Anonymous February 1, 2012 at 8:39 pm

You will also need to manually assign the local machines their IP address, as they will not get it from DHCP. And you will have to authorize them, for example with the localmac option we discussed earlier. And if you want them to also pass the firewall, you need to remove two lines from the firewall rules that are automatically added.

I have moved the settings needed for this to the local.conf file, as I found these “non-hotspot settings” better contained there than the default file. The firewall modification can be done by the ipup.sh script. Here are the ones I am using:

(PS: this is on OpenWRT+Chilli, not sure if other platforms would respond the same)

Code:
# LOCAL static IP range from 96 to 111
statip 192.168.20.96/255.255.255.240

lease 900 # default dhcp lease 900 seconds
leaseplus 300 # 5 minutes extra just in case
defsessiontimeout 90000 # 24 hour sessions for internal equipment (users are set by radius)
defidletimeout 3600 # 1 hour for internal equipment (users are set by radius)

# LOCAL MAC addresses
macallowlocal
macallowed XXXXXXXXXXXX #local device 1
macallowed YYYYYYYYYYY #local device 2

Code:
#!/bin/sh
#
# remove chilli build in added lines to allow native traffic again.
iptables -D INPUT -i br-lan -j DROP # this rule should be deleted
#iptables -D FORWARD -i br-lan -j DROP # leave this as # otherwise duplicate traffic
iptables -D FORWARD -o br-lan -j DROP # this rule should be deleted