Redirection to an external portal server

[yangliu0606]

I have a question. Currently, the portal portal page I configure for ccoova is on an external server. How do I send requests from the external login page to coova on my access point to authenticate using the radius server?

[yangliu0606]

The listening IP address is 192.169. 8.1. The listening IP address is 3990 on the internal bridge. The WAN IP address is 5.5.x.x. The external portal server can access only the WAN IP address. How does the external portal server notify the coovachilli on the access point of the device that the user passes the authentication and allows the user to pass through?

[yangliu0606]

HS_WANIF=eth_x
HS_LANIF=br1
HS_NETWORK=192.169.8.0
HS_NETMASK=255.255.255.0
HS_UAMLISTEN=192.169.8.1
HS_UAMPORT=3990
HS_UAMUIPORT=4990
HS_DNS1=211.1.1.2
HS_DNS2=211.1.1.3
HS_NASID=lo
HS_RADIUS=192.169.8.1
HS_UAMALLOW=www.coova.org,192.168.8.1,5.5.7.103
HS_RADSECRET=WinRadius
HS_UAMSECRET=change-me
HS_UAMALIASNAME=chilli
HS_KNAME=chilli
HS_REDIRSSL=on
HS_SSLKEYFILE=/var/chilli/etc/chilli/key.pem
HS_SSLCERTFILE=/var/chilli/etc/chilli/cert.pem
HS_UAMSERVER=192.169.8.1
HS_UAMFORMAT=http://5.5.7.103:26262/login.html
HS_UAMHOMEPAGE=http://192.169.8.1:3990/www/coova.html
HS_MODE=hotspot
HS_TYPE=coovachilli
HS_WWWDIR=/system/bin/chilli/etc/chilli/www
HS_WWWBIN=/system/bin/chilli/etc/chilli/wwwsh

[sevan]

Do you actually have 192.169.8.x allocated to you or have you misinterpreted RFC1918?

[yangliu0606]

[yangliu0606]

After the PC is redirected to the external portal server for authentication, how can the authentication result be notified to the coovachilli service listened by the router?

[akadata]

That's a really simple issue to resolve. its called a DMZ, simply cooca-chilli sends on a random high port a request to the webserver ideally on port 443. assuming you have HTTPS enabled. Then the user authenticates against the portal and a response is then sent back on the same random high port to coova. Now you ask why DMZ is needed, its not really however you need to be able to handle all those high ports that may be used, 65535-1024=much simpler to DMZ the chilli box. known from first hand experience and it will resolve the issue, simply goto the upstream router and say all incoming connections goto your chilli eth0/ wan port and Auth will just work.