Mastodawn

Here's Yomiko-in-a-Box! I hope at least a few of the 26 hits I had at #Anthrocon were entertained. It's a Raspberry Pi 5 providing a captive portal--the thing makes your phone pop up a web page that asks you to click "Agree" for free WiFi--except instead of getting internet access, you get a gallery of foxgirl art.

Show thread

Min @ Anthrocon 7h ago

There are tutorials out there on how to set up a captive portal on an RPi, like this one: https://pimylifeup.com/raspberry-pi-captive-portal/

But there is a problem that nobody seems to acknowledge about using an RPi as a WiFi access point: they all use NetworkManager for configuring the wireless interface, and nmcli is not capable of setting hardware flags for controlling capabilities and channel selection on WiFi devices in AP mode. This means your AP is limited to 802.11g speeds! That sucks.

The solution to this problem is a lot more involved. You can use hostapd to configure hardware flags on your access point, but it doesn't play nice with nmcli; you also have to install ifupdown for bringing your wireless interface up.

You also need to provide DNS and DHCP to clients that connect to your AP, which NetworkManager would automatically do for us if we were using that, but I'm not, so I also installed dnsmasq and manually configured it to assign IP addresses in the appropriate range.

The real magic here is then done by nodogsplash, which is what provides a captive portal that can be detected by connecting devices. It does so by intercepting DNS request that would be sent to dnsmasq, and if they would resolve to an external IP address, it redirects them to the local gateway (the RPi) and returns some specially-formatted data that clients interpret to mean that they need to display a login page.

This is where I got stuck for a while: nodogsplash requires the network gateway to be the same as the IP address it's running on, but ifupdown won't let you set a device's gateway to its own IP! I ended up modifying dnsmasq's configuration so that it would set a flag to clients telling them to use the Pi as their gateway even though that's not what's actually configured on the Pi's interface.

But then I ran into a second problem: nodogsplash works by proxying DNS requests to dnsmasq, but it would not return responses to clients at all if it didn't get responses from dnsmasq. In other words, if the Pi did not actually have an internet connection and had no gateway through which it could send DNS requests, dnsmasq would just refuse to return anything, which in turn made nodogsplash not return anything and the captive portal would never come up!

The fix was that I found another way in dnsmasq's configuration to rewrite all DNS requests that should be sent out externally to instead return a fixed IP address (itself). While this makes the system unusable as an actual internet portal, it does mean that now nodogsplash gets a response from it, then can instruct clients to pop up a "login" page.

And once that was working, I just made a quick and dirty static gallery using Vue/Vuetify and dropped that in the direct directory, so visitors are now forced to look at foxgirls.

Nice and simple!