Difuse/routing
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nodogsplash2: change configuration defaults (#341)

Browse source 
nodogsplash2: change configuration defaults

Changes:
* set default to NoDogsplash enabled as rest of config should now be safe and is possible to SSH to router to stop NDS if needed
* change clientidletimeout to 120 minutes (2 hours)
* add clientforcetimeout set to 1440 minutes (24 hours)
* comment out the two provided example authenticated_users block lines
* add list authenticated_users 'allow all'
* comment original list authenticated_users allow... entries and leave them as examples
* set preauth default to no use remote DNS. All devices used at a public wifi venues should be configured for DHCP. To force the use of the local DNS server makes DNS tunnelling very inefficient if not unusable on a typical OpenWrt device.
* set fw_mark settings for compatibility with other OpenWrt packages
This commit is contained in:
bluewavenet 2018-01-04 19:42:07 +00:00 committed by Moritz Warning
parent 679f780747
commit 5e96695d52
1 changed files with 25 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
nodogsplash2/files/nodogsplash.config
View file

@ -3,8 +3,8 @@
# See https://github.com/nodogsplash/nodogsplash/blob/master/resources/nodogsplash.conf # See https://github.com/nodogsplash/nodogsplash/blob/master/resources/nodogsplash.conf
config nodogsplash config nodogsplash
# Set to 1 to enable nodogsplash # Set to 0 to disable nodogsplash
option enabled 0 option enabled 1
# Serve the file splash.html from this directory # Serve the file splash.html from this directory
option webroot '/etc/nodogsplash/htdocs' option webroot '/etc/nodogsplash/htdocs'
@ -14,27 +14,34 @@ config nodogsplash
# The network the users are connected to # The network the users are connected to
option network 'lan' option network 'lan'
option gatewayname 'LEDE Nodogsplash' option gatewayname 'OpenWrt Nodogsplash'
option maxclients '250' option maxclients '250'
option clientidletimeout '1200' #Client timeouts in minutes
option clientidletimeout '120'
option clientforcetimeout '1440'
# Your router may have several interfaces, and you # Your router may have several interfaces, and you
# probably want to keep them private from the network/gatewayinterface. # probably want to keep them private from the network/gatewayinterface.
# If so, you should block the entire subnets on those interfaces, e.g.: # If so, you should block the entire subnets on those interfaces, e.g.:
list authenticated_users 'block to 192.168.0.0/16' # list authenticated_users 'block to 192.168.0.0/16'
list authenticated_users 'block to 10.0.0.0/8' # list authenticated_users 'block to 10.0.0.0/8'
# Typical ports you will probably want to open up. # Typical ports you will probably want to open up.
list authenticated_users 'allow tcp port 22' #list authenticated_users 'allow tcp port 22'
list authenticated_users 'allow tcp port 53' #list authenticated_users 'allow tcp port 53'
list authenticated_users 'allow udp port 53' #list authenticated_users 'allow udp port 53'
list authenticated_users 'allow tcp port 80' #list authenticated_users 'allow tcp port 80'
list authenticated_users 'allow tcp port 443' #list authenticated_users 'allow tcp port 443'
#Or for happy customers allow all
list authenticated_users 'allow all'
# For preauthenticated users to resolve IP addresses in their # For preauthenticated users to resolve IP addresses in their
# initial request not using the router itself as a DNS server, # initial request not using the router itself as a DNS server,
list preauthenticated_users 'allow tcp port 53' # Leave commented to help prevent DNS tunnelling
list preauthenticated_users 'allow udp port 53' #list preauthenticated_users 'allow tcp port 53'
#list preauthenticated_users 'allow udp port 53'
# Allow ports for SSH/Telnet/DNS/DHCP/HTTP/HTTPS # Allow ports for SSH/Telnet/DNS/DHCP/HTTP/HTTPS
list users_to_router 'allow tcp port 22' list users_to_router 'allow tcp port 22'
@ -43,7 +50,6 @@ config nodogsplash
list users_to_router 'allow udp port 53' list users_to_router 'allow udp port 53'
list users_to_router 'allow udp port 67' list users_to_router 'allow udp port 67'
list users_to_router 'allow tcp port 80' list users_to_router 'allow tcp port 80'
list users_to_router 'allow tcp port 443'
# MAC addresses that are / are not allowed to access the splash page # MAC addresses that are / are not allowed to access the splash page
# Value is either 'allow' or 'block'. The allowedmac or blockedmac list is used. # Value is either 'allow' or 'block'. The allowedmac or blockedmac list is used.
@ -54,3 +60,8 @@ config nodogsplash
#MAC addresses that do not need to authenticate #MAC addresses that do not need to authenticate
#list trustedmac '00:00:C0:01:D0:1D' #list trustedmac '00:00:C0:01:D0:1D'
# Set FW_MARK for compatibilty with other OpenWrt Packages eg mwan3, sqm etc.
list fw_mark_authenticated '520'
list fw_mark_trusted '510'
list fw_mark_blocked '500'