MikroTik

reinerotto

Whom did you find on that page ?

reinerotto

I am a Software guy, but for a friend I am looking for a technician, capable to install MT equipment, incl. cable config.
To set up SXT LTE6 or similar.

reinerotto

Your solution just is the basics. As other users pointed out here, there are possibilities to circumvent your "half baked" solution. However, up to a certain high degree all the arguments against your solution can be taken care of, with some additional work. I.e. DoT uses special port, to ...

reinerotto

tailscale might be best and simplest solution. Especially, because there is also (open source) headscale available, a do-it-yourself central manager, in case you do not trust a third party.

reinerotto

In case, you have a MT, which is officially supported to run openwrt, after flashing openwrt, you can do what you are asking for.

reinerotto

Is there a reliable multi-carrier SIM-provider in the USA, to allow usage of ATT&T or Verizon ?

reinerotto

>All 3 of the devices that worked for 5 minutes are all listed as "supports Verizon". < This is not clear to me. Do you find these devices on Verizons website, confirming, they are _certified_by_Verizon ? If not, no need to go any further. BTW, Mikrotiks devices are _NOT_ certified, AFAIK....

reinerotto

Golden Orb is some type of fork of "official" openwrt. Goggle for openwrt and your device type. You should find some instructions for flashing openwrt, or for restoring factory (MT) software.

reinerotto

Is there any mobile router from MT, which is certified for ATT or Verizon ?
For commercial installations, using some type of cheating here is too risky.
Certification of the device is the most important, because intending to use Quectel-AF modem, which is certified already.

reinerotto

Then you should have a look at squid proxy. Not to run on MT, AFAIK, so you will need a small LINUX host.
However, steep learning curve, for what you want to achieve. But doable.

reinerotto

1) VZ detects your non-certified hardware and drops connection.
2) You are leaking irregular traffic to Verizon, i.e. packets from LAN, without being NATted. VZ disconnects in this case.
tcpdump your traffic to VZ.

reinerotto

As mentioned already, hotspot functionality should do it. macauth + radius "daily session time".
I am writing "should do it", because standard MT hotspots are not so advanced like coova-chilli hotspots, running on openwrt.

reinerotto

some devices like Huawei routers have option to redirect user to some SITE for information - thou we don't know how they do it

Interesting. Did you verify, that this also worked flawlessly for HSTS sites ?

reinerotto

I am using the EC25-V in a large fleet of openwrt-routers, for IoT, because EC25-V AND the router itself are certified by Verizon to be used in their network. The EC25-AF also is certified by Verizon, AFAIK. Whether EC25-A is certified, I do not know. AFAIK Mikrotik devices are not officially certif...

reinerotto

EC25-A is not for usage on Verizon. Only EC25-AF or EC25-V.
Anyway, you confirmed, that the usage of your LHG-R and EC25-AF (or EC25-V) is properly supported/registered with Verizon ?

reinerotto

> it will be nice bounce if we could do something like making a specific domain works only for a specific device.<
You can do this, in case you can install a special service (i.e. DNS-server or DNS-forwarder; router) in the location of your "specifc device". To catch the mac.

reinerotto

well my problem is if i set lets say 10gb to a user and the user used 9gb of them then the next time he opens the internet if he used the remaining 1 gb it wont automatically cut him off the internet it'll wait until he logs out or the host is removed somehow Using "serious" Captive Porta...

reinerotto

We are provisioning about 200 devices a month. And yeah, it would be very nice to have some sort oft automatisation. All device run their own config - so every device is NOT a copy of another. Using openwrt-based, customized firmware image, my client(s) also provision lot of devices every month, fo...

reinerotto

Use a "serious" hotspot software, like coova-chilli + openwrt. Which has a CoA-similar mechanism built in, for more than 10 years already. Its called 'acctupdate', which means, when sending accounting info from hotspot device to radius, it _might_ pass back update of session pars, i.e. ses...

reinerotto

All this posts, but still valid what is written on post #2... Please, stop to spread wrong info. You can not assume, that, in case, you did not succeed in blocking, nobody else can do, as well. I.e. what does any browser, trying to use QUIC, in case UDP port 443 blocked in router ? There is an old ...

reinerotto

Can Mikrotik provide that info?

They should. But you can look online on Verizons pages, for certified devices, not being org Verizon products.

reinerotto

I support a large fleet of IoT devices, using Verizon. However, the fully certified routers and modems are not Mikrotik. But also from the Baltic states

reinerotto

Be very careful, when connecting Mikrotik to Verizon. They are _very_ strict in their certification policy, which means, you need to make shure, that the Mikrotik equipment is certified from Verizon to be used on their mobile network.
See here: viewtopic.php?t=193243

reinerotto

May be, renewal of IP does not work properly ? How long is IP valid ?

reinerotto

Actually, not enforced everywhere. Does youtube enforce it ?

reinerotto

Applaus.
You did the "teaching", I was too lazy for. Assuming, my hints would trigger some thinking.
BTW: SNI intercept can also help in blocking youtube etc.

reinerotto

Until you do not have full control of user device, you can not stop DoH & Co. with pihole (and neither the VPNs). Not absolutely correct. You _can_ stop DoH/DoT, and VPNs as well, at least, many or most of them. I.e. for WiFi in schools, this is an important feature. You can _not_ block DoH wit...

reinerotto

Would like to hold a presentation there, like: "The advantages of running openwrt on mikrotik hardware, especially for hotspots".
Question is, whether accepted by Mikrotik ...

reinerotto

I did something very similar, running openwrt on a mikrotik, to include customized DNS-server/recursor, similar to pi-hole, in same box.

reinerotto

You "simply" have to block all the IPs of the well-known DoH or DoT servers on the router, to force the usage of simple DNS. Still a small loophole, in case somebody runs his private DoH-server, though. Or your list of well-known Doh/DoT-Servers is incomplete; requires regular updates, of ...

reinerotto

There are a few issues, you have to consider, when doing this.
- Is IPv6-DNS also redirected to pi-hole ?
- Is DoH blocked ?
- Is DoT blocked ?

Nowadays, quite often DoH is used by default. Which renders the method from the video useless.

reinerotto

Now, they would be connecting with their WG IP address so the perpetrator of issues would be 'trackable'

Not necessarily, because WG IP can be easily changed.

reinerotto

#In case, your mikrotikdevice is officially supported by openwrt, #flash openwrt to your mikrotik, log into the router, i.e. via ssh or putty, and then it is just a one-liner: echo 'address=/#/ONLYIP' >> /etc/dnsmasq.conf #i.e. echo 'address=/#/192.168.1.1' >> /etc/dnsmasq.conf #reboot #This will fo...

reinerotto

I'd argue this is way easier on Mikrotik, than using OpenWRT and somehow integrating "mosquito" and "bash" [and cron and reading the dnsmasq leases]. #Sorry,but I have to correct you. #All you have to do on openwrt is to log into openwrt-shell, using ssh or putty, for example, a...

reinerotto

is it true that the MT feature become more diversitile if we install openWRT firmware on it..? I did my first hotspot systems on mikrotiks, many years ago. Later on, I switched to openwrt for this purpose, because much more open, with many more packages to choose from, giving the opportunity of som...

reinerotto

You can do this using a more appropriate device, instead of a mikrotik. I.e. a router, running openwrt.
However, _may_be, even your mikrotik is officially supported, to run openwrt. Then you only need to switch OS,
and you can use mosquitto and bash, to achieve your goal.

reinerotto

You could add your "private" DNS server plus logging to your network. However, depending upon knowledge of your clients, they might bypass this. Or the browser used does this by default itself, already. I.e. using DoH, which would need some additional tricks for you against it. A completel...

reinerotto

I think, for your purpose a router, based on openwrt, is the better solution. SImply, because it is much closer to a real LINUX system like ubuntu, than the mikrotik stuff. In fact, openwrt is a "shrinked down" LINUX, but also having a GUI for the common setups. But you can always change t...

reinerotto

The only real problem is the usage of VPN.
Everything else can be taken care of.

reinerotto

" ... shut down gracefully ..." means something like "shutdown" or "halt" to the device. And then, to switch off power to the device, like pulling the plug. As I read, MTs _should_ withstand abrupt power cut, but I am coming from industrial environments with high reliab...

reinerotto

In a professional, industry grade install, you have a small battery for buffering, to shut down gracefully in case of power loss.
When using in a vehicle, this also will take care of power fluctuations, especially during start up of the engine.

reinerotto

I did several variants of what you are talking about, however, on a commercial basis, either built into openwrt devices, OR server based.
Feel free to contact me on my adrs augustus_meyer at yahoo.de , for details.

reinerotto

As a developer, I did various custom management services for openwrt-routers, for various clients, mostly in the area of hotspots. Clients have all sources, of course. So no public open source, but open to the client himself. Thus, the answer in short: No 3rd party stuff. In case of more general man...

reinerotto

Having done various "flavors" of custom DNS, similar to OpenDNS, for WISPs, not willing to pay royalties because of commercial use, I do not completely understand your requirements, And your critics, that you used 4 different DNS based content filtering solutions, not being good enough. Wh...

reinerotto

I consider the critics here, regarding security and confidentiality of a cloud based service, not to be fair. Although, I have switched from using miktotik for custom hotspots many years ago, _ALSO_ because of the fact, that RoS is _NOT_ open source. Therefore, critics regarding security and confide...

reinerotto

+1.
Using wireguard on openwrt, which is much more "Linux" than MTs stuff, is straight forward.

reinerotto

What you want, can be controlled using RADIUS (i.e. freeradius). I do exactly what you want on hotspots, running openwrt, using coova-chilli as captive portal (which is the most flexible, but most complicated CP), which cooperates with RADIUS. To get rid of the bad guys, downloading or watching high...

reinerotto

Certain RB2011 models are officially supported by openwrt. Which allows much more customization for special applications, like yours, because being totally opensource. I.e. content filtering can be forced much better running openwrt compared to RoS, using certain packages of openwrt. In your case, D...

reinerotto

Alternative, probably faster than zerotier, and no license hassles, but requiring more tech know-how for setup: Use wireguard as VPN. wireguard-"client" on local router, setting up tunnel to private wireguard-"server" on the web. You can do this with mikrotik equipment, but also ...

reinerotto

On openwrt I _MUST_ make shure, that NTP syncs the system time, before wireguard starts up. Which needs re-arranging the startup-sequence regarding NTP service, and single-shot update of system time via NTP, not just graceful adjustment in small increments, to be on safe side or to handle worst case...

reinerotto

Today the power went out, and when it came back online, the router did not reconnect to the VPN. It seems that while the cable modem was reconnecting, wireguard failed to handshake and then the router just never tried again. It is not a wireguard problem, but MTs implementation/usage of wireguard. ...

reinerotto

In the good old days, when providing process control computers to airport environments, we used a simple switchover technique, triggered manually. The backup system was on cold stand-by, all external interfaces (DI/DO, serial lines ...) were switched from the failed live system to the backup using o...

reinerotto

"Some reading ..." confirms my statement from above. Thank you.

reinerotto

1) Since you can not see what's inside HTTPS packages, you can not know if its a web site or DoH traffic. 2) And since any can setup a DoH or DoT server, there are no way you can block this. 1) Since every "well-known DoH-server" has an IP, its possible to block. Or after interception of ...

reinerotto

How can you ever block all DoH servers?

Not possible, of course. But possible to block the "well known" DoH servers.

reinerotto

DoH in your browser will however bypass both your local DNS or local DoH server settings.

Not necessarily.
Because DoH server can be blocked, and then fallback to standard DNS.

reinerotto

I think you could even run openwrt on some mikrotik devices, and then install pihole with unbound.

+1
Or to use dnsmasq, or even powerDNS with openwrt, running on some MT devices.
Done that.

reinerotto

@reinerotto To solve this discussion. Give me a VPN to a site that you control and is porn secure, and I can send you some print screen show what I can get when using your VPN. (As long as you have standard usable open net. Not all IP blocked.) First of all, the fact, that you still did not provide...

reinerotto

I do not spread wrong information.

You still did not answer my question, how you can you claim, 100% control about clients is required, to block porn.
Which I also consider, to be wrong.

reinerotto

Running openwrt on certain mikrotiks, so I have the permission to be here, I assume.
However, I consider it a good idea, to correct the spreading of some wrong and bad desinformation, in case I encounter it, by chance.
To fight the degradation of software quality.

reinerotto

Posts #11 and #65 already give a good start. And then to use the few rules, posted here already, to redir all DNS-requests to openDNS, for example. There are lists of the "well known" DoH-Servers on the web. Block access to them on the RB, using firewall. Finally, implement "Force Saf...

reinerotto

1) Just google on how to ignore the Force Safe Search and you are done. 2) Or you can just change browser. 3) Again: Without 100% control of all clients, you can not block porn. 4) @reinerotto What are you trying to defend here with all this posts? That its easy to to block porn with RotuerOS? 1,2)...

reinerotto

The statement "porn is unblockable" is wrong already, when at least ONE porn site is automatically recognized and blocked.

reinerotto

Yes, that is the simple, general method to intercept all DNS requests, and force them to a specific server. Thus, it can be used to force usage of own, custom DNS server to perform the porn filtering by domain, and force the safe search. Because I do not really trust 3rd party services, which might ...

reinerotto

"That is something possible with RouterOS, just require using /ip/dns commands instead of OpenWRT's dnsmasq config ." OK, I di dnot know, because I do not know RoS so well. Dropped usage of RoS for hotspots many years ago, because not the best platform for this type of app. Sorry, I do not...

reinerotto

You are wrong, in regards regarding clients: "Force Safe Search" is possible _WITHOUT_ doing anything on the clients. Just read the docs about it. You are right, that this is not possible on Mikrotik, running RoS. In case, the mikrotik is running openwrt, you can do it. Installation accord...

reinerotto

"I would say closer to 80%, not 99.9% Example when search for "sex" in google.com using any browser, how would you block that." Bad example: Various methods to force "Safe Search" for bing, google, etc. For details, google "How to force safe search google". un...

reinerotto

Porn is unblockable. This is wrong generalization. Correct is: "Porn is not 100% blockable, but 99.9%". Assuming proper knowledge and tools, of course. MT enthusiasts should not think, the limits of RoS also apply to standard ubuntu, for example. Or openwrt. When going down to porn blocka...

reinerotto

I think, you are asking for too much. RoS is a routers operating system. As an alternative, in case you need DNS-Server functionality, use openwrt, which also runs on a few selected MTs. It also does routing, of course. But I even run powerdns on it. dnsmasq is standard, but you can also use unbound...

reinerotto

The funny part is, you consider setup of private DoH-Server to be simple. But you do not recognise the (technical) difference between blockage of (porn-)domains, which usually is good enough, and blockage of specific (porn-)URLs. BTW: A "clever' guy, trying to circumvent DNS based blockage, wou...

reinerotto

Intercept of https and de-crypt/ inspect/ en-crypt requires cert installs on clients, as decribed. 1) This is what I was looking for. Since you need to do some with the clients, this is more or less the same as how Palo Alto or Forcepoint works. Only a solution for company that has 100% controls of...

reinerotto

@Jotne Very comprehensive how web filter works in untangle https://wiki.untangle.com/index.php/Web_Filter At first glance, part of it contains a commercial version of squid, to intercept http(s). Impossible to be done on MT, but, as I wrote already, to be done yourself on openwrt device, or small L...

reinerotto

In Turkey they blocked various sites, like Wikipedia. DoH fixed access to it. So please show me a solution that are up to 100% secure without controlling the clients. Obviously, you did not read my post. Or, you did not understand. Then it does not make sense, to explain more details to you, regard...

reinerotto

It was just to show that trying to block some are more complicated and nearly impossible today. You are correct, when stating "nearly". But it is much closer to 100%, as your comments suggest. Unfortunately, I doubt everything can be done on a MT, as not "open" enough. openwrt-d...

reinerotto

Turn off safe search on your google search
You can block google.com, but then just use bing.com instead. Same problem.

No.
You can force safe search, both for google, and for bing, on the router.

reinerotto

add action=dst-nat chain=dstnat comment="block porn" dst-port=53 protocol=udp src-address-list="BLOCK PORN" to-addresses=208.67.222.123 to-ports=53 There is no way to construct a rule that will match DNS over HTTPS traffic in that same way. However, you can block access to (know...

reinerotto

Unfortunately, no change.
Thank you, anyway, will keep the rules, of course.

reinerotto

I have multiple identical routers, equipped with Quectel EC25-V, to be connected to Verizon. Using PPPD, about 60% of all the routers connect (receive IP) immediately, the other connect after many retries, after a few hours sometimes. Even, if the devices are located just side by side. A suspicion o...

reinerotto

There are several caveats: If the packet with the SNI is fragmented, the firewall rule is not triggered. This is also a limitation of MT. Because an openwrt-device, for example, can run squid, which is able to "examine" the complete SNI, and filter it, on higher level. Which means, this l...

reinerotto

@rextended There is no way, and the vendor do not have any importance. This is definitely not correct. Or, in your words, "idiotic". A MT-device actually does not run something like squid as intercept/explicit proxy. Which is the "kernel", required for https-url-filtering. But lo...

reinerotto

In case, you did it already using squid, then you can do it on openwrt-device the same way. And use the box as a router, too, of course.
For such "tricks", MT is not the best choice. Because closed, unfortunately.

reinerotto

This is not absolutely correct. There are proxies, which intercept HTTPS-traffic, de-/recipher the request, and allow URL-filtering. However, this needs installation of certs on the client devices, which is possible only on local nets. Does not work for certain sites, using pinned certs, though. All...

reinerotto

mikrotiks first of all are routers. All other functionalities are addons, usually good enough for average requirements.
However, for (ad-)blocking I use an openwrt-device. Which has many more possibilities.

reinerotto

Does the definition of this canary domain 'use-application-dns.net' for FF really disable DoH ? I have FF 79, connected to non-MT router, running dnsmasq. And I can not see any access to this domain in my logs. May be, FF dropped this option recently ? As a workaround, I block access to many well-kn...

reinerotto

You are bound to the limitations of RoS. In general, it is possible to achieve, what you want, _BUT_ getting a security warning from the browser, first, because of wrong certificate. I do this on openwrt, however. Which is more suited for such tasks. Which are typical for advanced hotspots, requirin...

reinerotto

If you are filtering Facebook, use NAT instead to redirect the Facebook connection to a local server that will serve a page.

Clever. Thanx a lot.

reinerotto

On openwrt, I do it using multiple instances of dnsmasq.

reinerotto

>the browser needs to resolve to check ifs there connection< AFAIK, this is done trying DNS. In standard hotspots, DNS works. You should do detailed analysis, whats going on between browser and router. I.e. using tcp-dump. Be warned, that "Captive Portal Detection" is similar for Andoid an...

reinerotto

Because openwrt is open source, coova-chilli can be used as Captive Portal. Like on more expensive comercial hotspot systems. coova-chilli can be configured, first to try MAC-auth, when users device associates. In case of success, user can immediately reach the web. In case of failure, coova-chilli ...

reinerotto

Although this question is not MT-specific, as a general guideline you need to use MAC-based auth on the second login. Which is to be set up both on freeradius, and the hotspot itself.
Sorry, no details for MT, as I only do openwrt-based hotspots. More suited for advanced configs.

reinerotto

OP not asking for radius only. Radius usually is part of any good management system, but only small part.

reinerotto

This is not the right place to make recommendations out of mikrotiks environment.
For openwrt based systems, which includes several mikrotik devices, hotspotsystem.com is a good choice. Or ct-networks.io

I have no connections with both.

reinerotto

Unfortunately, mikrotik is not the best platform for hotspot services, having above-basic requirements. One reason is, that RoS is closed, so no special customization possible. This said, you might take into consideration, that there are a few hotspot+management packages available for openwrt-based ...

reinerotto

I am looking for business-related contacts, regarding filtering services for hotspots, either at home, or public.
Yes, there is openDNS. But there might be a better, and cheaper, alternative.
Pls, mail augustus_meyerATyahoo.de

reinerotto

Using squid: YES.
I did that for "Parental Control" , for a commercial product.

reinerotto

1) This question has nothing to do with Mikrotik, all vendors do it in their own unique way (and also change those ways from time to time). 2) I doubt anyone of this forum will be able to answer this particular question fully. 1) Correct. 2) Wrong. However, because of 1), no further details here. Q...

reinerotto

And how does does it know the hotspot login page to send the user to? Lets say the hotspot is hosted at 1.1.1.1, how does it know to send the user to 1.1.1.1? Back to one of my previous posts: Using openwrt for hotspots will show you, because open source. I.e. check the docs and source code for coo...

reinerotto

What I did do is scour all the walled garden section (there's a bunch) and found *gstatic.com and *akamai* was infact in the wallen garden list. We are using HSNM (lets see if that now fixes the issue and reduces complaints) These were not in the configurable parameters but actually came from a php...

reinerotto

Correct.
But thats not all, as firefox, for example, has a pre-loaded list of HSTS sites. I guess, same for Chrome.

reinerotto

https://support.apple.com/en-jo/HT209144#trusted

reinerotto

When buying a certificate for your website, buy from "trusted" authority.
Otherwise you might face inconvenient issues when using newer IOS clients.

reinerotto

hing I see on the software page that is a bit alarming is the fact that they display YouTube videos when you are not authenticated Yes, this is very, very suspicious, at least. Good indication would be problems with Android phones, as their CP-detection relies on google servers. IOS should not be c...

reinerotto

So the CP-detection is your real issue. I am a bit wondering about this, as I thought, MT-hotspots are quite often used, and I expected MT to have a reasonable solution, at least. Your issue(s) need more detailed discussion, it looks like, as CP-detection also is dependent upon clients device, altho...

reinerotto

As I wrote already, you will _never_ be able to reliably redirect HTTPS (for purpose of Captive Portal CP or anything else), unless you are able to install special certificate on the users device. Which is not possible for a public hotspot. Valid for MT-hotspots, openwrt-based ones etc. No differenc...

reinerotto

If the hotspot server is a mikrotik router, how do you accomplish this?

Sorry, no idea, but doing this for long time already, on openwrt-based devices.
Which are much better suited for hotspots with "advanced features", like this one.

reinerotto

RouterOS is a configurable router, this puts it in the same category as ubiquiti, cisco, junipter, pfsense, your typical x86 based and linux OS. The mean weakness that mikrotik has is that unlike ubiquiti or any standard OS you cant install anything else onto the router other than what mikrotik dev...

reinerotto

Thanx for confirmation. But what about using MT plus USB-dongle from carrier, where applicable ?
Also the MT-boards need "Certification" ?

reinerotto

For a friend in BR I want to buy a MT with LTE modem.
However, I am advised, that such equipment needs some type of 'Certification' for legal usage in BR.
Are all MTs legal to be used in BR ?

reinerotto

Why so complicated ?
Use MT for "plain and simple" routing/networking.
And an openwrt-box for the missing functions, like wireguard, squid proxy, nginx web server etc.
Or, just use openwrt devices for routing/networking, too.

reinerotto

This you can do yourself, using squid proxy. However, it needs quite some expertise for correct setup.
However: Does forcepoint work with _ALL_ domains ? (facebook, google ...)
Just thinking about pinned certs ...

reinerotto

Dunno. But the MT should be able to determine the MAC itself, from IP and leases of dhcp.

reinerotto

Sorry, but I do this for a living, and on openwrt. Besides, impossible to do the same on MT, because not open, and it needs some software (openwrt-packages; or LINUX, if you want) not available on MT. I often stated several times here that for hotspots with special requirements, MT is _no_ good choi...

reinerotto

Congrats. So you are the second

Works for Android 7, too, I hope ...

reinerotto

>... and they must be explicitly configured to use the proxy - transparent proxying does not work for HTTPS.< This is not absolutely correct, with respect to the requested logging. (Not to mention fiddling aroud with certs, which allows transparent https-proxying to some extent even further.) Transp...

reinerotto

Sorry, but publishing more details about a future commercial product goes too far. Wait, and you'll see. As a good comparison, for hotspots with special requirements, MT also is not properly suited, because closed. No problem to install squid or nginx on openwrt, for eample, if required for special ...

reinerotto

Perfectly within the realms of a MikroTik

Yes, you are correct, to match the basic requirements of the thread starter.
However, in case of more demanding functionality, MT not usable any more
for commercial product.

reinerotto

R1CH had the best proposal: Fake a Captive Portal. Implementation details depend upon your network structure, i.e. using DNS-hijack. And might not be so simple, though. However, will work without flaws on http only, but on connecting devices the Captive Portal Detection will be triggered, and you ca...

reinerotto

You might simply wait, to buy a router with your requested features. Time to wait depends upon your location, as I am doing a commercial product based on openwrt
implementing your request

MT is not the best platform for such a device. Because too closed.

reinerotto

@Isko900: As many sites, like youtube or facbook, use https, which is encrypted, it is not possible any more to block certain (video-) file types, like .avi or .mp4. Simply, because they are not recognizable any more, as when using http. Slowing down the connection per user, i.e. to 128kbit/s, would...

reinerotto

Or use a device, much better suited to hotspot functionality with above-average requirements: openwrt-based device. There we (can) do such tricks. And a few more. _But_ your requirement impossible to fulfill cleanly for https, of course. In best case, you reach the redirected page after some browser...

reinerotto

OpenDNS which is a free service for home or private users.

FYI: For commercial use, OpenDNS asks for subscription payments. So, for a public WISP, I did a simple clone of OpenDNS, to save the $$.
In case of interest, lemme know.

reinerotto

Agree to previous post in general; however, something else must be wrong, too. As practically every client-device with recent OS (iOS, Android, Windows ...) tests the internet connection using _standard_ http, which triggers the captive portal. Or the MT hotspot. At least, it should trigger, _unless...

reinerotto

Use the search function on this forum, and you will find some advice regarding your question. Also some comments from me.

reinerotto

Dump IPFire, install a small/old x86-PC running squid as local proxy within your network. This can do, what you want.
It is always strange, to read some questions, having already a supposed-to-work answer included

reinerotto

Yes: Use a full-featured proxy, like squid.

Your usage case is one more argument against using MT for hotspots
with above-basic requirements.
As in openwrt, I often integrated squid. Also to implement
your requested functionality

reinerotto

MT is not the wright platform for the functionality, you want.
On openwrt-based devices, you can do this either based on
DNS
or by impleneting a full fletched proxy.
Will also work on https, with some browser warnings, though.

reinerotto

Did several commercial systems, like you are asking for. However, MT is not the wright platform for this, because not flexible enough. openwrt is the way to go. I.e. I did a "local hotspot" for on board aircraft, without internet connection, to work as media server, for order processing et...

reinerotto

No. As you wrote, it also needs an (impossible) https-redir. "Best" you could do is to trigger some error messages from browser, regarding invalid cert. But this frightens the user even more.
So just to ignore https here only viable solution.

reinerotto

There was (still is ?) a function for regular adverts (via REDIRs) available, for MT-hotspots. However, this was/is not a solution for wide production use, as it does a REDIR simply time-based. Which disturbes the rendering of a web page just being requested. (Browser must request multiple objects t...

reinerotto

goggle for "squid cache"

reinerotto

In general, you will _never_ be able to reliably redirect HTTPS (for purpose of Captive Portal CP or anything else), unless you are able to install special certificate on the users device. Which is not possible for a public hotspot. This is just a feature of HTTPS, especially designed to inhibit suc...

reinerotto

Yes. I did this already several times for various clients, but based on openwrt/LEDE-devices as hotspots.
As I wrote here already:: For more than basic requirements for hotspots, MT is _NOT_ the best platform.
For commercial help, you can contact me: augustus_meyerATyahoo.de

reinerotto

ivicask gave the simplest and most complete solution to the problem. Also works for https-sites, of course.

reinerotto

>Regarding using mac address instead of IP would not solve anything.. .< No. Because it depends upon, how to use the MAC. ALmost 2 years ago I did a commercial parental control device (AP/router) on openwrt, based on MAC-control. And DNS-hijacking. Unknown MACs have everything blocked, so faking the...

reinerotto

>Is there a way to "fool" the CNA to "think" the user has internet access and display "Done" so when Captive window is closed, the device stays connected to our Hotspot?< Yes. _But_ I dunno, how to do it on MT, as it is closed. So, no surprise, you got no other response...

reinerotto

wifibus.com.mx Why to block the path to evolution, by starting too limited ? You might convince the client about alternative hw, and its possibilities. I.e. we also do GPS tracking of busses,of course. And, I do not know cost structure of 3g/4g in your area, but it might be quite expensive. So the u...

reinerotto

Same idea here. Hotspot redirects to a page (without user/pass) and serves the first video that must be seen complete. Then, redirects to free web. We do much more: Local server to serve real movies, music, simple games, local news etc. from web-site within device. For entertainment of user (to sav...

reinerotto

I have more than 1000 routers moving on vehicles serving as hotspot. They're connected to 4G. I need to periodically (say, every hour) read the uptime, traffic consumption, clients connected, know if Did that for public transport system in big Mexican city. Using openwrt-based devices, also deliver...

reinerotto

>and then after login immediately shut down< This happens on new Android devices automatically, because the mini-browser closes the window, as soon as web access granted. Same for Windows-mobile. Some possible workarounds for this behaviour, but not on MT. Needs smarter (or more open) hotspot system...

reinerotto

So sorry, mixed up with this one:
>Forcepoint strips of https certificate, looks at were you go and allow/block session. If it allows session it uses the real cert from the site you are visiting.<

reinerotto

Both methods require to install custom root CA cert on the clients. Again, in case you want to filter/log certain _hostnames_ (_NOT_ complete URLs) or IPs, you do _NOT_ need to install the certificate for https. Exactly, what I did for a special router (openwrt/LEDE) for parental control. Which is ...

reinerotto

The only thing you'll get with HTTPS [edit: if you're explicitly proxying it] is the hostname that the connection was proxied to

I have to disagree here. You can get the same info for transparently proxied https, using squid.
However, configuring "splice/bump" for this is non-trivial.

reinerotto

Not 100% correct.
squid (open source) can do the same. So, in open Linux environments (also on openwrt/LEDE), this can be done without separate product.

reinerotto

>how can i force the devices to open safari, chrome or firefox instead of microbrowsers< You can not. As it is a functionality of the users device. However, you can switch to the philosophy, that user has to _explicitly_ open the browser to connect to the WiFi. _And_ you need to fake the internet co...

reinerotto

@cpctech: Yes, setup is the most suitable, and simplest. @troffasky: "You aren't going to get any caching or a lot of useful info from Squid about HTTPS sites without MITM." No caching effect without MITM, correct. Amd this setup is for (very) advanced users. However, useful info from http...

reinerotto

To fulfill clients prio #1 simplest and best is to set up an intermediate caching proxy with logging for the whole network. Old PC running LINUX+squid reduces required bandwidth (because of cache) and provides extensive logging of user activities on http and https.Various log analyzers for squid log...

reinerotto

Own DNS-server makes sense. However, BIND is overkill for what you want to achieve.
dnsmasq will do the job; much easier to configure.

reinerotto

The last thing I'll leave you with, you may need to look at DNS based blocking from a provider like OpenDNS if you can't install a device that MITM's SSL.

Agreed. However, you also have the option to do DNS-based blocking yourself.

reinerotto

You have the best solution, possible on mikrotik. However, very best solution can be done on open (openwrt/LEDE) hotspot systems. I.g. it means, to filter (or to fake) the internet-connection probes by iOs, WP, Android. Your issue is one more confirmation for my decision, to drop MT for hotspots wit...

reinerotto

Only correct, when you talk about mikrotik.
I did a (better) clone of openDNS on an average ubuntu server, blocking about 1.2Mio porno sites.
Theoretically, could be done on MT, too. In case, it were open (for mods).

reinerotto

best router for hotspot is based on openwrt/LEDE. As youhave (almost) all possibilities of linux packages available. I.e. you can integrate full featured caching proxy like squid. Or captive portal like coova-chilli. miktotiks have similar functionalities, but closed and more limited. But are easier...

reinerotto

1) How to send PM here ?
2) Some people are willing to compensate for " Best Know-How". Or for better functions/higher quality.
3) Quite a few "leechers" on various forums, to get financial advantages from free high-quality advice.

reinerotto

You can just read this post:
viewtopic.php?f=13&t=125057

Which is for free, too, and much smarter than your contribution.
However, no continous (streaming) solutions.
As you get, what you pay for.

reinerotto

Yes; not a big deal. In case you can use openWRT, at least, as it is much more flexible. In plain words: open in its features. Did it for two clients already; right now for a third one in South America. As I do coding, incl. firmware, for a living. However, there are some limitations to the interpre...

reinerotto

DMA Radius (based on free radius) is not able to do this. I am wondering. The limitations is RoS, I strongly suspect. As Radius can control a lot of various quota policy. You are another example, that RoS is not the best choice for hotspots with special requirements. openwrt/LEDE + freeradius backe...

reinerotto

I wanted to write: Use proxy, like squid. However, in case the user opens https-tunnel, or uses VPN, then ...

reinerotto

Can you give an example, where a porn hosting website would also have family oriented pages on the same domain :) ? The problem is usually not that, but there are indeed cases where some people want to block "part of a site". E.g. some site that offers games (that are seen as unwanted, e....

reinerotto

Because of the costs of openDNS for commecial use, but the necessity of filtering the access to public, open hotspots of a client, I did a "worst case" DNS-server, considering several blocklists, most of all porn, of course, but also gambling etc. So no special consideration of age-ranges...

reinerotto

Because of the costs of openDNS for commecial use, but the necessity of filtering the access to public, open hotspots of a client, I did a "worst case" DNS-server, considering several blocklists, most of all porn, of course, but also gambling etc. So no special consideration of age-ranges,...

reinerotto

Doing fb-login with large hotspot provider, haven't heard of this issue. Not using MT, though, but openwrt-based solution. With special backend for auth.
Did you contact fb already, to get the reason for the "temp locked" ?

reinerotto

To use it for business purposes it is formally required to ask them for a quote for a paid account. And it is very expensive (I tried).

And that is the reason, I developed a simple clone of openDNS for a hotspot provider. With custom "Blocked !" page, of course

reinerotto

Hi, Previously Mikrotik had a feature called advertisement in HotSpot, which is obsolete in latest ROS versions. Any suggestions? I remember this RoS-feature. After first usage, few years ago, I recognized the pitfalls, as it was not good enough for real production use. As it might interrupt the re...

reinerotto

This is typical task for a (free-)radius server as backend. Dunno how to interface to RoS, though. openwrt/LEDE is better suited to special hotspot configs, like this one.

reinerotto

CCR-support on openwrt/LEDE looks unreliable to me, far from production stability. However, you hit an interesting feature. Having developed a lot of different firmware for special purpose hotspots/routers (incl. parental control, social login, access logging, local content distribution etc.) on var...

reinerotto

Depending upon number of hotspots required, I might consider some special development using openwrt/LEDE. Which _might_ even run on certain mikrotiks.
Which MTs are you using ?

reinerotto

>several hotspot rules were added dynamically on top of the list!< This is normal for Captive Portals to work. However, sequence of rules depends upon sequence of module activitation (custom rules, rules fom captive portal) Which is obvious in open systems, like openwrt/LEDE; but _NOT_ in RoS, becau...

reinerotto

Dunno on MT. openwrt/LEDE-based hotspots (incl. coova-chilli) do not have your problem. And may solve a few more sophisticated issues (i.e. site/url-logging).

reinerotto

1)It seems that at some point the mikrotik or radius (who releases the ip) after a while seems to end the ip, I increased the time lease but the problem persists as I can do it? Sounds like session terminated by radius. because of inactivity, or session too long 2)Is there a script that allows me to...

reinerotto

Add an external squid Proxy. Or use openwrt/LEDE based router/hotspot, incl. squid.

reinerotto

Agreed.
Thats the reason, I left RoS for development of special purpose WiFi devices (routers), like for integration of parental control or similar.
_OR_ simply better hotspot functionality.

reinerotto

I do not remember, sorry. Although I am on upwork, too, several completed projects are on freelancer.
Allso containing, what you still want to achieve. Both UBT and MT are the wrong tools for that.

reinerotto

Yes.
I have hotspots, delivering local content only. But these are based on openwrt/LEDE.
Which contain such a special feature you are looking for

However, own developed firmware.
MT is too closed for such advanced features.

reinerotto

- Automatic popup/captive window after connect to the HS (each time you connect to this HS) This is standard, but ... - this redirected page has to be opened in native webbrowser (Safari, Chrome,.. ) not on "lightweight login Browser window" Here is the problem: Some OS (certain Android ve...

reinerotto

Injection of content into 3rd party pages can help in funding free hotspots. You are correct, that there _might_ be interference, but only in case of extremely dynamic (tricky) sites.. Which need to be blacklisted.
MTs 'interstetials' are much more risky regarding disturbance of 3rd party sites.

reinerotto

In principal, YES, there is. I developed some commercial software to do 'injection of content' into HTML, on-the-fly, using a proxy (http only).
A common usage scenario is the injection of ads, typically overlays, by means of injected JS.
In case of interest, contact me augustus_meyerATyahoo.com

reinerotto

Instead of messing around with this one >...you can disrupt the connection before SSL is fully negotiated. certificate exchange takes place "in cleartext", < on MT on low level, similar can be done in a clean way using squids https interception. Which also allows to block facebook etc. How...

reinerotto

You can _not_ detect inline-malware, like injected javascript, using DNS.
You _could_ keep privacy using local intercepting https proxy.
But, privacy (read: protection) of advertisers is the crucial issue here.

reinerotto

There are pros and conns to SSL intercept. I.e. SSL-intercept could be useful to better detect malware. Or to do parental control more refined.
Or to do better ad blocking. Which, I guess, is the main reason, quite a few "browser vendors" try hard to make this impossible.

reinerotto

Yes, that is part of the story.

reinerotto

Nobody tried this or there is no solution for this kind of parental control?

I did a (commercial) clone of openDNS. Which also can be tailored for individual MACs. However, needs private server, and special router (non-MT; but openwrt/LEDE)

reinerotto

>I wouldn't be surprised if Squid supports this.< You are correct in some sense. Using squid, it is possible to determine the target domain/IP of the SSL session, without installation of special certs in the clients. However, a bit tricky. And _NOT_ possible to see the full URL, domain only. Install...

reinerotto

>the Facebook logon page is launched in the mobile phone's browser instead of in the Facebook app. Most people, myself included, don't have my Facebook credentials stored in my mobile phone's browser so people simply click on the "Skip logon" link which defeats the object of the system.< Y...

reinerotto

This is so called 'Like-Gating'. Which is prohibited since end of 2015 by facebook. Unless fb explicitly grants this right to your app. Which is very unlikely, but you can try. However, it is allowed to ask for a like. But user may refuse. Login via fb I can only setup using special backend server, ...

reinerotto

>why Mikrotik keep holding this option< Marketing argument. It works "in principal". However, not good enough for production with _many_ users, as number of complaints will increase. Better alternative: I have a few, depending upon requirements. However, I make my living from "good kn...

reinerotto

Depends upon the device and what you need. You can squeeze openwrt, for example, just by installing necessary packages (SW).
Then you will need to build your own image, for real downsizing.
Not all MTs run openrwrt, BTW.
openwrt is open, RoS is not.
openwrt the best choice for hotspots, for example.

reinerotto

Worked for me in the past, but then I dropped usage. As not a good solution for production. There are btter alternatives.
Anyway: You need to do active browsing. When the timer for advertisements expires, it will redirect you, when navifating to another URL.
Simple wait will not work

reinerotto

Addendum to my previous post http://forum.mikrotik.com/viewtopic.php?f=7&t=108527
We might offer the WLAN-contract also to foreign partners. A charity org always has low budget

reinerotto

As technical consultant for an international charity org, also active in several refugee camps in Greece, I am looking for contacts with WISPs, which can establish PtP-WAN-connections to the camps or setup WLANs within the camps. However, this will be two separate contracts. For the largest camp we ...

reinerotto

Hi, I have a contact in Mexico, who just did that also for MT. Send me a mail, to augustus_meyer@ahoo.de, so I can forward you. Note: facebook does not allow (any more) "Like-Gating", which means, forcing the user to give a "Like" before receiving some service. However, is is pos...

reinerotto

Don't know pfsense in detail. However, you might also install the squid-box (or pfsense ?) inbetween the MTs.
Then you can use the easy solution for your hotspot users, at least.
squid-box could be old/simple ubuntu-PC (or your netbook) , with lot of RAM (fastest cache

and (fast) HDD, 2 NICs.

reinerotto

In general, installation of HTTP-intercepting squid is simple in any standard LINUX environment, as it only needs an iptables-rule to REDirect http-traffic to squid on same machine. In case, squid runs on another PC (NOT the one with the iptables-rule) it is more difficult. So, in your case, having ...

reinerotto

You are wright, VPN is an alternative.
Did not think about it that time

reinerotto

Yes. For a customer, having very similar problem, I developed a solution using email, to signal "valid IP" to server running squid. In case of interest, consider a project on "freelancer.com". And let me know

reinerotto

>you get opened browser with login page<
Which is triggered by the browser OR OS-dependent activities in case of successful connection to WiFi, like Apple or MS or Android do.

reinerotto

Caching DNS-server (like dnsmasq) and a caching proxy (like squid). There are some solutions around to cache youtube with squid.

reinerotto

Hi, I came across this thread as trying to find a minimum 16mb flash & 64mb RAM router with USB & 2.4ghz wifi we can install WRT on. There are a lot of different devices available, meeting your specs. I have done mods to OM2Ps FW (r481) and programmed different openwrt-devices (various TP-L...

reinerotto

Transp proxy should also work, in case "specific host" has fixed IP, and you only redirect its traffic.
Otherwise, you need to redirect evething to proxy, and then deny access/display message for "specific hosts" domain.

reinerotto

Use a real proxy, like squid, on a separate box.

reinerotto

Using radius-CoA you can command a redirect from the server. Question is, whether client (Mikrotik) supports it.

reinerotto

Search found 523 matches