which overrides the original stock WRT54GL firmware converting it to a wireless hotspot gateway. Firewall rules are created dynamically using IPTABLES developed by netfilter group. Web management codes are written in shell scripts and are for the time being proprietary to SBHG.

Simple and Better

2010-05-17T06:13:00.000-07:00

I call it "SBHG" for "simple and better hotspot gateway". It is truly simple and better because it has all the necessary functions required to manage a wi-fi hotspot. An intuitive web browser interface makes it easy to use. It requires neither a computer nor any server. Everything is self-contained inside a tiny router, the famous Linux based Linksys WRT54GL.