最近网络营销路由器很火，在智能路由器的烘托下，广告路由器也在如火如荼的展开，不少公司都在向这块进发。

WiFiDog 进程的核心是iptables的规则路由，如若想深入了解其运行步骤需要对iptables有个基础的认识Chain， 三个表五条链。

除了iptables之外，还有一个处理认证前的HTTP请求的web服务器，默认端口为2060。

还有一些线程完成定期汇报，检查状态等。

认证服务器需要自己搭建。

线程：
1）ping 保活协议
2）定时检查客户端是否超时
3）HTTP 请求处理
4）一个不经常用的线程：wifidog 控制线程

本文章由http://www.wifidog.pro/2015/02/05/wifidog%E6%A1%86%E6%9E%B6.html整理编辑，转载请注明出处

利用luci写了个wifidog认证服务，实现直接openwrt路由器本地认证。直接安装ipk安装包，然后修改/etc/wifidog.conf文件(需要先安装wifidog)，如下：

AuthServer {
    Hostname 192.168.1.1
    Path /cgi-bin/luci/wdas/
    MsgScriptPathFragment gw_message/?
}

主要的源码如下：

module("luci.controller.wifidog.wdas", package.seeall)

local session = require "luci.wifidogsession"
local http = luci.http
local translate = luci.i18n.translate
local wdcfg = require("luci.wifidogconfig")

function index()
    local page    = node("wdas")
    page.target   = alias("wdas", "login")
    page.order    = 90
    page.i18n = "wifidogauth"
    page.setuser  = "nobody"
    page.setgroup = "nogroup"

    entry({"wdas", "login"}, call("login"))
    entry({"wdas", "logincheck"}, call("logincheck"))
    entry({"wdas", "auth"}, call("auth"))
    entry({"wdas", "ping"}, call("ping"))
    entry({"wdas", "portal"}, call("portal"))
    entry({"wdas", "gw_message"}, call("gw_message"))
end

function login()
    --login/?gw_id=&gw_address=&gw_port=&mac=&url=
    luci.template.render("wifidog/wdas_login")
end

function logincheck()
    local username, password = wdcfg.auth.username, wdcfg.auth.password
    local user, pwd, id, addr, port, mac, url, token
    user = http.formvalue("user")
    pwd = http.formvalue("pwd")
    id = http.formvalue("gw_id")
    addr = http.formvalue("gw_address")
    port = http.formvalue("gw_port")
    mac = http.formvalue("mac")
    url = http.formvalue("url")
    token = http.getcookie("wdastok")
    http.prepare_content("application/json")
    if addr and port and mac and (user == username) and (pwd == password) then
        token = token and token:match("^[a-f0-9]*$") or luci.sys.uniqueid(16)
        local sdt = {id=id, addr=addr, port=port, mac=mac, url=url, timestamp=luci.sys.uptime()}
        local path = (http.getenv("SCRIPT_NAME") or "") .. "/wdas"
        session.write(token, sdt)
        http.header("Set-Cookie", "wdastok=" .. token .. "; path=" .. path)
        http.write('{url:"http://' .. addr .. ':' .. port ..
            '/wifidog/auth?token=' .. token .. '"}')
    else
        if addr and port and mac then
            http.write('{error: "' .. translate("Invalid username or password.") .. '"}')
        else
            http.write('{error: "' .. translate("Invalid parameter.") .. '"}')
        end
    end
end

function auth()
    --auth/?stage=&ip=&mac=&token=&incoming=&outgoing=
    local stage, ip, mac, token, incoming, outgoing
    stage = http.formvalue("stage")
    ip = http.formvalue("ip")
    mac = http.formvalue("mac")
    token = http.formvalue("token")
    incoming = http.formvalue("incoming")
    outgoing = http.formvalue("outgoing")
    token = token and token:match("^[a-f0-9]*$")
    local sdt = token and session.read(token)
    if token and sdt and (mac == sdt.mac) then
        http.write("Auth: 1")
    else
        http.write("Auth: 0")
    end
end

function ping()
    --ping/?gw_id=&sys_load=&sys_memfree=&sys_load=&wifidog_uptime=
    local id, sys_uptime, sys_memfree, sys_load, wifidog_uptime
    id = http.formvalue("gw_id")
    sys_uptime = http.formvalue("sys_uptime")
    sys_memfree = http.formvalue("sys_memfree")
    sys_load = http.formvalue("sys_load")
    wifidog_uptime = http.formvalue("wifidog_uptime")
    if id and sys_uptime and sys_memfree and sys_load and wifidog_uptime then
        http.write("Pong")
    else
        http.write("{error:2}")
    end
end

function portal()
    --portal/?gw_id=%s
    local token, sdt, url
    token = http.getcookie("wdastok")
    sdt = token and session.read(token)
    url = sdt and sdt.url or "http://www.baidu.com"
    http.redirect(url)
end

function gw_message()
    local msg = http.formvalue("message")
    http.write(msg)
end

源码编译说明：
modules目录下的wifidogauth目录放到./feeds/luci/modules/下。

po/zh_CN/wifidogauth.po文件放到./feeds/luci/po/zh_CN/下。

./feeds/luci/contrib/package/luci/Makefile增加如下语句：

$(eval $(call module,wifidogauth,wifidog auth server,+luci-base))

然后 make menuconfig在luci-->Modules下找到luci-mod-wifidogauth选上。

make package/feeds/luci/luci/compile V=s

认证的用户名、密码的配置文件路径/etc/config/wifidogauth

本文章由 http://www.wifidog.pro/2015/02/05/luci-wifidog.html 整理编辑，转载请注明出处

client采用wifidog，可以在openwrt的menuconfig后network – captive portals下找到
server采用wifidog新推荐的authpuppy

authpuppy的安装配置可参考http://www.authpuppy.org/doc/Getting_Started
除了部分细节，基本可完全按其成功配置

目前遗留问题：

mysql配置好后无法通过安装页面登录，虽然在终端下正常。只能转而采用postgresql。

路由器wifidog启动后，访问web是会跳转到认证登录界面，但选择连接network login成功登录后还是无法访问internet而还是跳转到认证页面。

原因不知是否是因为server在路由的内部网络，或者wifidog的配置问题。
附wifidog配置wifidog.conf

GatewayID default

ExternalInterface pppoe-wan

GatewayInterface br-lan

AuthServer {

Hostname 192.168.1.111

HTTPPort 80

Path /authpuppy/web/

}

HTTPDMaxConn 100

ClientTimeout 10

FirewallRuleSet global {

FirewallRule allow to 123.150.205.139 #S

FirewallRule allow to 125.39.111.239 #S

FirewallRule allow to 42.121.98.148 #S

FirewallRule allow to 74.117.62.156 #S

FirewallRule allow to 74.117.62.157 #S

FirewallRule allow to 8.8.8.8 #S

}

FirewallRuleSet validating-users {

FirewallRule allow to 0.0.0.0/0

}

FirewallRuleSet known-users {

FirewallRule allow to 0.0.0.0/0

}

FirewallRuleSet unknown-users {

FirewallRule allow udp port 53

FirewallRule allow tcp port 53

FirewallRule allow udp port 67

FirewallRule allow tcp port 67

FirewallRule block udp port 8000

}

wifidog.conf字段的含义可参考http://dev.wifidog.org/browser/trunk/wifidog/wifidog.conf

本文章由 http://www.wifidog.pro/2015/02/05/openwrt-wifidog-3.html 整理编辑，转载请注明出处

最近在研究Wifi的Portal认证相关，研究了一下wifidog，整理了一下iptables规则。

本文章由 http://www.wifidog.pro/2015/02/04/wifidog-iptables.html 整理编辑，转载请注明出处