2020-03-27 20:46:08 +00:00
|
|
|
|
Use WPA2 network with hotspot credentials
|
|
|
|
|
|
=========================================
|
|
|
|
|
|
|
|
|
|
|
|
[◀ Go back to main README](../README.md)
|
|
|
|
|
|
|
2022-02-12 12:05:56 +00:00
|
|
|
|
> ℹ️ **Info**: This script can not be used on its own but requires the base
|
2022-02-11 22:34:39 +00:00
|
|
|
|
> installation. See [main README](../README.md) for details.
|
2021-05-03 13:07:50 +00:00
|
|
|
|
|
2020-03-27 20:46:08 +00:00
|
|
|
|
Description
|
|
|
|
|
|
-----------
|
|
|
|
|
|
|
|
|
|
|
|
RouterOS supports an unlimited number of MAC address specific passphrases
|
|
|
|
|
|
for WPA2 encrypted wifi networks via access list. The idea of this script
|
|
|
|
|
|
is to transfer hotspot credentials to MAC address specific WPA2 passphrase.
|
|
|
|
|
|
|
|
|
|
|
|
Requirements and installation
|
|
|
|
|
|
-----------------------------
|
|
|
|
|
|
|
|
|
|
|
|
You need a properly configured hotspot on one (open) SSID and a WP2 enabled
|
|
|
|
|
|
SSID with suffix "`-wpa`".
|
|
|
|
|
|
|
|
|
|
|
|
Then install the script:
|
|
|
|
|
|
|
|
|
|
|
|
$ScriptInstallUpdate hotspot-to-wpa;
|
|
|
|
|
|
|
|
|
|
|
|
Configure your hotspot to use this script as `on-login` script:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/ip/hotspot/user/profile/set on-login=hotspot-to-wpa [ find ];
|
2020-03-27 20:46:08 +00:00
|
|
|
|
|
2021-06-22 13:58:03 +00:00
|
|
|
|
### Automatic cleanup
|
|
|
|
|
|
|
|
|
|
|
|
With just `hotspot-to-wpa` installed the mac addresses will last in the
|
|
|
|
|
|
access list forever. Install the optional script for automatic cleanup:
|
|
|
|
|
|
|
|
|
|
|
|
$ScriptInstallUpdate hotspot-to-wpa-cleanup,lease-script;
|
|
|
|
|
|
|
|
|
|
|
|
Create a scheduler:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/system/scheduler/add interval=1d name=hotspot-to-wpa-cleanup on-event="/system/script/run hotspot-to-wpa-cleanup;" start-time=startup;
|
2021-06-22 13:58:03 +00:00
|
|
|
|
|
|
|
|
|
|
And add the lease script to your wpa interfaces' dhcp server:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/ip/dhcp-server/set lease-script=lease-script [ find where name~"wpa" ];
|
2021-06-22 13:58:03 +00:00
|
|
|
|
|
2020-03-27 20:46:08 +00:00
|
|
|
|
Configuration
|
|
|
|
|
|
-------------
|
|
|
|
|
|
|
|
|
|
|
|
On first run a disabled access list entry acting as marker (with comment
|
|
|
|
|
|
"`--- hotspot-to-wpa above ---`") is added. Move this entry to define where new
|
|
|
|
|
|
entries are to be added.
|
|
|
|
|
|
|
|
|
|
|
|
Create hotspot login credentials:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/ip/hotspot/user/add comment="Test User 1" name=user1 password=v3ry;
|
|
|
|
|
|
/ip/hotspot/user/add comment="Test User 2" name=user2 password=s3cr3t;
|
2020-03-27 20:46:08 +00:00
|
|
|
|
|
2021-12-21 12:15:35 +00:00
|
|
|
|
Additionally templates can be created to give more options for access list:
|
|
|
|
|
|
|
2022-03-07 21:26:41 +00:00
|
|
|
|
* `action`: set to `reject` to ignore logins on that hotspot
|
2021-12-21 12:15:35 +00:00
|
|
|
|
* `private-passphrase`: do **not** use passphrase from hotspot's user
|
|
|
|
|
|
credentials, but given one - or unset (use default passphrase) with
|
|
|
|
|
|
special word `ignore`
|
|
|
|
|
|
* `ssid-regexp`: set a different SSID regular expression to match
|
|
|
|
|
|
* `vlan-id`: connect device to specific VLAN
|
|
|
|
|
|
* `vlan-mode`: set the VLAN mode for device
|
|
|
|
|
|
|
|
|
|
|
|
For a hotspot called `example` the template could look like this:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/caps-man/access-list/add comment="hotspot-to-wpa template example" disabled=yes private-passphrase="ignore" ssid-regexp="^example\$" vlan-id=10 vlan-mode=use-tag;
|
2021-12-21 12:15:35 +00:00
|
|
|
|
|
|
|
|
|
|
The same settings are available in hotspot user's comment and take precedence
|
|
|
|
|
|
over the template settings:
|
|
|
|
|
|
|
2022-05-11 08:05:47 +00:00
|
|
|
|
/ip/hotspot/user/add comment="private-passphrase=ignore, ssid-regexp=^example\\\$, vlan-id=10, vlan-mode=use-tag" name=user password=v3ry-s3cr3t;
|
2021-12-21 12:15:35 +00:00
|
|
|
|
|
|
|
|
|
|
Usage and invocation
|
|
|
|
|
|
--------------------
|
|
|
|
|
|
|
2020-03-27 20:46:08 +00:00
|
|
|
|
Now let the users connect and login to the hotspot. After that the devices
|
|
|
|
|
|
(identified by MAC address) can connect to the WPA2 network, using the
|
|
|
|
|
|
passphrase from hotspot credentials.
|
|
|
|
|
|
|
2021-06-22 13:58:03 +00:00
|
|
|
|
See also
|
|
|
|
|
|
--------
|
|
|
|
|
|
|
|
|
|
|
|
* [Run other scripts on DHCP lease](lease-script.md)
|
|
|
|
|
|
|
2020-03-27 20:46:08 +00:00
|
|
|
|
---
|
|
|
|
|
|
[◀ Go back to main README](../README.md)
|
|
|
|
|
|
[▲ Go back to top](#top)
|
