First time page / Start page

[bichumo]

Hi,

How to provide such a solution for LAN users: for example first time user tries to browse any webpage, he needs to be redirected to my page which provides him information and browsing rules, or maybe asks to login before he can browse web. What software can be used for this?

Thanks in advance.

[DutchDaemon]

That's much tougher than you may think I hacked something together involving:

1) a bridge, with:
2) a redirect rule, redirecting unauthenticated web traffic to localhost:
3) a Squid proxy on localhost, producing nothing but an error page -- which is the 'explanation page' with a link to:
4) a webserver on the external interface, providing basic http authentication against a local .htpasswd file
5) a firewall ruleset which allows authenticated users through using a table
6) a time-out mechanism based on arp and firewall states, revokiing authentication when the user has 'left the building'

Good luck with that

By the way: it will be much easier if you just tell everyone to go to that webserver immediately, but in my case that wasn't possible. I guess using an authenticating proxy is also a solution, but you will have to tell everybody to configure it, or use redirection (which has its own caveats, like https).

[anomie]

By coincidence I was reading about squidguard this morning. You might check into this as well to see if it meets your requirements.

http://www.squidguard.org/about.html

squidGuard can be used to
...
* redirect unregistered user to a registration form.
...

[crayoxide]

Originally Posted by bichumo

What software can be used for this?

This might be of use:

http://nocat.net

Yet another website that I remember reading but forget to bookmark it. Then later when I need to revisit it, I cannot find it because I am not using the right search keywords. ack!

Memo to myself: bookmark more often.

[Sunnz]

Originally Posted by DutchDaemon

4) a webserver on the external interface, providing basic http authentication against a local .htpasswd file
5) a firewall ruleset which allows authenticated users through using a table

Hey,

So how is authentication done? Are you using PF for your firewall?

The web server would need to store the authenticated IP address(?) somewhere, and the firewall would need to know where that is stored and check against it, right?

[DutchDaemon]

I'm using Apache (https, in this case, to prevent password sniffing) and PF, yes. The authenticated IP address gets harvested from a continuous tail -f on the https logfile (grepping/awking lines with a 200 OK status, which means someone must have authenticated themselves), and put in a firewall table using the usual pfctl -t some_table -T add $ip routine. It's a terrible hack, but it works

[Sunnz]

Ahhh nice. I was thinking about setting up something like this in a Motel public WiFi thing, this would be very help full, thanks.

[DutchDaemon]

Note that you get the IP address and the username in the same log line, so you can use them as variables for logging/tracking purposes as well. Just a little scripting needed.