Packet filter rules
From /ip firewall filter print dynamic command, you can get something like this (comments
follow after each of the rules):
Any packet that traverse the router from unauthorized client will be sent to the hs-unauth chain.
The hs-unauth implements the IP-based Walled Garden filter.
Everything that comes to clients through the router, gets redirected to another chain, called
hs-unauth-to. This chain should reject unauthorized requests to the clients
Everything that comes from clients to the router itself, gets to another chain, called hs-input.
Allow client access to the local authentication and proxy services (as described earlier)
All other traffic from unauthorized clients to the router itself will be treated the same way as the
traffic traversing the routers
Unlike NAT table where only TCP-protocol related Walled Garden entries were added, in the
packet filter hs-unauth chain is added everything you have set in the /ip hotspot walled-garden ip
menu. That is why although you have seen only one entry in the NAT table, there are two rules
here.
Everything else that has not been while-listed by the Walled Garden will be rejected. Note usage of
TCP Reset for rejecting TCP connections.
Reject all packets to the clients with ICMP reject message
Customizing HotSpot: HTTP Servlet Pages
Description
You can create a completely different set of servlet pages for each HotSpot server you have,
specifying the directory it will be stored in html-directory property of a HotSpot server profile (/ip
hotspot profile). The default servlet pages are copied in the directory of your choice right after you
create the profile. This directory can be accessed by connecting to the router with an FTP client.
You can modify the pages as you like using the information from this section of the manual.
Available Servlet Pages
Main HTML servlet pages, which are shown to user:
•
redirect.html - redirects user to another url (for example, to login page)
•
login.html - login page shown to a user to ask for username and password. This page may take
the following parameters:
• username - username
• password - either plain-text password (in case of PAP authentication) or MD5 hash of chap-id
variable, password and CHAP challenge (in case of CHAP authentication)
• dst - original URL requested before the redirect. This will be opened on successfull login
• popup - whether to pop-up a status window on successfull login
Page 519 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
