Re: [sweetspot-users] Sweetspot Information

[Ilya E. <il...@gl...>]

Daniel,

> Hi Ilya, I am afraid I can not even get my clients to get a dhcp 
> address. I have a centos box with eth0 10.201.0.101/16 as the external 
> device, eth1 is 10.201.0.129/32 (as outlined in your manual) and I

If you choose to use all IPs (inner, outer and clients) from the same
network, make sure your clients won't get the same IP as you assign
to your interfaces.

> followed the instructions on your web pages. I have an internode adsl 
> internet connection going out via eth0 throught a router. I have listed
> all my configurations with notes on the side, I hope you can help me. 
> Thank you for devoting your time on this, it is greatly appreciated.

So far I do not see what makes this setup not working. Could you sniff
some traffic from your client on both eth0 & eth1 interfaces?

For instance, could you run a ping 68.180.206.184 on your client
and then start and leave running the following commands

tcpdump -i eth1 host <your-client-ip>
tcpdump -i eth0 host <your-client-ip>

? Then run

sweetuam UP <your-client-ip>

to enable IP connectivity for this particular client and let me see what 
happens?

Read on:

> 1. Software compiled correctly.
>
> 2. vi /usr/local/etc/sweetspot/sweetspot.conf
> # Sweetspot daemon configuration
>
> # inner interface name (which is close to users)
> inner-interface eth1
>
> # outer interface name (which is close to Internet)
> outer-interface eth0
>
> # user IP CIDR (addresses anyhow assigned to user computers)
>
> #user-networks 127.0.0.0
> user-networks 10.201.0.0/16 (this is the address range I want broadband clients to receive)
>
> # SNAT public networks
>
> #snat-public-networks 192.168.104.0/30 (have no idea if I need this or not)
>
> # authentication server address
> uam-server-address www.moreways2pay.com/LaptopLogin (this is the URL i want all sweetspot wireless users to be directed to)

You have to specify local IP interface here where this daemon would 
listen for controlling commands sent by the sweetuam command line (or 
php or python) tools.

Therefore it may be:

uam-server-address 127.0.0.1

here. Your captive portal site (www.moreways2pay.com/LaptopLogin) should
reside somewhere. If it's going to be on the same server, bind your Apache
to eth0 address.

> # authentication server port
> #uam-server-port 3993
>
> # authentication server shared secret (auth client must have the same)
> uam-secret ht2eb8ej6s4et3rg1ulz
>
> # report UAM errors back to client (obsolete)
>
> #uam-report-errors 1
>
> # Detail file accounting
> acct-detail-file /var/sweetspot/detail
>
> # Interim accounting interval (in secs)
>
> #acct-interim-interval 300
>
> # NAS-IP-Address to report in acct detail file
> #acct-nas-ip-address 127.0.0.1
>
> # Packet filters directory
>
> #filter-dir /usr/local/etc/sweetspot/filters
>
> # Captive filter
> filter-anonymous anonymous
>
>
> 3. vi /usr/local/etc/sweetspot/sweetuam.conf
>
> # Sweetspot UAM client configuration
>
> # authentication server group (comma-separated list)
> uam-server-group 203.38.180.218:3993 (dont know if this is right, 203.38.180.218 is the server for the URL I wrote above , www.moreways2pay.com/LaptopLogin)

This is a way to tell sweetuam client where to send its control commands
to. If you choose to control sweetspot locally, use 127.0.0.1:3993 here.

> # originate client message from this address
> #uam-client-address 0.0.0.0 (what is this?)

This is the address from where sweetuam tool would send its control 
commands to daemon.

> # UAM client receive timeout
> #uam-client-timeout 1
>
> # authentication client shared secret (auth server must have the same)
> uam-secret ht2eb8ej6s4et3rg1ulz
>
>
> 4. vi /usr/local/etc/sweetspot/filters/anonymous
>
> #
> # If this filter is configured as a "filter-anonymous" to Sweetspot
> # daemon, it will be automatically assigned to captured sessions what
> # would cause certain services (HTTP, HTTPS, DNS) to be forced to
> # a Captive Portal authentication page.
> #
> # WARNING: replace 192.168.1.1 with IP address of your DNS and
> #          authentication server (possibly, sweetspot outer interface
> #          address if your DNS and HTTP server live on sweetspot machine)
> #          to make this filter working!
>
>
> # DNS loophole
> pass in proto udp to 192.231.203.132 port eq 53 (my public dns server)
> pass out proto udp from 192.231.203.132 port eq 53
>
>
> # dnat HTTP
> dnat in proto tcp to port eq 80 redir to 10.201.0.129 port 80 (my eth1 ip address)
> dnat out proto tcp from 10.201.0.129 port eq 80
>
> # dnat HTTPS
> dnat in proto tcp to port eq 443 redir to 10.201.0.129 port 443 (my eth1 ip address)
> dnat out proto tcp from 10.201.0.129 port eq 443

This should be the IP address where your authentication page (captive 
portal) lives.. If you choose to put it on the same server and bind your 
Apache to external interface (eth0), you should do DNAT to its IP 
(10.201.0.101).

Please, let me know if it helps.

-ilya

>
> # no connectivity beyond this point
> block in
> block out
>
>
> ________________________________________
> From: Ilya Etingof [il...@gl...]
> Sent: Friday, 26 September 2008 11:08 PM
> To: Daniel Garcia
> Cc: swe...@li...
> Subject: Re: [sweetspot-users] Sweetspot Information
>
> Daniel,
>
> There are some discussions on the Sweetspot issues on the mailing list:
>
> http://sourceforge.net/mailarchive/forum.php?forum_name=sweetspot-users
>
> although it might not cover your issues.
>
> Otherwise, please, let me know what are your problems with this software?
>
> thanks,
> ilya
>
> On Fri, 26 Sep 2008, Daniel Garcia wrote:
>
>> Hi,
>>
>> My name is Daniel and I work for a company that designs and deploys wifi
>> solutions to our clients. We have been using chilli as the software that
>> sends Radius messages to our radius server for our wireless customers to
>> authenticate their accounts. We have an issue where we designed a network
>> topology for a new site in Fiji which went against the MAC address or layer 2
>> based authentication of chilli and in our testing can not access the captive
>> portal that chilli provides.
>>
>> We have had a look at Coovachilli and we came across sweetspot, which seems
>> like would be the ideal software for us to use since its based on layer 3
>> authentication. The problem, however, is that I have run into some issues in
>> regards to setting it up and besides http://sweetspot.sourceforge.net/ there
>> seems to be no other source of help, documentation or forum postings that can
>> guide us through a successful install and trial.
>>
>> It was my hope that you would be able to supply me with a link to other
>> resources or maybe even updated documentation on this software as I would
>> really like to see it work and deployed as a software solution for our needs.
>>
>> Any assistance you could provide would be greatly appreciated.
>>
>> Thanks
>>
>> Daniel Garcia
>> Assistant IT Manager
>> Global Gossip Australia
>>
>