参照routeros的手册,针对我的情况作了部分修改。已经在2.7.14和2.8.11上测试通过。
我的routeros是2块网卡,ether1连接adsl,做pppoe client,ether2连接局域网。
首先按照论坛上置顶的说明正确安装并配置routeros,实现客户机能够正常上网。
然后terminal routeros
改变www服务端口为8081:
/ip service set www port=8081
改变hotspot服务端口为80,为用户登录页面做准备:
/ip service set hotspot port=80
Setup hotspot profile to mark authenticated users with flow name
"hs-auth
":
/ip hotspot profile set default mark-flow=
"hs-auth
" login-method=enabled-address
增加一个用户:
/ip hotspot user add name=user1 password=1
重定向所有未授权用户的tcp请求到hotspot服务
/ip firewall dst-nat add in-interface=
"ether2
" flow=
"!hs-auth
" protocol=tcp action=redirect
to-dst-port=80 comment=
"redirect unauthorized clients to hotspot service
" 允许dns请求、icmp ping ;拒绝其他未经认证的所有请求:
/ip firewall add name=hotspot-temp comment=
"limit unauthorized hotspot clients
" /ip firewall rule forward add in-interface=ether2 action=jump
jump-target=hotspot-temp comment=
"limit access for unauthorized hotspot clients
" /ip firewall rule input add in-interface=ether2 dst-port=80 protocol=tcp
action=accept comment=
"accept requests for hotspot servlet
" /ip firewall rule input add in-interface=ether2 dst-port=67 protocol=udp
action=accept comment=
"accept requests for local DHCP server
" /ip firewall rule input add in-interface=ether2 action=jump
jump-target=hotspot-temp comment=
"limit access for unauthorized hotspot clients
" /ip firewall rule hotspot-temp add flow=
"hs-auth
" action=return
comment=
"return if connection is authorized
" /ip firewall rule hotspot-temp add protocol=icmp action=return
comment=
"allow ping requests
" /ip firewall rule hotspot-temp add protocol=udp dst-port=53 action=return
comment=
"allow dns requests
" /ip firewall rule hotspot-temp add action=reject
comment=
"reject access for unauthorized clients
" 创建hotspot通道给认证后的hotspot用户
Create hotspot chain for authorized hotspot clients:
/ip firewall add name=hotspot comment=
"account authorized hotspot clients
" Pass all through going traffic to hotspot chain:
/ip firewall rule forward add action=jump jump-target=hotspot
comment=
"account traffic for authorized hotspot clients
" 客户机输入任何网址,都自动跳转到登陆页面,输入账号密码,继续浏览。
如果使用ftp、pop3等,也必须先通过网页登录,才可以使用,当然使用winbox的时候也必须先登录。
关注天下网吧微信,了解网吧网咖经营管理,安装维护: