from the
dd-wrt wiki:
Creating A FirewallThere's one optional, but HIGHLY recommmended thing you should do before advertising the Hotspot. As it stands, anyone connected to the hotspot SSID will have full access to the whole 192.168.X.X network including your router's web admin page. To stop this you need to add the below code to the firewall. Do this by pasting the into the box on the Admin > Commands page and hitting Save Firewall.
The main lines controlling which addresses are avilable are the "iptables -t nat -I PREROUTING -i tun0 -d xxx.xxx.xxx.xxx/xx -j DROP" lines. The first (with nvram get lines) automatically gets your router's local address and blocks access to that and all it's clients. The others can be removed if you so wish, but as they stand will block access to all privately used IP addresses. You must keep the ...192.168.182.1/32 -j ACCEPT rule in to allow the hotspot clients to access the Chillispot server.
PPPOE users should add the MTU bugfix line below the first two "##"'s. see below
The script also contains a commented part that limit the speed of any uploads or download on the hotspot SSID. These can be altered by changing the numbers after DOWNLINK and UPLINK, currently set a 1 Mbps down and 256 Kbps up.
Note that bandwidth is controlled per user in the worldspot access profile. This is why I commented this part. If you still wish an overall bandwidth limit, please uncomment the last part.
#!/bin/sh
##
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j logdrop
# secure access to local addresses other than chillispot
iptables -A FORWARD -i tun0 -j DROP;
iptables -t nat -I PREROUTING -i tun0 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 192.168.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 169.254.0.0/16 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 172.16.0.0/12 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 10.0.0.0/8 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 192.168.182.1/32 -j ACCEPT
##bandwidth limitation for all hotspot users.
##uncomment below to activate
#DEV="tun0"
#DOWNLINK="1024"
#UPLINK="256"
#
#tc qdisc del dev $DEV root
#tc qdisc del dev $DEV ingress
#
## limit download
#tc qdisc add dev $DEV root handle 1: htb
#tc class add dev $DEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbit burst 6k
#tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.182.1/24 flowid 1:1
#
## limit upload
#tc qdisc add dev $DEV ingress handle ffff:
#tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k drop flowid :1
For PPPOE users:There is a bug in Chillispot that causes connection problems to websites (specifically https and larger domains) while using a PPPOE connection from the DD-WRT router with an MTU other than the default Ethernet value of 1500. PPPOE users can find thier current MTU setting by checking the Setup > Basic Setup tab of the DD-WRT web config pages under Optional Settings then MTU. PPPOE users therefore MUST use the following fix to enable Chillispot to function correctly. This does not apply if you have a seperate modem that connects to the net using PPPOE but then connects to the rest of your network (eg. your dd-wrt router) using a regular local IP address.
In the web config pages, go to Administration > Commands and paste the following code in to the Command Shell box, then click Save Firewall. If there is already a Firewall box with text present then click Edit under the Firewall box and add the code to the top of the Command Shell box, replacing only any #!/bin/sh text already present and leaving the rest intact.
#!/bin/sh
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1452:65535 -j TCPMSS --clamp-mss-to-pmtu
NOTE: If your MTU is different from 1492, you must replace the 1452 in the above code with your current MTU value, minus 40. Eg: If your MTU is 1362, replace the 1452 in the code with 1322 (that's 1362 - 40).
