Manual:Hotspot Introduction
Contents
1. Manual Hotspot Introduction Manual Hotspot Introduction Summary HotSpot is a way to authorize users to access some network resources but does not provide traffic encryption To log in users may use almost any web browser either HTTP or HTTPS protocol so they are not required to install additional software The gateway is accounting the uptime and amount of traffic each client have used and also can send this information to a RADIUS server The HotSpot system may limit each particular user s bitrate total amount of traffic uptime and some other parameters mentioned further in this document The HotSpot system is targeted to provide authentication within a local network for the local network users to access the Internet but may as well be used to authorize access from outer networks to access local resources like an authentication gateway for the outside world to access your network It is possible to allow users to access some web pages without authentication using Walled Garden feature Getting an Address First of all a client have to get an IP address It may be set on the client statically or leased from a DHCP server The DHCP server may provide ways of binding lent IP addresses to clients MAC addresses if required The HotSpot system does not care how client get an address before he she gets to the HotSpot login page Moreover HotSpot server may automatically and transparently change any IP address yes meaning rea2. arden rules at HTTP level DNS names HTTP request substrings ip hotspot walled garden ip Walled Garden rules at IP level IP addresses IP protocols ip hotspot user local HotSpot system users Ap hotspot user profile local HotSpot system users profiles user groups ip hotspot active dynamic list of all authenticated HotSpot users ip hotspot cookie dynamic list of all valid HTTP cookies Top Back to Content Article Sources and Contributors Article Sources and Contributors Manual Hotspot Introduction Source http wiki mikrotik com index php oldid 19393 Contributors Marisb Image Sources Licenses and Contributors Image Icon note png Source http wiki mikrotik com index php title File Icon note png License unknown Contributors Marisb Route
3. be allowed to access an internal file server or another restricted area This can be done by setting up Walled Garden system When a not logged in user requests a service allowed in the Walled Garden configuration the HotSpot gateway does not intercept it or in case of HTTP simply redirects the request to the original destination Other requests are redirected to the HotSpot servlet login page infrastructure When a user is logged in there is no effect of this table on him her Walled Garden for HTTP requests is using the embedded proxy server This means that all the configured parameters of that proy server will also be effective for the WalledGarden clients as well as for all clients that have transparent proxy enabled Authentication There are currently 6 different authentication methods You can use one or more of them simultaneously e HTTP PAP simplest method which shows the HotSpot login page and expect to get the authentication info i e username and password in plain text Another use of this method is the possibility of hard coded authentication information in the servlet s login page simply creating the appropriate link Note passwords are not encrypted when transferred over the network e HTTP CHAP standard method which includes CHAP challenge in the login page The E CHAP MDS hash challenge is used together with the user s password for computing the string w which will be sent to the HotSpot gateway The hash resu
4. dless of what PC is used The system will automatically detect and redirect requests to a proxy server that client is using if any it may be set in his her settings to use an unknown proxy server to the proxy server embedded in the router Authorization may be delegated to a RADIUS server which delivers similar configuration options as the local database For any user requiring authorization a RADIUS server gets queried first and if no reply received the local database is examined RADIUS server may send a Change of Authorization request according to standards to alter the previously accepted parameters Advertisement The same proxy used for unauthorized clients to provide Walled Garden facility may also be used for authorized users to show them advertisement popups Transparent proxy for authorized users allows to monitor http requests of the clients and to take some action if required It enables the possibility to open status page even if client is logged in by mac address as well as to show advertisements time after time When the time has come to show an advertisement the server redirects client s web browser to the status page Only requests which provide html content are redirected images and other content will not be affected The status page displays the advertisement and next advertise interval is used to schedule next advertisement If status page is unable to display an advertisement for configured timeout starting from
5. e packet path so that even firewall mangle table which normally sees received packets unaltered can only see the translated address Note arp mode must be enabled on the interface where one to one NAT is used j Before the authentication When enabling HotSpot on an interface the system automatically sets up everything needed to show login page for all clients that are not logged in This is done by adding dynamic destination NAT rules which you can observe on a working HotSpot system These rules are needed to redirect all HTTP and HTTPS requests from unauthorized users to the HotSpot authentication proxy Other rules that are also inserted will be described later in a special section of this manual In most common setup opening any HTTP page will bring up the HotSpot servlet login page which can be customized extensively as described later on As normal user behavior is to open web pages by their DNS names a valid DNS configuration should be set up on the HotSpot gateway itself it is possible to reconfigure the gateway so Manual Hotspot Introduction that it will not require local DNS configuration but such a configuration is impractical and thus not recommended Walled Garden You may wish not to require authorization for some services for example to let clients access the web server of your company without registration or even to require authorization only to a number of services for example for users to
6. in link is T XX XX XX XX XX XXK where XX XX XX XX XX XX is his her MAC address The authentication procedure will not ask RADIUS server permission to authorise such a user HotSpot can authenticate users consulting the local user database or a RADIUS server local database is consulted first then a RADIUS server In case of HTTP cookie authentication via RADIUS server the router will send the same information to the server as it was used when the cookie was first generated If authentication is done locally profile corresponding to that user is used otherwise in case RADIUS reply did not contain the group for that user the default profile is used to set default values for parameters which are not set in RADIUS access accept message For more information on how the interaction with a RADIUS server works see the respective manual section The HTTP PAP method also makes it possible to authenticate by requesting the page login username username amp password password In case you want to log in using telnet connection the exact HTTP request would look like that GET login username username password password HTTP 1 0 Note that the request is case sensitive Authorization After authentication user gets access to the Internet and receives some limitations which are user profile specific HotSpot may also perform a one to one NAT for the client so that a particular user would always receive the same IP address regar
7. irst generated Otherwise the user will be prompted to log in and in the case authentication is successful old cookie will be removed from the local HotSpot active cookie list and the new one with different random ID and expiration time will be added to the list and sent to the web browser It is also possible to erase cookie on user manual logoff not in the default server pages but you can modify them to perform this This method may only be used together with HTTP PAP HTTP CHAP or HTTPS methods as there would be nothing to generate cookies in the first place otherwise Manual Hotspot Introduction e MAC address try to authenticate clients as soon as they appear in the hosts list i e as soon as they have sent any packet to the HotSpot server using client s MAC address as username e Trial users may be allowed to use the service free of charge for some period of time for evaluation and be required to authenticate only after this period is over HotSpot can be configured to allow some amount of time per MAC address to be freely used with some limitations imposed by the provided user profile In case the MAC address still has some trial time unused the login page will contain the link for trial login The time is automatically reset after the configured amount of time so that for example any MAC address may use 30 minutes a day without ever registering The username of such a user as seen in the active user table and in the log
8. lly any IP address of a client to a valid unused address from the selected IP pool If a user is able to get his her Internet connection working at their place he she will be able to get his her connection working in the HotSpot network This feature gives a possibility to provide a network access for example Internet access to mobile clients that are not willing or are disallowed not qualified enough or otherwise unable to change their networking settings The users will not notice the translation i e there will not be any changes in the users config but the router itself will see completely different from what is actually set on each client source IP addresses on packets sent from the clients even the firewall mangle table will see the translated addresses This technique is called one to one NAT but is also known as Universal Client as that is how it was called in the RouterOS version 2 8 One to one NAT accepts any incoming address from a connected network interface and performs a network address translation so that data may be routed through standard IP networks Clients may use any preconfigured addresses If the one to one NAT feature is set to translate a client s address to a public IP address then the client may even run a server or any other service that requires a public IP address This NAT is changing source address of each packet just after it is received by the router it is like source NAT that is performed early in th
9. lt as a password together with username is sent over network to HotSpot service so password is never sent in plain text over IP network On the client side MD5 algorithm is implemented in JavaScript applet so if a browser does not support JavaScript like for example Internet Explorer 2 0 or some PDA browsers or it has JavaScipt disabled it will not be able to authenticate users It is possible to allow unencrypted passwords to be accepted by turning on HTTP PAP authentication method but it is not recommended due to security considerations e HTTPS the same as HTTP PAP but uses SSL protocol to encrypt transmissions HotSpot user just sends his her password without additional hashing note that there is no need to worry about plain text password exposure over the network as the transmission itself is encrypted In either case HTTP POST method if not possible then HTTP GET method is used to send data to the HotSpot gateway e HTTP cookie after each successful login a cookie is sent to the web browser and the same cookie is added to active HTTP cookie list Next time the same user will try to log in web browser will send the saved HTTP cookie This cookie will be compared with the one stored on the HotSpot gateway and only if source MAC address and randomly generated ID matches the ones stored on the gateway user will be automatically logged in using the login information username and password pair was used when the cookie was f
10. moment when it is scheduled to be shown client access is blocked within walled garden just as unauthorized clients are Client is unblocked when the scheduled page is finally shown Note that if popup windows are blocked in the browser the link on the status page may be Manual Hotspot Introduction used to open the advertisement manually While client is blocked FTP and other services are not allowed Thus requiring client to open an advertisement for any Internet activity not especially allowed by the Walled Garden Accounting The HotSpot system implement accounting internally you are not required to do anything special for it to work The accounting information for each user may be sent to a RADIUS server Configuration menus ip hotspot HotSpot servers on particular interfaces one server per interface HotSpot server must be added in this menu in order for HotSpot system to work on an interface ip hotspot profile HotSpot server profiles Settings which affect login procedure for HotSpot clients are configured here More than one HotSpot servers may use the same profile ip hotspot host dynamic list of active network hosts on all HotSpot interfaces Here you can also find IP address bindings of the one to one NAT ip hotspot ip binding rules for binding IP addresses to hosts on hotspot interfaces Ap hotspot service port address translation helpers for the one to one NAT ip hotspot walled garden Walled G
Download Pdf Manuals
Related Search