check my firewall setup on my openwrt chillispot box
IT WORKS FOR ME!!! when the user expired, it close all ports! specially ssh

====================================
=             filename: /etc/init.d/S45firewal                   =
=                                                                            =
====================================
#!/bin/sh

## Please make changes in /etc/firewall.user
${FAILSAFE:+exit}

. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)

## CLEAR TABLES
for T in filter nat; do
  iptables -t $T -F
  iptables -t $T -X
done

iptables -N input_rule
iptables -N output_rule
iptables -N forwarding_rule

iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule

### INPUT
###  (connections with the router as destination)

  # base case
  iptables -P INPUT DROP
  iptables -A INPUT -m state --state INVALID -j DROP
  iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j  DROP

  #
  # insert accept rule or to jump to new accept-check table here
  #
  iptables -A INPUT -j input_rule

  # allow
  iptables -A INPUT -i \! $WAN  -j ACCEPT       # allow from lan/wifi interfaces
  #iptables -A INPUT -p icmp     -j ACCEPT       # allow ICM
  iptables -A INPUT -p gre      -j ACCEPT       # allow GRE

  # reject (what to do with anything not allowed earlier)
  iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
  #iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
### OUTPUT
### (connections with the router as source)

  # base case
  iptables -P OUTPUT DROP
  iptables -A OUTPUT -m state --state INVALID -j DROP
  iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

  #
  # insert accept rule or to jump to new accept-check table here
  #
  iptables -A OUTPUT -j output_rule

  # allow
  iptables -A OUTPUT -j ACCEPT          #allow everything out

  # reject (what to do with anything not allowed earlier)
  iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
  iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable

### FORWARDING
### (connections routed through the router)

  # base case
  iptables -P FORWARD DROP
  iptables -A FORWARD -m state --state INVALID -j DROP
  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

  #
  # insert accept rule or to jump to new accept-check table here
  #
  iptables -A FORWARD -j forwarding_rule

  # allow
  iptables -A FORWARD -i br0 -o br0 -j ACCEPT
  iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT

  # reject (what to do with anything not allowed earlier)
  # uses the default -P DROP

### MASQ
  iptables -t nat -A PREROUTING -j prerouting_rule
  iptables -t nat -A POSTROUTING -j postrouting_rule
  iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

## USER RULES
[ -f /etc/firewall.user ] && . /etc/firewall.user

===================================
=                                                                          =
=  filename:/etc/firewall/ssh                                    =
===================================

#!/bin/sh
. /etc/functions.sh

WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)

iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT
iptables        -A input_rule      -i $WAN -p tcp --dport 22 -j ACCEPT

To allow access to secure websites (such as https://www.example.com/), you must open port 443, as well.

iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT

Try to enable packet forwarding you should add the following line in /etc/sysctl.conf

net/ipv4/ip_forward=1

then restart your network /etc/init.d/networking restart

in addition to my posted opinion:

as you said you are using squid. Try to remove your SQUID as transparent proxy in your server, because i think user can easily bypass Chillispot login page. if they specify server's IP address (for example 192.168.182.1) in to there BROWSER proxy setting  to HTTP proxy input and the port (usually 3128), user do not need to login to access/browse the internet.

YES of course! try to execute this command on your mysql

SELECT SUM(AcctInputOctets) AS total_upload, SUM(AcctOutputOctets) AS total_download FROM radacct WHERE UserName='$username'

to the total of your download upload while online....

Good luck!

YES....
specify IP address with same block as your chilli box ip.... and your gateway should be the the ip of your chilli box