First the DHCP part. My AP is still unsecured, which means that we can play around with freeloaders. I want to make sure that my own laptop connection is steady, however. To accomplish that, I'll create two subnets, both running on the same interface. One of them will be the 'secure' network, the other one will be the funny one. The /etc/dhcp3/dhcpd.conf listed below does exactly this (10.0.0.0/24 being the 'secure' subnet, providing only one fixed IP-address (10.0.0.20) for one known host, 192.168.0.0 being the 'funny' one, providing IP-addresses in the range of 192.168.0.10-192.168.0.100).
default-lease-time 3600;
max-lease-time 86400;
log-facility local7;
shared-network local {
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.10 10.0.0.100;
option routers 10.0.0.1;
option subnet-mask 255.255.255.0;
option domain-name-servers x.x.x.x, x.x.x.x;
deny unknown-clients;
host D430 {
hardware ethernet xx:xx:xx:xx:xx:xx;
fixed-address 10.0.0.20;
}
}
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.10 192.168.0.100;
option routers 192.168.0.1;
option subnet-mask 255.255.255.0;
option domain-name-servers x.x.x.x, x.x.x.x;
allow unknown-clients;
}
}
For each subnet, DHCP will now search for an interface which has an IP-address on that subnet. Since we're using a single access point, build on wlan0, we'll need to assign two IP-address to this interface:
sudo ifconfig wlan0 10.0.0.1 netmask 255.255.255.0
sudo ifconfig wlan0:0 192.168.0.1 netmask 255.255.255.0
Note that the log-facility local7; line in the above dhcpd.conf forces syslog to use local7 as output log. If we edit /etc/rsyslog.conf and add the line local7.debug /var/log/dhcpd.log to it, then DHCP logs will be written to /var/log/dhcpd.log instead of the general syslog file. If you do this, make sure to restart the syslog daemon after updating its configuration: sudo service rsyslog restart.
We can now (re)start the DHCP server with sudo /etc/init.d/dhcp3 restart (or sudo /etc/init.d/isc-dhcp-server restart on newer Ubuntu releases)
After all above, clients should still be able to connect. Trusted clients, however, should be placed on the 'trusted' network, while unknown clients will be on the 'funny' subnet :)
Now that we can distinguish the two networks, it is time to play a bit. You could, for example, redirect all web traffic towards a single IP-address (xkcd.com) using IP-tables:
sudo iptables -t nat -A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp --dport 80 -j DNAT --to-destination 72.26.203.99
We'll be having more fun when we redirect everything through a squid proxy. Download and extract these scripts into (e.g.) /scripts and chmod them 755. Note that you probably have to update the $ourIP variable in those scripts (into 192.168.0.1 in this situation).
Then remove the just created iptables rule and install squid3, apache2 (yeah, we also need apache) and some more tools:
sudo iptables -t nat -D PREROUTING 1
sudo apt-get install squid3 apache2 imagemagick ghostscript jp2a
As shown on g0tmi1k, the things we need to change in /etc/squid3/squid.conf are the following:
- change "http_port 3128" into "http_port 3128 transparent"
- Add "acl localnet src 10.0.0.0/24" after the "#acl localnet src ..." lines
- Add "http_access allow localnet" near the "http_access" statements
- (at EOF) add "url_rewrite_program /scripts/blurImages.pl" (or any other script)
sudo mkdir /var/www/tmp
sudo chown nobody:nogroup /var/www/tmp
sudo chmod 777 /var/www/tmp
sudo /etc/init.d/apache2 restart
sudo /etc/init.d/squid3 restart
sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 3128
