I recently setup a wireless/wired network for a hotel to be used by
about 75 guests.  It was simply a matter of daisy chaining a few
Netgear switches (JFS516) from the ISP's DSL modem/router and then
connecting a few Netgear Access points (WG602) with alternating
channels on each floor (one per floor). DHCP is controlled by the
router.  Everything worked great.  However, now the hotel has
requested that the network be upgraded to do the following:

- Provide a central firewall - I figured that this can be done at the
ISP's router level.  But I may not have access to the router
administration to change the settings.  My assumption is that if the
router has a firewall it will be on by default.

- Terms of Service Page - When guests try to access the Internet they
want them to be directed to a Terms and Conditions page that guests
must accept BEFORE they can gain access to the internet. I'm assuming
that if they decline the Terms and Conditions they would not be
allowed access.

- A Start Page - After the Terms and Conditions are accepted by the
guest they will be redirected to the hotel's URL on the Internet.

My Findings and Questions:

I've been asking around but have not been able to get a complete
explanation on how to do this.  I've received a few suggestions that a
proxy server should do the trick but,if that is the case,how do I
configure it to push all internet requests to the Terms and Conditions
page and redirecttion to the Start Page URL?  Will the conditions of
the Terms and Conditions page require some sort of script to allow or
decline access to the Internet? What hardware/Software products are
available to accomplish this as easily as possible?

I'm pretty good at computer networking and this is a little above my
head but if someone explains it clearly I'm sure I'll be able to
figure it out.  I have some HTML skills but no programming skills.

Thanks!

Hi, 

I am a little sort on time at the moment, so I can't put in the time
to research all of this right now, but I'll tell you what I've done in
a similar situation in the past (from memory).

Basically a proxy server (specifically Squid -
http://www.squid-cache.org/ ) was configured so that all requests that
did not contain a certain cookie were redirected to an internal
webpage (a simple PHP script) that would, in this case, take user
credientials and then modify an 'allow' config file to allow proper
web access. Our system was quite complex as login affected DHCP and
routing settings but it would be easy enough to make the allow list
work for 24-hours or something, before requiring a re-approval.


In this case I would have that internal webpage display the terms you
are talking about, and then once accepted it would change the IP list
and redirect the visitor to the hotel's website and pass the
originally requested URL as well, so that the website would be in a
frame that displays at the top "Continue to http://www.whatever.com/"
in a similar way to the frames on Google Image searches or About.com
links.

Here is a tutorial on configuring a Linux-based transparent proxy:
http://www.faqs.org/docs/Linux-mini/TransparentProxy.html

Here is the Squid documentation on ACLs:
http://www.deckle.co.za/squid-users-guide/Access_Control_and_Access_Control_Operators#Source.2FDestination_IP_address

And this page may help:
http://www.visolve.com/squid/whitepapers/redirector.php

If Squid is a little complicated (which it can be), Apache's Mod Proxy
may be a little more userfriendly...

http://httpd.apache.org/docs/2.0/mod/mod_proxy.html

Regards,
Sycophant