NAME

Captive::Portal::Role::Firewall - firewall methods for Captive::Portal

DESCRIPTION

Does all stuff needed to dynamically update iptables and ipset.

ROLES

$capo->fw_start_session($ip_address, $mac_address)

Add tuple IP/MAC to the ipset named capo_sessions_ipset. Members of this ipset have Internet access and are no longer redirected to the login/splash page crossing the gateway.

Also insert this IP into capo_activity_ipset, needed for stateful restarts.

$capo->fw_stop_session($ip_address, $mac_address)

Delete tuple IP/MAC from the ipset named capo_sessions_ipset.

$capo->fw_reload_sessions()

This method is called during startup of the Captive::Portal when the old state of the clients must be preserved. Reads the sessions from disc cache and calls fw_start_session for all ACTIVE clients.

$capo->fw_status()

Counts the members of the ipset 'capo_sessions_ipset'. Returns the number of members in this set on success (maybe 0) or undef on error (e.g. ipset undefined).

$capo->fw_list_sessions()

Parses the output of: ipset list capo_sessions_ipset

and returns a hashref for the tuples { ip => mac, ... }

$capo->fw_list_activity()

Reads and flushes the ipset 'capo_activity_ipset' and returns a hashref for the tuples { ip => timeout, ... }

Captive::Portal doesn't rely on JavaScript or any other client technology to test for idle clients. A cronjob must call periodically:

   capo-ctl.pl [-f capo.cfg] [-l log4perl.cfg] purge

in order to detect idle clients. The firewall rules add active clients to the ipset 'capo_activity_ipset' and the purger reads this set for activity checks.

$capo->fw_clear_sessions()

Flushes the ipset 'capo_sessions_ipset', normally used in start/stop scripts, see capo-ctl.pl.

$capo->fw_start()

Calls the firewall templates in the order flush, init, mangle, nat and filter, see the corresponding firewall templates under templates/orig/firewall/. After the init step the ipsets are filled via fw_reload_sessions from disc cache.

$capo->fw_stop()

Calls the firewall template flush, see the corresponding firewall template under templates/orig/firewall/.

$capo->fw_purge_sessions()

Detect idle sessions, mark them as IDLE in disk cache and remove entry in ipset.

AUTHOR

Karl Gaissmaier, <gaissmai at cpan.org>

LICENSE AND COPYRIGHT

Copyright 2010-2013 Karl Gaissmaier, all rights reserved.

This distribution is free software; you can redistribute it and/or modify it under the terms of either:

a) the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version, or

b) the Artistic License version 2.0.