0

I am helping a small non-profit set up a public wifi network. It's an event venue, they have terrible cellphone data service in their area, and they need customers to be able to pull up a remotely hosted QR code in their email so it can be scanned for events. They are worried about offices and residents upstairs from their venue using the public wifi for their home internet. The QR code is always embedded from the same domain (the resolving IP may change).

I've found a support page on the D-Link website that describes how to make a web filter with their router software:

https://eu.dlink.com/uk/en/support/faq/routers/mydlink-routers/dir-810l/how-do-i-set-up-website-filtering-on-my-router

But, I'm concerned customers could work around this by setting an alternative IP for their DNS server on their machines (such as Google's DNS).

I'm wondering if anyone has experience with this feature and if so, do you know if it can be worked-around like that?

Also interested to know about any other routers that may support this use case. I did find a lot of recommendations to use smoothwall.com but from what I'm gathering, it seems too expensive for this small organization.

Improve this question
2
  • 2
    What about people who use web-based email? Not just the big-name providers like gmail, but some corporations host their own webmail servers, and some users choose to use that instead of IMAP or Exchange or POP or whatnot. Those users won't have any email pre-downloaded on their phone. If a corporate webmail user can't get to their corporate webmail server, they won't even be able to find the link to your QR code. I don't think you can get away with just whitelisting your QR code server and Gmail. I think you'll need to do something like a captive portal with a code you give out at the event.
    – Spiff
    Aug 26, 2019 at 22:50
  • @Spiff hmm, that's a good point that I hadn't thought of! I think we could whitelist the most common email providers, if the user can't access their email either from the network, or with their phone data plan, there is a backup option to have their ticket printed out at the box office window. We are just trying to alleviate the bottleneck they're experiencing there now, because literally everyone is having their ticket printed there.
    – jessica
    Aug 26, 2019 at 23:54

1 Answer 1

Reset to default
2

The DIR-810L is supported by OpenWrt's last version. Once you have OpenWrt installed, you can do whatever you want! Limit is the sky (and RAM and CPU, as usual).

On OpenWrt you can install a full featured web server, a captive portal, and many other goodies, examples: Adblock, Policy Routing, multiple gateways, and so on. You can really choose how to implement your solution.

As an example, you can force all DNS queries via your DNS using iptables. It's a single rule job placed in rc.local: "redirect to my dns-ip all outgoing traffic to port 53". Done. But would be silly to have such a power house and don't implement some more good stuff :)

You could, as an example, use the statistics module to detect rogue clients: the ones that are always on and generate high traffic are rogues.

Cheers

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .