Scott wrote: > Tom Eastep wrote: >> Scott wrote: >>> Rob Ogle wrote: >>>> I'm trying to create a splash page for one of my leaf firewalls. I've >>>> checked the different boards and I know there is nocatsplash and >>>> chillispot, >>>> but everyone says they are buggy and you have to restart it a lot. >>> I'm trying to do (almost) exactly the same thing. I've checked out >>> chillispot >>> but it requires radius which isn't currently part of or planned to be in >>> this >>> network. It seems like this is something shorewall could do nicely. >> I don't see how. Shorewall isn't a daemon; it only runs during >> start/stop/restart operations so Shorewall certainly can't go about adding >> rules dynamically when people do something on a web base. >> >>> I just have to direct first time connections to remote port 80 to a specific >>> website, then "whitelist" their MAC address after that. Is this capability >>> in >>> shorewall at present or is chillispot the only FOSS option out there? I >>> have a >>> FC6 box as my shorewall router and I'd like to keep it as clean as possible. >> Shorewall does not have a "whitelist' capability. You *can* do the following >> though in your /etc/shorewall/rules: > > Even if I wrote a script to add the MAC address to the ipset after they first > connect it won't make a difference. When a windows user starts up their > machine > there's probably 20 remote port 80 connections being made which would negate > the > whole purpose of this.
How so? Once you register the MAC address in the ipset, the NONAT rule will
pass further port 80 connection requests from that MAC regardless of the
destination IP address.
Note that you can accomplish the same goal without ipsets (much less
efficiently) by inserting rules in the front of the nat table 'loc_dnat' chain:
iptables -t nat -I loc_dnat -m mac --mac-source <MAC> -j RETURN
You would probably want to maintain a database of allowed MACs so these
rules could be restored in your /etc/shorewall/start script.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
