Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We (the tech I work with and myself) live in a remote northern town where Internet access is somewhat of a luxury, and bandwidth is quite limited. Here, overage charges ranging from few hundreds, to few thousands of dollars a month, is not uncommon. I myself incur regular monthly charges just through my regular Internet usage at home (I am allowed 10G for $60CAD!)

As part of my work, I have found myself involved with several hotels that are feeling this. I know that I can come up with something to solve this problem, but I am relatively new to system administration and I don't want my dreams to overcome reality.

So, I pass these ideas on to you, those with much more experience than I, in hopes you will share some of your thoughts and concerns.

This system must be cost effective, yes the charges are high here, but the trust in technology is the lowest I've ever seen.

  • Must be capable of helping client reduce their usage (squid)
  • Allow a limited (throughput and total usage) amount of free Internet, as this is often franchise policy.
  • Allow a user to track their bandwidth usage
  • Allow (optional) higher speed and/or usage for an additional charge. This fee can be obtained at the front desk on checkout and should not require the use of PayPal or Credit Card.
  • Unfortunately some franchises have ridiculous policies that require the use of a
    third party remote service to authenticate guests to your network. This means WPA is out, and it also means that I do not auth before Internet usage, that will be their job. However, I do require the ABILITY to perform authentication for Internet access if a hotel does not have this policy. I will still have to track bandwidth (under a guest account by default) and provide the same limiting, however the guest often will require a complete 'unlimited' access, in terms of existence, not throughput.
  • Provide firewalling capabilities for hotels that have nothing, Office, and Guest network segregation (some of these guys are running their office on the guest network, with no encryption, and a simple TOS to get on!)
  • Prevent guests from connecting to other guests, however provide a means to allow this to happen. IE. Each guest connects to a page and allows the other guest, this writes a iptables rule (with python-netfilter) and allows two rooms to play a game, for instance.

My thoughts on how to implement this. One decent box (we'll call it a router now) with a lot of ram, and 3 NIC's:

  1. Internet
  2. Office
  3. Guests (AP's + In Room Ethernet)

Router Firewall Rules

  • Guest can talk to router only, through which they are routed to where they need to go, including Internet services.
  • Office can be used to bridge Office to Internet if an existing solution is not in place, otherwise, it simply works for a network accessible web (webmin+python-webmin?) interface.

Router Software:

  • OpenVZ provides virtualization for a few services I don't really trust. Squid, FreeRADIUS and Apache. The only service directly accessible to guests is Apache.
  • Apache has mod_wsgi and django, because I can write quickly using django and my needs are low. It also potentially has the FreeRADIUS mod, but there seems to be some caveats with this.
  • Firewall rules are handled on the router with iptables.
  • Webmin (or a custom django app maybe) provides abstracted control over any features that the staff may need to access.
  • Python, if you haven't guessed it's the language I feel most comfortable in, and I use it for almost everything.

And finally, has this been done, is it a overly massive project not worth taking on for one guy, and/or is there some tools I'm missing that could be making my life easier?

For the record, I am fairly good with Python, but not very familiar with many other languages (I can struggle through PHP, it's a cosmetic issue there). I am also an avid linux user, and comfortable with config files and command line.

Thank you for your time, I look forward to reading your responses.

Edit: My apologies if this is not a Q&A in the sense that some were expecting, I'm just looking for ideas and to make sure I'm not trying to do something that's been done. I'm looking at pfSense now as a possible start for what I need.

share|improve this question
I'm having trouble working out what your question is. I see some complaints and some ideas but what are you actually after? This is after all a Q&A site, not a discussion forum. – John Gardeniers Feb 17 '10 at 8:55
I apologize for being unclear, the problem is I'm not asking a very specific question. I'm not saying "I've got two computers, I did this, it should work, its not". I'm looking for advice on a much higher level. Before I knew about FreeRADIUS for instance, a good response could be "For tracking those users, and being able to bill them, have a look at FreeRADIUS". Another thread regarding bandwidth restrictions for a roommate tipped me off to pfSense, which seems to offer a great deal of control, and might be very useful to me. I also want to avoid reinventing the wheel. – Anthony Hiscox Feb 17 '10 at 9:05
I'm wondering what's the significance of 'remote northern town'. Would you reject a solution which worked in a 'remote southern town' ? – pavium Feb 17 '10 at 9:54
If the phone lines aren't big enough, then why not satellite internet such as wildblue or hughesnet ? – Paul Feb 17 '10 at 10:22
There is no significance to where I live, besides the fact it's where I live. Saying that myself and someone else live in the remote south would have been lying. Of course I won't reject any ideas or solutions if they will help us. I will check with the other tech on the sat issue, my guess is that will be something hard to sell. – Anthony Hiscox Feb 17 '10 at 11:25

After looking at the pfSense project now, I think it will provide a lot of what I need with a bit of configurations. It supports Captive Portal, and does this with Radius servers, can be setup with Squid for transparent proxying, and seems like it has a LOT of control over the traffic. I'm still open to any more ideas that may help. Thanks!

share|improve this answer

Random thoughts:

  • First, start with a network diagram. Don't worry about firing up Visio; just draw one on paper. Once you figure out where to start, repost some specific questions here. This posting is way too dense. Making it bite-sized will get you better, more thoughtful answers that address specific questions.

  • "Prevent guests from connecting to other guests..." You're not going to be able to do this at the firewall because everyone is on the same, internal LAN. You'll have to do it at the switch, so you'll need to get a managed (smart) switch.

  • Python is the ideal language for something like this. Don't worry about not knowing PHP. PHP is not the right language. PHP is never the right language. For anything.

  • You're not going to want to maintain your iptables rules by hand unless you're masochistic. Look into using Shorewall instead. It's simply a thin configuration layer on top of iptables that makes it much easier to manage.

share|improve this answer
I will consider doing a diagram, but this is a bit difficult as I need to be flexible for a few different network setups. The other tech is currently looking at a 48 port PoE injecting switch I believe it is managed. +1 Python -1 PHP, good. I mentioned it because of things like: PHPMyPrepaid, which the other tech suggested I look into. I agree, I did consider either Firehol or Shorewall, I will look into this more. I am now reading about pfSense, it looks like it might be a step in the right direction. Cheers. – Anthony Hiscox Feb 17 '10 at 8:57
-1 for saying PHP is not good for anything. I'd agree that PHP is usually not the right choice if you had put it even a little bit less strongly, this is just fanboy behavior. Edit: Additionally, I do use iptables and they work great for my purposes so far. Not sure how well Shorewall runs on Android but iptables works just fine thank you. – Luc Jul 1 '13 at 19:10

There are ready made installs for providing the kind of service that you are talking about. Usually a mini-itx system with the OS already setup on compact flash. Often giving you the option between free access and a payment system that works across APs at many different locations. I'm assuming you are from Canada but I only know specific examples that are for Britain.

share|improve this answer
Would knowing the name allow me any more insight into how they do it? If so, I would still like to look into it. – Anthony Hiscox Feb 17 '10 at 11:21
I should note, having an option between paid and free won't work. I need free, but also paid. Free Internet access is something that MANY franchises implement across their hotels, and it's a requirement we can't just do away with because we're remote. So there always has to be a free level of Internet provided. How much that means a user gets to use, is up to our discretion. Essentially we want heavy users to pay like we do, and light users still get everything for free. – Anthony Hiscox Feb 17 '10 at 11:29

A Mikrotik Hotspot will do everything you have listed. You should be able to run each location off a 450G or similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.