nzamps
commented
7 years ago Interesting, you shouldn't see your download limited at all with xt_coova - it is meant to bypass chilli for authenticated users!
I think one problem is due to your use of a bridge, which incidentally I wouldn't recommend unless you use the 'usetap' option. We use the conup/condown scripts to insert tc and iptables rules to enforce rate limits.
Also, I think the issue is you are not using 2 ip ranges for unauthenticated and authenticated users. With xt_coova you have uamlisten on one range and dynip on the other and xt_coova does a DNAT between the two.
e.g. you could have:
192.168.181.0/24 for unauthenticated 192.168.180.0/24 for authenticated
option uamlisten '192.168.181.1'
option net '192.168.180.0/24'
option dynip '192.168.180.0/24'and your firewall rules should match the auth range only for xt_coova e.g.
iptables -A FORWARD -d 192.168.180.0/24 -i br-if_pub -m coova --name chillipub --dest -j ACCEPT
iptables -A FORWARD -s 192.168.180.0/24 -o br-if_pub -m coova --name chillipub --source -j ACCEPT
iptables -A FORWARD -d 192.168.181.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.181.0/24 -j ACCEPT
Your INPUT rules look like they need some work - you normally have policy DROP and only allow the ports you need e.g. uamport would be:
iptables -A INPUT -d 192.168.181.1/32 -p tcp -m tcp --dport 3990 -j ACCEPTFor more see: http://coova.github.io/mail-archive/chilli/2010-April/001239.html
TBH I'm quite surprised your setup works at all - do users get a splash page ok and can login ? Do you see packet counts when you do:
cat /proc/net/coova/chillipubYou might need to change things around quite a bit to get it to work how it was designed!
Cheers Brian
keulu
gbaligh
irongomme
khmtambi
reinerotto
xewonder
Hi guys,
1 week ago, i noticed that my users connected behind coova are not limitted on upload on my router with openWRT 15.05.1 and coova 1.3.2
this is my device in chilli_query list
CC-25-EF-31-3B-75 192.168.180.2 pass 58ac194800000003 1 2945522 8/31536000 2/900 2010420/0 0/0 0 1 **0%/262144 0%/1048576** http://captive.apple.com/hotspot-detect.html vlan=(null)My limits are set correctly. When i download someting, i see log about leaky bucket for download, and my limit is well apllied. (Leaky bucket dropping download overflow to CC-25-EF-31-3B-75). it's applied because i see 99%/1048576 great !
But... (and that make me crazy) i can't limit my upload.
this are my confs
`
/etc/config/chilli
config chilli 'public' option radiusnasid 'testacopub' option radiuslisten '10.1.210.254' option radiussecret '**' option radiusserver1 '**' option radiusserver2 '**' option radiusauthport '1812' option radiusacctport '1813' option uamserver 'http://testacopub.***.net' option uamhomepage 'http://splash.***.net' option uamsecret '**' option uamlisten '192.168.180.1' option uamport '3990' option uamanydns '1' option uamaliasip '1.0.0.1' option uamaliasname 'login' option uamlogoutip '1.1.1.1' option nouamsuccess '1' option coaport '3799' option coanoipcheck '1' option tundev 'tun11' option net '192.168.180.0/22' option lease '7200' option dhcpif 'br-if_pub' option dns1 '8.8.8.8' option dns2 '8.8.4.4' option domain '**' option kname 'chillipub' option swapoctets '1' option interval '3600' option ipup '/iwibox/coova/ipup.sh' option ipdown '/iwibox/coova/ipdown.sh' option conup '/iwibox/coova/conup.sh' option condown '/iwibox/coova/condown.sh' option locationname '***' option maxclients '1024' option nowispr1 '1' option nowispr2 '1' option noc2c '1' option rfc7710uri 'http://192.168.180.1:3990/prelogin' option dnslog '/var/log/coova_dns_pub.txt' `
`
INPUT and OUPUT POLICY is ACCEPT by default
Chain FORWARD (policy DROP 1444 packets, 134K bytes) target prot opt in out source destination
ACCEPT all -- tun11 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- tun11 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- br-if_pub 0.0.0.0/0 0.0.0.0/0 coova: name: chillipub side: dest ACCEPT all -- br-if_pub 0.0.0.0/0 0.0.0.0/0 coova: name: chillipub side: source `
I also tried to disable TSO GRO and GSO on my interfaces, but nothing change...
does anyone have an idea, What i'm missing ?
@nzamps I saw that you a pretty active about xt_coova. do you know what my problem is ?