For a while now, I've been looking at how we deal with customers that have not paid their bill. At the moment, after several gentle email reminders being sent to an email address that the customers subscribe to themselves, we essentially reprogram the CPE to disable the ethernet port. Needless to say, there are positives and negatives with doing it this way.

I'd really like to do some form of a captive billing portal that can isolate the specific customer's traffic, redirect all web traffic to our portal with a notice saying they need to pay their bill and then allow access only to our online billing system.

Using some network magic (vlans) and possibly use a few pieces of software already written for something like this I'd love to find an open source solution or other ideas for doing something like this. Given our internal setup and the numerous different customer CPE configurations (bridged v.s. nat devices, static IP vs dynamic IP), I don't think any one method like hijacking thier DNS or http redirection will work alone. I know it won't work for everyone but I'd love to be able to do it for the majority of customers.

So, I ask you all. In the open source/Free software world, what are people using to accomplish something like this and how is it being done?

Edit: We are a small WISP. Our CPE consists of mostly cambium canopy SMs but have some WiMax hardware mixed in as well.

  • 2
    You mention you have CPE, but you don't tell us what you're actually providing. Are you an ISP? – Mark Henderson Jan 17 '12 at 10:42

From your edit, you're an (W)ISP, and you'd like to redirect everyone to a billing control panel if they haven't payed their bills. You'd like to do that using open-source tools. I'd put together a solution using iptables and a web server of your choice. Using iptables I'd simply DNAT all access on port 80 (HTTP) and DROP everything but HTTP and DNS. No matter what the user types in there browser, no matter what address DNS wold resolve, the port-80 redirector would send traffic to your billing portal.

Having this solution in mind, you can start putting together a list of problems that need solving for this to work:

  • All traffic needs to (ultimately) go through your iptables router. If you already have other kinds of hardware in place, you'd need to update the question because it's a significant limitation.
  • The iptables router needs to know the IP addresses for the clients that need to be banned. It also needs a scripted way of quickly updating it's rules. Getting the list of static-ip's that need to be banned shouldn't be a problem. Getting the list of dynamic IP's that need the same treatment might a bit more difficult, depending on how they get there IP's, but it should be doable. If IP's fail, you can always match on MAC address!
  • You need to have a web server on a static address that only serves your portal. For a better experience this web server should serve two web-sites: A "default" web-site that uses a rewrite rule so it serves a HTTP Redirect page no matter what URL was requested, and a name-based virtual web site that implements your actual portal.

Each of those bullets would need to be addressed separately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.