Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| en:dpi:dpi_options:use_cases:wifi_hotspot_session_management:start [2024/08/07 16:33] – elena.krasnobryzh | en:dpi:dpi_options:use_cases:wifi_hotspot_session_management:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | {{indexmenu_n> | ||
| - | ====== Configuring GUI, SSG, and WiFi HotSpot with Session Management Enabled ====== | ||
| - | ===== Network Topology ===== | ||
| - | - Connect the equipment according to the network topology.\\ {{ : | ||
| - | |||
| - | ===== Authorization Sequence ===== | ||
| - | - The subscriber connects to the WiFi network | ||
| - | - A welcome page appears informing the subscriber to open a browser and identify themselves | ||
| - | - The subscriber opens a browser, and upon navigating to any URL, they are redirected to the identification page | ||
| - | - The subscriber enters their phone number and requests an access code | ||
| - | - The access code is sent to the phone number via SMS | ||
| - | - The subscriber enters the received access code | ||
| - | - Session cookies are recorded on the subscriber' | ||
| - | |||
| - | ===== Setting Up Virtual Machines (VM) ===== | ||
| - | - Create two virtual machines with the following minimum specifications: | ||
| - | * VM '' | ||
| - | * VM '' | ||
| - | - Install the latest version of CentOS 7 (build-2009 at the time of writing) on both virtual machines. Choose minimal installation during setup.\\ After OS installation, | ||
| - | - Disable SELinux on both VMs: | ||
| - | * Edit the file ''/ | ||
| - | * Set the parameter '' | ||
| - | |||
| - | ===== Installing and Configuring dpiui_vm ===== | ||
| - | - Install DPIUI on '' | ||
| - | - Configure the network on both VMs and SSG:< | ||
| - | ONBOOT=yes | ||
| - | IPADDR=10.0.0.x | ||
| - | NETMASK=255.255.255.0 | ||
| - | GATEWAY=10.0.0.1 | ||
| - | DNS1=10.0.0.2</ | ||
| - | - Log in to the GUI and add both VMs and SSG in the " | ||
| - | |||
| - | ===== Installing and Configuring cp_wifi_vm ===== | ||
| - | - Install the '' | ||
| - | - Edit the configuration file for Hotspot:< | ||
| - | - **'' | ||
| - | - **'' | ||
| - | - **'' | ||
| - | - **'' | ||
| - | - **'' | ||
| - | |||
| - | If the parameter '' | ||
| - | |||
| - | Finally, run the command:< | ||
| - | |||
| - | ===== Installing and Configuring dhcp-isc on cp_wifi_vm ===== | ||
| - | - Install the '' | ||
| - | - Configure the static ARP scripts and the '' | ||
| - | * First, the '' | ||
| - | authoritative; | ||
| - | db-time-format local; | ||
| - | log-facility local7; | ||
| - | |||
| - | subnet 100.64.0.0 netmask 255.255.252.0 { | ||
| - | range 100.64.0.3 100.64.3.254; | ||
| - | default-lease-time 600; | ||
| - | max-lease-time 600; | ||
| - | option subnet-mask 255.255.252.0; | ||
| - | option broadcast-address 100.64.3.255; | ||
| - | option routers 100.64.0.1; | ||
| - | option ntp-servers < | ||
| - | option domain-name-servers 10.0.0.2; | ||
| - | option domain-name " | ||
| - | |||
| - | on commit { | ||
| - | set ClientIP = binary-to-ascii(10, | ||
| - | set ClientMac = concat ( | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | log(concat(" | ||
| - | |||
| - | | ||
| - | on release { | ||
| - | set ClientIP = binary-to-ascii(10, | ||
| - | set ClientMac = concat ( | ||
| - | suffix (concat (" | ||
| - | substring(hardware, | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | suffix (concat (" | ||
| - | |||
| - | log(concat(" | ||
| - | execute("/ | ||
| - | on expiry { | ||
| - | set ClientIP = binary-to-ascii(10, | ||
| - | log(concat(" | ||
| - | execute("/ | ||
| - | } | ||
| - | subnet 10.0.0.0 netmask 255.255.255.0 { | ||
| - | }</ | ||
| - | |||
| - | touch / | ||
| - | && chown dpiacc: | ||
| - | |||
| - | chmod 755 / | ||
| - | |||
| - | chmod 755 / | ||
| - | |||
| - | set METHOD [lindex $argv 0] | ||
| - | set IP_ADDR [lindex $argv 1] | ||
| - | set MAC_ADDR [lindex $argv 2] | ||
| - | set MAC_ADDR [string toupper $MAC_ADDR] | ||
| - | #Client interface on Mikrotik: | ||
| - | set INT_ClIENT " | ||
| - | set status 0 | ||
| - | |||
| - | |||
| - | #Recording dhcp-lease (start and end) in the Hotspot database | ||
| - | spawn / | ||
| - | |||
| - | |||
| - | expect " | ||
| - | |||
| - | |||
| - | #Connecting to the router | ||
| - | spawn ssh -i / | ||
| - | expect { | ||
| - | " | ||
| - | " | ||
| - | ">" | ||
| - | } | ||
| - | if { $METHOD == " | ||
| - | send "ip arp add address=$IP_ADDR mac-address=$MAC_ADDR interface=$INT_ClIENT\r"; | ||
| - | expect ">"; | ||
| - | |||
| - | |||
| - | send "ip firewall address-list remove \[find address=$IP_ADDR list=DROP_CLIENTS\]\r"; | ||
| - | expect ">"; | ||
| - | send "log info \"ADD: $IP_ADDR -- $MAC_ADDR\" | ||
| - | expect ">" | ||
| - | send " | ||
| - | expect eof | ||
| - | } elseif { $METHOD == " | ||
| - | send "ip arp remove \[find mac-address=$MAC_ADDR\]\r"; | ||
| - | expect ">"; | ||
| - | send "ip firewall address-list add address=$IP_ADDR list=DROP_CLIENTS\r"; | ||
| - | expect ">"; | ||
| - | send "log info \" | ||
| - | expect ">" | ||
| - | send " | ||
| - | expect eof | ||
| - | } elseif { $METHOD == " | ||
| - | send "ip arp remove \[find address=$IP_ADDR\]\r"; | ||
| - | expect ">"; | ||
| - | send "ip firewall address-list add address=$IP_ADDR list=DROP_CLIENTS\r"; | ||
| - | expect ">"; | ||
| - | send "log info \" | ||
| - | expect ">" | ||
| - | send " | ||
| - | expect eof | ||
| - | } elseif {$status == 0} { | ||
| - | send " | ||
| - | |||
| - | expect eof | ||
| - | exit 1; | ||
| - | } | ||
| - | |||
| - | set status 0 | ||
| - | |||
| - | #Connecting to SSG and adding static subscriber record | ||
| - | spawn ssh -i / | ||
| - | |||
| - | expect { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | if {$status == 0} { | ||
| - | send "/ | ||
| - | expect " | ||
| - | send " | ||
| - | expect eof | ||
| - | }</ | ||
| - | METHOD=$1 | ||
| - | IP_ADDR=$2 | ||
| - | MAC_ADDR=$3 | ||
| - | |||
| - | MYSQL_CONNECT_LEASEDB=" | ||
| - | |||
| - | if [ " | ||
| - | echo " | ||
| - | elif | ||
| - | [ " | ||
| - | echo " | ||
| - | |||
| - | elif | ||
| - | [ " | ||
| - | echo " | ||
| - | fi | ||
| - | |||
| - | echo "end mysql"</ | ||
| - | systemctl start dhcpd | ||
| - | firewall-cmd --permanent —add-service=dhcp | ||
| - | firewall-cmd --reload</ | ||
| - | - Create a script for transferring the session file to FTP:< | ||
| - | mkdir / | ||
| - | mkdir / | ||
| - | touch / | ||
| - | |||
| - | FTP_ADDR="< | ||
| - | FTP_USER="< | ||
| - | FTP_PASS="< | ||
| - | |||
| - | #Directory with AAA Hotspot | ||
| - | DIR="/ | ||
| - | |||
| - | ls $DIR | while read f; do | ||
| - | curl --user $FTP_USER: | ||
| - | |||
| - | /$f ftp:// | ||
| - | mv $DIR/$f / | ||
| - | */5 * * * * / | ||
| - | - Create an SSH key pair:< | ||
| - | ssh-keygen -t rsa</ | ||
| - | |||
| - | Leave the passphrase empty.\\ | ||
| - | **Attention! Transfer id.pub to SSG (10.0.0.6) and Mikrotik (100.64.0.1)!** | ||
| - | * SSG (10.0.0.6): transfer the file via SSH to SSG and add it to '' | ||
| - | * Mikrotik (100.64.0.1): | ||
| - | |||
| - | =====Configuring SSG===== | ||
| - | - Configure the DB for users on SSG: <code bash> | ||
| - | udr=1</ | ||
| - | - Set up filtering based on the federal list: <code bash> | ||
| - | federal_black_list=1 | ||
| - | #redirect to page | ||
| - | black_list_redirect=http:// | ||
| - | - Set the default class: <code bash> | ||
| - | - Enable IPFIX export: | ||
| - | * Configure the '' | ||
| - | ONBOOT=yes | ||
| - | IPADDR=< | ||
| - | PREFIX=24</ | ||
| - | netflow_dev=eth1 | ||
| - | netflow_timeout=20 | ||
| - | netflow_full_collector_type=2 | ||
| - | netflow_full_collector=127.0.0.1: | ||
| - | netflow_passive_timeout=10 | ||
| - | netflow_active_timeout=20 | ||
| - | netflow_rate_limit=30 | ||
| - | ipfix_dev=eth1 | ||
| - | |||
| - | ipfix_tcp_collectors=< | ||
| - | ipfix_meta_tcp_collectors=< | ||
| - | ipfix_observation=127 | ||
| - | ipfix_dns_tcp_collectors=< | ||
| - | ipfix_nat_udp_collectors=< | ||
| - | - Minimize traffic in class 7: <code bash> | ||
| - | tbf_inbound_class7=rate 1kbit</ | ||
| - | - Enable redirect to Captive portal: '' | ||
| - | - Disable NAT for private addresses: '' | ||
| - | - Other SSG settings: <code bash> | ||
| - | ctrl_dev=lo | ||
| - | scale_factor=1 | ||
| - | num_threads=2 | ||
| - | class_order=0 | ||
| - | mem_tracking_flow=1500000 | ||
| - | mem_tracking_ip=3000000 | ||
| - | http_parse_reply=1 | ||
| - | rlimit_fsize=32000000000</ | ||
| - | - Replace the content of the script ''/ | ||
| - | fdpi_ctrl load --service 5 --profile.name=' | ||
| - | fdpi_ctrl load --service 11 --profile.name=' | ||
| - | fdpi_ctrl load --policing --profile.name=' | ||
| - | - Add the public key for Hotspot access to SSG in the file ''/ | ||
| - | fdpi_ctrl load --service 5 --profile.name=' | ||
| - | fdpi_ctrl load --service 11 --profile.name=' | ||
| - | fdpi_ctrl load --policing --profile.name=' | ||
| - | - Configure the '' | ||
| - | ONBOOT=yes | ||
| - | IPADDR=10.0.0.6 | ||
| - | PREFIX=24 | ||
| - | DNS1=10.0.0.2</ | ||
| - | |||
| - | =====Configuring DPI and Hotspot via DPIUI===== | ||
| - | Configuring prioritization by protocols. | ||
| - | |||
| - | 1. Go to the DPI Management tab → PROTOCOL PRIORITIZATION (DSCP) → Editor | ||
| - | * cs0 – what we pass through | ||
| - | * cs1 – what we throttle by tariff | ||
| - | * cs7 – what we globally throttle <code bash> | ||
| - | default cs1 | ||
| - | dns cs0 | ||
| - | http cs0 | ||
| - | https cs0</ | ||
| - | 2. CG-NAT on SSG:\\ Go to the Services Management tab → Services → CGNAT\\ Create a profile:\\ Description: | ||
| - | |||
| - | **Hotspot Configuration: | ||
| - | - Go to the Services Management tab → Hotspot\\ Web server: '' | ||
| - | - Enable WiFi and SMS authorization\\ SMS authorization through sms.ru service:\\ Method: '' | ||
| - | - Body (From): <code bash> | ||
| - | to = [PHONE] | ||
| - | msg = Your code for WIFI: [CODE]</ | ||
| - | |||
| - | **Hotspot Tariffs (in the editor):** | ||
| - | - Tariff for authorization:< | ||
| - | htb_inbound_class0=rate 8bit ceil 5mbit burst 8bit cburst 2500kbit | ||
| - | htb_inbound_class1=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class2=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class3=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class4=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class5=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class6=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_inbound_class7=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_root=rate 100kbit ceil 100kbit burst 50kbit cburst 50kbit | ||
| - | htb_class0=rate 8bit ceil 100kbit burst 8bit cburst 50kbit | ||
| - | htb_class1=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class2=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class3=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class4=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class5=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class6=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_class7=rate 8bit ceil 8bit burst 8bit cburst 8bit</ | ||
| - | - Tariff for free WiFi:< | ||
| - | htb_inbound_class0=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class1=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class2=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class3=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class4=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class5=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class6=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_inbound_class7=rate 8bit ceil 8bit burst 8bit cburst 8bit | ||
| - | htb_root=rate 10mbit ceil 10mbit burst 5mbit cburst 5mbit | ||
| - | htb_class0=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class1=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class2=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class3=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class4=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class5=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class6=rate 8bit ceil 10mbit burst 8bit cburst 5mbit | ||
| - | htb_class7=rate 8bit ceil 8bit burst 8bit cburst 8bit</ | ||
| - | |||
| - | 3. Services:\\ | ||
| - | Go to Services Management, enable CGNAT, and select the NAT_WIFI profile. | ||
| - | |||
| - | 4. Allow list:\\ | ||
| - | Go to the Services Management tab → Services → Block lists and Allow lists.\\ | ||
| - | Select the desired profile and create a list: '' | ||
| - | If there is a DNS record for CP, add it as: '' | ||
| - | Save settings through the interface. | ||
| - | |||
| - | Here's the configuration for Mikrotik and Unifi Network: | ||
| - | |||
| - | --- | ||
| - | |||
| - | ### Mikrotik Configuration (100.64.0.1) | ||
| - | |||
| - | - **Configure Client Interface on Mikrotik:** | ||
| - | Upgrade to Router OS 6.48.x | ||
| - | ```bash | ||
| - | /interface vlan | ||
| - | add arp=reply-only arp-timeout=10m interface=sfp1 name=vWifi vlan-id=40 | ||
| - | |||
| - | /ip settings | ||
| - | set icmp-rate-limit=5 rp-filter=strict | ||
| - | |||
| - | /ip address | ||
| - | add address=100.64.0.1/ | ||
| - | |||
| - | /ip dhcp-relay | ||
| - | add dhcp-server=10.0.0.4 disabled=no interface=vWifi local-address=100.64.0.1 name=relay1 | ||
| - | |||
| - | /ip dns | ||
| - | set servers=10.0.0.2 | ||
| - | |||
| - | /ip route | ||
| - | add distance=1 dst-address=10.0.0.4/ | ||
| - | |||
| - | /system clock | ||
| - | set time-zone-name=Europe/ | ||
| - | |||
| - | /system ntp client | ||
| - | set enabled=yes primary-ntp=< | ||
| - | |||
| - | /tool bandwidth-server | ||
| - | set authenticate=no enabled=no | ||
| - | ``` | ||
| - | |||
| - | - **Configure IP Connectivity between DHCP/ | ||
| - | |||
| - | ### Unifi Network Configuration | ||
| - | |||
| - | - **Configure Ubiquiti Access Points:** | ||
| - | * Install Unifi Network on the server. | ||
| - | * Configure DHCP to provide settings to the access points. | ||
| - | * If the access points and controller are in different subnets, specify option 43 in DHCP with the controller IP address in hex format. Refer to: [UniFi Device Adoption Methods](https:// | ||
| - | * **Note:** Switch to the old interface by toggling the switch in System Settings → New USER Interface. | ||
| - | |||
| - | - **Configure Network and Additional Settings:** | ||
| - | * Go to Settings → Network | ||
| - | * Create a new network with VLAN 40, name it `WiFi-Client`, | ||
| - | * Go to Settings → Guest Control | ||
| - | * In Pre-Authorization Access, specify the IP of the Hotspot (10.0.0.4). | ||
| - | * Go to Settings → Wireless Networks | ||
| - | * Create a WiFi network. | ||
| - | * Open ADVANCED OPTIONS. | ||
| - | * Enter any name/SSID. | ||
| - | * Check Enabled. | ||
| - | * Check Open. | ||
| - | * Check Guest Policy. | ||
| - | * Select `WiFi-Client` in Network. | ||
| - | * Check Block LAN to WLAN Multicast and Broadcast Data. | ||
| - | * Check Allow BSS Transition with WNM. | ||
| - | * Check Block Tunneled Link Direct Setup (TDLS) connections. | ||
| - | * Check Isolate stations on layer 2 (ethernet) level. | ||
| - | * Click Save. | ||