search

WebMaestroFr / rpi-roam-webapp

Setup script and web application for a wireless Raspberry Pi bridge.
https://blog.webmaestro.fr/wireless-raspberry-pi-bridge
13 stars 4 forks source link

IP Tables Rules for Captive Portal #4

Open WebMaestroFr opened 7 years ago

WebMaestroFr commented 7 years ago

If the Pi is not connected to WiFi, any HTTP request should redirect to the Flask application (available at raspberrypi.local by default). Ideally, some very simple iptables rules. I tried a few different things but cannot figure it out...

https://github.com/WebMaestroFr/rpi-roam-webapp/blob/master/roam/webapp/modules/configuration/iptables.sh#L21

Lewiscowles1986 commented 7 years ago

I'll try to take a look, but tomorrow most of the day is spent with my nephew

WebMaestroFr commented 7 years ago

Awesome :) No rush, have a good weekend.

Lewiscowles1986 commented 7 years ago

Looks like installing netcat and then following StackOverflow is a winner http://unix.stackexchange.com/questions/6809/how-can-i-check-that-a-remote-computer-is-online-for-ssh-script-acess

WebMaestroFr commented 7 years ago

Thanks for looking into this ;)

The problem is not to detect if the Pi is connected : the first argument – when iptables.sh is called via Python – is 1 for "active" and 0 for "not connected". I'm trying to place under the commented else the correct IPTables rules for this "not connected" situation. I thought it could be possible to simulate a "Captive Portal" if we redirect any URL to the flask application. User would be invited to set a new WiFi instead of facing a "no connection" screen.

Lewiscowles1986 commented 7 years ago

oh... that is more complicated.

You'd technically need a dns server and dhcp server just for the PC to connect (my script provides both so you should have it). You then need to setup local entries for each site to redirect (see pi-hole for something like this) remove or deactivate the dns server or catch all rules once completed.

In any case some bugs you'd encounter is that any site the PC has visited using public key pinning to prevent downgrade attach would display a security warning to the user. Worse still some sites use HSTS and that will also generate the same error as you wouldn't have a valid cert for every domain on the internet.

There is a windows and linux method for announcing devices that might be better, but a simple guide is probably the easiest method and using ethernet to setup. Alas every time I've looked for a decent auto-setup I've found few answers and not had much luck, so I just plump for documentation and a local mDNS vanity url reachable via avahi-daemon.

WebMaestroFr commented 7 years ago

I hoped for something very simple... I guess I will keep the app as it is for now. And eventually come back to it after learning and experimenting for some more time. :) Thank you for pointing out at all of this !

Lewiscowles1986 commented 7 years ago

The amount of time I've spent on being able to take online things offline is stupendous. I'm always interested if you manage to get something worked out, or if anyone else has more robust ways to get things done. Also interested in the project it seems really cool, thanks for highlighting it :wink: