0

Currently, my company internet access for visitor are required to request MAC address from them if they want to access to internet. Can we do something like the Hotel wifi? they just access to the network and just key in the password, then they are able to access the internet for certain time of period. so far, i have looking for linux solution, but they are no such program/application available. do you all have any experience on it?

Regards, MH

closed as off-topic by mdpc, Ward, Jenny D, kasperd, HBruijn Aug 23 '14 at 17:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • What you refer to is called a "captive portal", and yes, there are many ways to provide this type of service. – EEAA Aug 22 '14 at 0:54
  • Thanks!!! with the key word, I'm able to get the application i want!! thanks ^^ – Min Hong Tan Aug 22 '14 at 1:01
  • Captive Portal, combined with 802.1X. Unknown MAC? Throw them on a guest VLAN. Known MAC? Put them on the protected network. – Mark Henderson Aug 22 '14 at 1:17
  • that's great, but any open source to introduce? – Min Hong Tan Aug 22 '14 at 1:18
  • PacketFence. It will do everything you need. – Michael Hampton Aug 22 '14 at 1:39
2

A great way of doing this is with 802.1x and port-based authentication, combined with a captive portal.

You set up a captive portal on your gateway to make the user accept terms/conditions or enter a guest password. You assign that captive portal onto your guest VLAN.

Then you use 802.1x on all your switch ports. If the MAC address authentication passes, then put the ports native VLAN to your normal protected network.

If the MAC address authentication fails, then the users port goes onto the guest VLAN, and they hit the captive portal.

You'll need:

  • Switches that support 802.1x
  • A RADIUS server to perform the authentication (Such as FreeRADIUS)
  • A gateway that supports captive portals (such as PFSense)
  • i think should be correct,but,i'm not really familiar with 802.1x and port-based authentication,and also vlan , still need to study more information. – Min Hong Tan Aug 22 '14 at 1:24
  • @陈明峰 there's a lot of information for you to learn then. This is not an "easy" solution to implement. – Mark Henderson Aug 22 '14 at 1:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.