I'm trying to organise some wide wifi network

imagine a small town with several wifi points

when user is connected to a wifi point, device is redirected to captive-portal(cp) website where they must input some info and accept terms and condtitions

we organised captive portal behind each wifi-point with linux iptables (allowing users to go to internet if device with their mac address accepted terms of service)


it works perfect until user moves to another location(to other wifi point) - user have to accept-terms again on captive portal

we created a sync of the list of mac addresses between capive portals to avoid that issue, but then comes other issue since amount of internet users is about 90000 - we have high CPU load on CP machines because iptables handling that 90k+ mac address rules

so the question - is there some lightweght solution like iptables filtering by mac-address or maybe we should use some other strategy ?

closed as off-topic by Sven, Ward, mdpc, Rex, TheCleaner Mar 31 '14 at 13:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Sven, Ward, mdpc, Rex, TheCleaner
If this question can be reworded to fit the rules in the help center, please edit the question.


You should consider using a central RADIUS server for authentication. It will keep a list of valid (and logged-in) users/devices and can inform the access points about the status of a device, which then needs to manage only currently connected devices.

Another approach, which can also be combined with the RADIUS solution, is to have a central, powerful gateway where the access points connect to that handles all the routing/firewall stuff. Naturally, this requires a network architecture supporting this kind of topology.

Not the answer you're looking for? Browse other questions tagged or ask your own question.