abills.net.ua

Код: Выделить всё

$conf{nas_servers}={'chillispot'=>'Wireless network access server'};

Код: Выделить всё

 elsif ($nas_type eq 'chillispot') {
    radius_disconnect_chillispot($NAS, $PORT, $USER);
 } 

Код: Выделить всё

IPTABLES="/usr/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"

#Flush all rules
$IPTABLES -F 
$IPTABLES -F -t nat
$IPTABLES -F -t mangle

#Set default behaviour
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#Allow releated, established and ssh on $EXTIF. Reject everything else.
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT

#х.з. какой надо открывать, поэтому открываем и tcp и udp 
#хотя наверное используеться только udp, надо будет потестить
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 3799 -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p udp -m udp --dport 3799 -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -j REJECT

#Allow related and established from $INTIF. Drop everything else.
$IPTABLES -A INPUT -i $INTIF -j DROP

#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT

#Allow 3990 on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT


#Allow ICMP echo on other interfaces (input).
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#Allow everything on loopback interface.
$IPTABLES -A INPUT -i lo -j ACCEPT
#$IPTABLES -A INPUT -i tun0 -j ACCEPT
# Drop everything to and from $INTIF (forward)
# This means that access points can only be managed from ChilliSpot
$IPTABLES -A FORWARD -i $INTIF -j DROP
$IPTABLES -A FORWARD -o $INTIF -j DROP

#Enable NAT on output device
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Код: Выделить всё

#данная опция запускае демон в режиме foreground(для отладки), если надо запускать в background, закоментируйте ее нафик
fg
#debug
#interval 3600
#pidfile /var/run/chilli.pid
#statedir ./


# TUN parameters

#net 192.168.182.0/24
#пул адресов выставляеться именно здесь а не в chilli
#ВАЖНО! пул адресов задаеться только в dynip, иначе не будет работать маршрутизация, сам собаку на этом съел :)
dynip 192.168.182.0/24
#statip 192.168.182.0/24

# ДНСы обязательно надо прописывать
# Primary DNS server.
dns1 10.0.1.2
dns2 10.0.1.1
domain yourdomain.com

#ipup /chilli.ipup
#ipdown /etc/chilli.ipdown

# TAG: conup
# Script executed after a user has been authenticated.
#conup /etc/chilli.conup

# TAG: conup
# Script executed after a user has disconnected.
#conup /etc/chilli.condown

# Radius parameters
# TAG: radiuslisten
# IP address to listen to
# Normally you do not need to uncomment this tag.
radiuslisten 192.168.0.235

# TAG: radiusserver1
# IP address of radius server 1
# For most installations you need to modify this tag.
radiusserver1 192.168.0.1

# TAG: radiusserver2
# IP address of radius server 2
# If you have only one radius server you should set radiusserver2 to the
# same value as radiusserver1.
# For most installations you need to modify this tag.
radiusserver2 192.168.0.1

# TAG: radiusauthport
# Radius authentication port
# The UDP port number to use for radius authentication requests.
# The same port number is used for both radiusserver1 and radiusserver2.
# Normally you do not need to uncomment this tag.
radiusauthport 1812

# TAG: radiusacctport
# Radius accounting port
# The UDP port number to use for radius accounting requests.
# The same port number is used for both radiusserver1 and radiusserver2.
# Normally you do not need to uncomment this tag.
radiusacctport 1813

# TAG: radiussecret
# Radius shared secret for both servers
# For all installations you should modify this tag.
radiussecret radsecret

# TAG: radiusnasid
# Radius NAS-Identifier
# Normally you do not need to uncomment this tag.
radiusnasid wifi

# TAG: radiusnasip
# Radius NAS-IP-Address
# Normally you do not need to uncomment this tag.
radiusnasip 192.168.0.235

# TAG: radiuscalled
# Radius Called-Station-ID
# Normally you do not need to uncomment this tag.
#radiuscalled 00133300

# TAG: radiuslocationid
# WISPr Location ID. Should be in the format: isocc=<ISO_Country_Code>,
# cc=<E.164_Country_Code>,ac=<E.164_Area_Code>,network=<ssid/ZONE>
# Normally you do not need to uncomment this tag.
#radiuslocationid isocc=us,cc=1,ac=408,network=ACMEWISP_NewarkAirport

# TAG: radiuslocationname
# WISPr Location Name. Should be in the format: 
# <HOTSPOT_OPERATOR_NAME>,<LOCATION>
# Normally you do not need to uncomment this tag.
#radiuslocationname ACMEWISP,Gate_14_Terminal_C_of_Newark_Airport


# Radius proxy parameters

# TAG: proxylisten
# IP address to listen to
# Normally you do not need to uncomment this tag.
#proxylisten 10.0.0.1

# TAG: proxyport
# UDP port to listen to. 
# If not specified a port will be selected by the system
# Normally you do not need to uncomment this tag.
#proxyport 1645

# TAG: proxyclient
# Client(s) from which we accept radius requests
# Normally you do not need to uncomment this tag.
#proxyclient 10.0.0.1/24

# TAG: proxysecret
# Radius proxy shared secret for all clients
# If not specified defaults to radiussecret
# Normally you do not need to uncomment this tag.
#proxysecret testing123


# Remote configuration management

# TAG: confusername
# If confusername is specified together with confpassword chillispot
# will at regular intervals specified by the interval option query the
# radius server for configuration information.
# Normally you do not need to uncomment this tag.
#confusername conf

# TAG: confpassword
# If confusername is specified together with confpassword chillispot
# will at regular intervals specified by the interval option query the
# radius server for configuration information.
# Normally you do not need to uncomment this tag.
#confpassword secret


# DHCP Parameters

# интерфейс на котором слушает dhcp сервер
dhcpif eth1

# TAG: dhcpmac
# Use specified MAC address.
# An address in the range  00:00:5E:00:02:00 - 00:00:5E:FF:FF:FF falls
# within the IANA range of addresses and is not allocated for other
# purposes.
# Normally you do not need to uncomment this tag.
#dhcpmac 00:00:5E:00:02:00

# TAG: lease
# Time before DHCP lease expires
# Normally you do not need to uncomment this tag.
#lease 600


# Universal access method (UAM) parameters

# TAG: uamserver
# УРЛ по которому юзера будут редиректить на страницу авторизации
uamserver https://192.168.0.235/cgi-bin/hotspotlogin.cgi

# TAG: uamhomepage
# URL of welcome homepage.
# Unauthenticated users will be redirected to this URL. If not specified
# users will be redirected to the uamserver instead.
# Normally you do not need to uncomment this tag.
#uamhomepage http://192.168.182.1/welcome.html

# TAG: uamsecret
# Shared between chilli and authentication web server
# должен біть раскомментирован обязательно
uamsecret ht2eb8ej6s4et3rg1ulp

# TAG: uamlisten
# IP address to listen to for authentication requests
# Do not uncomment this tag unless you are an experienced user!
#uamlisten 10.0.200.1

# TAG: uamport
# TCP port to listen to for authentication requests
# Do not uncomment this tag unless you are an experienced user!
uamport 3990

#куда клиенту разрешено без авторизации
uamallowed 82.207.71.93,10.0.1.2,10.0.1.1,192.168.0.1

#если раскомментировано, неавторизированнім юзерам разрешен доступ к ДНС сервера
#uamanydns


# MAC authentication

# TAG: macauth
# If this flag is given users will be authenticated only on their MAC
# address.
# Normally you do not need to uncomment this tag.
#macauth

# TAG: macallowed
# List of MAC addresses.
# The MAC addresses specified in this list will be authenticated only on
# their MAC address.
#macallowed 00-0A-5E-AC-BE-51,00-30-1B-3C-32-E9

# TAG: macpasswd
# Password to use for MAC authentication.
# Normally you do not need to uncomment this tag.
#macpasswd password

# TAG: macsuffix
# Suffix to add to MAC address in order to form the username.
# Normally you do not need to uncomment this tag.
#macsuffix suffix 

Код: Выделить всё

#!/bin/sh
#
# chilli      This shell script takes care of starting and stopping
#             chilli.
#
# chkconfig: - 65 35
# description: ChilliSpot

# Source function library.
#. /etc/rc.d/init.d/functions

# Source networking configuration.
#. /etc/sysconfig/network

#if [ -f /etc/sysconfig/chilli ]; then
#        . /etc/sysconfig/chilli
#fi

# Check that networking is up.
#[ ${NETWORKING} = "no" ] && exit 0

#[ -f /usr/sbin/chilli ] || exit 0
#[ -f /etc/chilli.conf ] || exit 0

RETVAL=0
prog="chilli"

start() {
	# Start daemons.
	echo -n $"Starting $prog: "

	# Load tun module
	/sbin/modprobe tun >/dev/null 2>&1

	# Enable routing of packets: WARNING!!!
	# Users should enable this explicitly
	# echo 1 > /proc/sys/net/ipv4/ip_forward

	/usr/local/sbin/chilli --coaport 3799 --coanoipcheck
	RETVAL=$?
	echo
	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/chilli
	return $RETVAL
}

stop() {
	# Stop daemons.
	echo -n $"Shutting down $prog: "
	killproc chilli
	RETVAL=$?
	echo
	[ $RETVAL = 0 ] && rm -f /var/lock/subsys/chilli /var/run/chilli.pid
	return $RETVAL
}

# See how we were called.
case "$1" in
  start)
	start
	;;
  stop)
	stop
	;;
  restart|reload)
	stop
	start
	RETVAL=$?
	;;
  condrestart)
	if [ -f /var/lock/subsys/chilli ] ; then
	    stop
	    start
	    RETVAL=$?
	fi
	;;
  status)
	status chilli
	RETVAL=$?
	;;
  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
	exit 1
esac

exit $RETVAL