wifi_captive_blackhole.md

Setup wifi captive portal blackhole không có mạng

Yêu cầu

• Card wifi hỗ trợ Access Point mode, kiểm tra bằng lệnh iw list:

Wiphy phy1
...
	Supported interface modes:
		 * IBSS
		 * managed
		 * AP
		 * AP/VLAN
		 * WDS
		 * monitor
		 * mesh point
...

Hướng dẫn

1. Cài Ubuntu Desktop 20.04.1
2. Cài một số gói sau đây:

$ sudo apt update
$ sudo apt dist-upgrade
$ sudo apt install hostapd bind9 isc-dhcp-server nginx

3. Cấu hình cho NetworkManager không manage thiết bị wifi:

$ sudo nano /etc/NetworkManager/NetworkManager.conf

Thêm dòng sau vào cuối file:

[keyfile]
unmanaged-devices=interface-name:<tên interface wifi>

4. Set cấu hình IP tĩnh cho wifi interface:

$ sudo nano /etc/netplan/00-wifi.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    <tên interface wifi>:
     dhcp4: no
     addresses: [10.1.10.1/24]

5. Cấu hình hostapd để phát wifi:

$ sudo nano /etc/hostapd/hostapd.conf

Thay nội dung như sau:

interface=<tên interface wifi>

# SSID to be used in IEEE 802.11 management frames
ssid=PHRI PUBLIK WAIFU
# Driver interface type (hostap/wired/none/nl80211/bsd)
driver=nl80211
# Country code (ISO/IEC 3166-1)
country_code=VN

# Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz)
hw_mode=g
# Channel number
channel=7
# Maximum number of stations allowed
max_num_sta=5
# Station MAC address -based authentication
# Please note that this kind of access control requires a driver that uses
# hostapd to take care of management frame processing and as such, this can be
# used with driver=hostap or driver=nl80211, but not with driver=atheros.
# 0 = accept unless in deny list
# 1 = deny unless in accept list
# 2 = use external RADIUS server (accept/deny lists are searched first)
macaddr_acl=0

# Bit field: bit0 = WPA, bit1 = WPA2
#wpa=2
# Bit field: 1=wpa, 2=wep, 3=both
#auth_algs=1

# Set of accepted cipher suites; disabling insecure TKIP
#wpa_pairwise=CCMP
# Set of accepted key management algorithms
#wpa_key_mgmt=WPA-PSK
#wpa_passphrase=Somepassphrase

# hostapd event logger configuration
logger_stdout=-1
logger_stdout_level=2

# Uncomment and modify the following section if your device supports 802.11n
## Enable 802.11n support
#ieee80211n=1
## QoS support
#wmm_enabled=1
## Use "iw list" to show device capabilities and modify ht_capab accordingly
#ht_capab=[HT40+][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]

6. Cấu hình Bind9 để reply mọi DNS request về IP của wifi: Tạo file /etc/bind/db.catchall với nội dung:

$TTL    604800
@   IN  SOA . root.localhost. (
             26     ; Serial
         604800     ; Refresh
          86400     ; Retry
        2419200     ; Expire
         604800 )   ; Negative Cache TTL

    IN  NS  .
.   IN  A   10.1.10.1
*.  IN  A   10.1.10.1

Thêm DNS zone vào cuối file /etc/bind/named.conf.local:

zone "." {
  type master;
  file "/etc/bind/db.catchall";
};

7. Cấu hình ISC DHCP server để cấp IP cho thiết bị connect vào wifi: Thêm vào cuối file /etc/dhcp/dhcpd.conf:

subnet 10.1.10.0 netmask 255.255.255.0 {
  range 10.1.10.100 10.1.10.200;
  option domain-name "localdomain";
  option domain-name-servers 10.1.10.1;
  option routers 10.1.10.1;
  interface <tên interface wifi>;
}

8. Cấu hình nginx để redirect network checking requests về trang default của nginx: Sửa file /etc/nginx/sites-available/default:

• Xóa default_server khỏi 2 dòng listen trong default block;
• Thay server_name _; trong default block bằng một domain bất kì vd server_name lolwut.wtf;
• Thêm block sau:

server {
  listen 80 default_server;
  listen [::]:80 default_server ipv6only=on;
  
  server_name _;

  # Apple CNA
  location /hotspot-detect.html {
    return 302 http://lolwut.wtf/;
  }

  # Apple CNA
  location /library/test/success.html {
    return 302 http://lolwut.wtf/;
  }

  # ChromeOS
  location /generate_204 {
    return 302 http://lolwut.wtf/;
  }

  # Windows connectivity detection (http://blog.superuser.com/2011/05/16/windows-7-network-awareness/)
  location /ncsi.txt {
    return 302 http://lolwut.wtf/;
  }

  location / {
    return 302 http://lolwut.wtf/;
  }
}

Thử check config nginx xem mọi thứ có ok hay không?

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

9. Tự khởi động hostapd:

$ sudo systemctl unmask hostapd
$ sudo systemctl enable hostapd

10. Restart and profit:

$ sudo reboot