Slashdot Mirror
Providing a Whitelisted Wireless Hotspot?
Ploxis writes "I volunteer some of my day managing a small network (and a ragtag band of computers) for a local nonprofit. I have been asked to set up a second, open, independent wireless network on site that will provide cost-free broadband Internet access to patrons. The catch is that they want to provide access only to a select group of about 25 websites while disallowing everything else. No objectionable sites, no mundane but non-relevant sites such as online banking or YouTube, and no other activities such as P2P or IM. They only want HTTP and HTTPS activity from a set of whitelisted websites." For the rest of Ploxis's question and his intial thoughts on making this happen, read on below.
"They'd also like any non-whitelisted URL to be redirected to a 'splash page,' which would just be some HTML providing a list of allowed sites by category. I'd host this page internally on the network.
Their primary concerns are liability for access of illegal/objectionable materials and conserving their bandwidth, while still providing access to specific relevant tools online.
My initial thought was simply an open wireless router, a set of remarkably restrictive firewall rules, and an in-house server as a custom DNS ... but that's pretty shaky (i.e. anyone specifying their own DNS can still get at whatever they want). I assume they'll need a router with some pretty significant traffic management capabilities as well, but that's not something I've investigated before.
Anyone's experiences, recommendations, case studies, or maps of similar networks would be greatly appreciated."
and turn it into a router and make a domain for those folks?
Configure a linux box as a router, put squid on it, set up your whitelist, and you're all set.
Sounds like something that pfSense might be able to do, between squid and maybe the captive portal.
mod_proxy, mod_rewrite
your friends at apache have most of the work done for you. All you have to do is slap it together and write some custom rules.
Linux as a firewall, to make sure that all http/http traffic gets redirected through the proxy
if the hostname in the url doesn't match what's in your rewrite rules (aka, to pass through) then rewrite it to your custom splash page.
no need for wacky dns tricks here.
Support FSF: Stop thinking with your wallet, and think with your imagination. (cc/non-commercial)
Tell them no and strike a blow for Net Neutrality!
M
One of the requirements is that this is wireless. So he wants to cut out the random interlopers leeching his bandwidth.
Roughly half my comments are never submitted. You may be reading the better half...
If it's only 25 sites (and not going to turn into "hundreds") then why play whack-a-mole? Set the default to Deny, look up those 25 IP addresses, and allow only 80 and 443 to those sites. That gets you 90% of the way there (the remaining 10% being virtualhosts on the same IPs). The rest of the IPs can be rewritten to a local webserver, which either is dedicated to this purpose or uses namebased virtual hosts to have it's own website, then the "default" vhost being the message you're putting up.
Make a simple script to add and remove IPs from the list and reload the rules, write down instructions on "What to do if www.foo.com stops working" or "What to do if you want to add www.baz.com", and you're done.
There are probably dozens of ways to actually implement this. Most of them will involve either custom wireless router firmware, or the wireless router plugged into a "real" router.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Untangle's pro version should allow this. Maybe they have a discount for non-profits?
Oh please. We don't know the context of this guys application, or what his non-profit does and who it applies to. Maybe he has a very valid reason.
Keep honest people honest, and only allow a small subset of sites.
Instead of squid, use tinyproxy. You're not primarily interested in caching, you're interested in access control. Tinyproxy gives you much finer control of that, and it's also ... well ... tiny.
Just set up a "no proxy" rule for the sites you want them to get to, and redirect everything else to a 404 server.
Of the allowed sites.
Use any commercial router and access point, or even a WRT-54G. Drop the list of allowed ips into an access list
Deny traffic for all other ips.
Use separate rules to deny traffic to ports other than 80 and 443
OpenDNS were talking about adding this as a pay-for service, which would be cheaper and easier than setting up a dedicated Linux box, which is the normal proposed solution to any problem posed to Slashdot.
Incidentally, the thread I linked has some other solutions posted in it.
All intents and purposes. Not intensive purposes.
Whatever you do, make sure you whitelist any dependencies these 25 websites use. I'm thinking of things like google-analytics, any kind of javascript library that is third-party hosted (Google Code or YUI) and ad code here. If you whitelist those as well, your patrons browsers might act a little funky depending on your solution.
Wont work. The days of IP's meaning anything are long over. You are best to assume they will change in a week.
These 25 sites could be using round-robin DNS and change their IP every DNS lookup. They could be using some load balancer that plays games with DNS and hops you around the globe depending on their mood. You have no idea how they manage their IP space and you are insane to try :-)
Squid is a much better solution. You can get squid to whitelist by domain.
But seriously, the greater internet nerd contingent needs to get it in their head that the days of IP addresses being useful as any kind of fixed or even temporary identifier are over.
Why in god's name would you statically encode IP addresses when the DNS system is sitting right there to make sure you don't have to do that manual work? Besides, if they're including any reasonably sized site in that list, their DNS entries will resolve to a different IP address depending on the day of the week and the mood of their edge network provider, so it could be any of hundreds of IPs for a single address.
Slashdot needs a "-1, Wrong" moderation option.
The Urban Hippie
Absolutely. Another essential ingredient is electricity. And an internet uplink. Who are you? Captain Obvious?
Setup a transparent proxy and use dansguardian. I've set this up and had it running for several months. It *easily* supports whitelited/blacklisted sites, domains (using regular expressions even), and mime types. It can also block objectionable content based on keyword groups and ratings etc. Very good indeed.
Why in god's name would you statically encode IP addresses when the DNS system is sitting right there to make sure you don't have to do that manual work?
Because that's how firewalls work, in general. Some firewalls will helpfully resolve domain names into IP addresses, but there's no guarantee that the IP addresses that the firewall gets from DNS are the same the client gets, so that is a dead end too.
To do better you need to look into the actual HTTP session. If the poster had a firewall which could do that, he would most likely know, and therefore wouldn't ask the question in the first place.
Finally! A year of moderation! Ready for 2019?
Simplest, quickest way to do it, and does everything you're looking to do.
They put a relatively decent shell interface on top of linux that hides a lot of the complexity, and also have a good GUI management utility (I don't use it myself, but it can do everything the shell can).
It'll run on most hardware, including x86. You'd have to buy a license, $45, but it's worth the time saved figuring out how to get all the different parts tied in together.
And there is an active community forum with helpful people in case you run in to trouble.