it is 32bit very old machine (P133, 64MB...) with a Debian Leny.
It should be my mistake with the configuration or I'm missing something, but I cannot figure out what is it.
In chilli.conf I have:
# TUN parameters
net 192.168.1.0/24
dynip 192.168.1.128/25
statip 192.168.1.0/25
dns1 dns1.ip
dns2 dns2.ip
domain key.chillispot.info
# Radius parameters
radiusserver1 127.0.0.1
radiusserver2 127.0.0.1
radiussecret theradiussecret
# DHCP Parameters
dhcpif rausb0
# Universal access method (UAM) parameters
uamserver https://192.168.1.1/cgi-bin/hotspotlogin.cgi
uamhomepage http://192.168.1.1/
uamsecret theuamsecret
#uamlisten 192.168.1.1
uamallowed dns1.ip,dns2.ip,192.168.1.1
uamanydns
# MAC authentication
macauth
macallowed 00-11-22-33-44-55
macpasswd MySecretPassword
The firewall rules looks like:
IPTABLES="/sbin/iptables"
EXTIF="ppp0"
INTIF="rausb0"
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#Allow releated, established and ssh on $EXTIF. Reject everything else.
#$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -j REJECT
#Allow related and established from $INTIF. Drop everything else.
$IPTABLES -A INPUT -i $INTIF -j DROP
#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 53 --syn -j ACCEPT #< No difference with and without this line
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
#Allow 3990 on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT
#Allow everything on loopback interface.
$IPTABLES -A INPUT -i lo -j ACCEPT
# Drop everything to and from $INTIF (forward)
# This means that access points can only be managed from ChilliSpot
$IPTABLES -A FORWARD -i $INTIF -j DROP
$IPTABLES -A FORWARD -o $INTIF -j DROP
#Enable NAT on output device
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#PPP Bug
$IPTABLES -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1421:65535 -j TCPMSS --clamp-mss-to-pmtu #<= It is the same with and without this line
