3

I have a Linux box operating as router. There's a NIC that's connected to the internet (WAN), a NIC connected to an 8-port GbE switch (LAN), and a NIC connected to a Linksys wireless N-router (WLAN). Routing between everything is working perfectly.

I have security completely disabled on the wireless router, but the WLAN NIC is firewalled such that it will only accept DNS queries and PPTP VPN connections. Currently HTTP/HTTPS traffic and everything else is blocked.

I would like to run something that listens on port 80/443 of the WLAN NIC, and, for non VPN'ed connections, given any HTTP/HTTPS request it will return a single webpage saying "Unauthenticated" and explain how to sign into the VPN. A transparent proxy seems to be what I need, but my searches all seem to direct me to Squid, which is already running on my server and seems overkill for this simple task.

Is there a simpler, lightweight program out there that does just this or should I just suck it up and run two instances of Squid (or figure out how to configure it)?

Or, is this entire VPN thing I'm doing complete nonsense and I should just enable encryption on the wireless router?

Improve this question
1
  • HTTP should be easy. The problem with HTTPS is that users are going to get certificate errors
    – Zoredache
    Mar 14, 2010 at 23:01

5 Answers 5

Reset to default
1

No need to install any fancy HTTP server, proxy or Perl module as long as you have netcat and a shell:

$ while true ; do (echo -e 'HTTP 1.0 200 OK\r\n\r\n'; cat static.html ) | nc -q0 -l -p 80 ; done

That's for the original netcat. GNU netcat is a bit different but you can use the same principle. As for HTTPS, you can use the same trick with "openssl s_server".

Improve this answer
1

As other have mentioned you can setup a simple web server to listen for http/https requests. Pick your favorite there are many to choose from. I would do it with apache, but only because that is what I am most familiar with.

Once the web server is there you will want to add iptables rules that looks like this to intercept the traffic and send it to your local web server.

/sbin/iptables -t nat -A PREROUTING -p tcp -i {wlanif} --dport 80 -j REDIRECT --to-ports 80
/sbin/iptables -t nat -A PREROUTING -p tcp -i {wlanif} --dport 443  -j REDIRECT --to-ports 443
Improve this answer
0

If the page is completely static I would use tux, the kernel web server. It's wicked fast, stable and very reliable for static content. I'm not sure if it will handle SSL traffic though so you may need to have it proxy that content back to a server with the certs loaded on it since it doesn't sound like you have the certs on this machine.

Improve this answer
2
  • 1
    I would not recommend TUX, since it has never been integrated in the official Linux kernel...
    – Laurent Parenteau
    Feb 26, 2010 at 22:15
  • 1
    I don't think this is a good answer, he asked for simple, your answer requires installing unofficial kernel patches and recompiling the kernel by hand.
    – davr
    Feb 26, 2010 at 23:43
0

Good suggestion about tux. Also a lot of typical home broadband routers use lighttpd as their web server for control panels and things, so that might be another option.

Improve this answer
0

You should use a small webserver directly in your Linux router box. No need to forward the traffic to another web server using Squid...

Beside the already suggested lighttpd, I recommend you to look at HTTPi, which is a very small web server in Perl.

You can also look at this article in LinuxJournal, which create a web server using Python in approximately 20 lines of code.

Since you only want to serve a single static page, don't look at more complicated stuff...

Improve this answer

You must log in to answer this question.