View on
Karl Gaissmaier > Captive-Portal-3.13 > Captive::Portal::Role::Firewall



Annotate this POD


New  1
Open  0
View/Report Bugs
Module Version: 3.13   Source   Latest Release: Captive-Portal-4.10


Captive::Portal::Role::Firewall - firewall methods for Captive::Portal


Does all stuff needed to dynamically update iptables and ipset.



Send a ping to the clients to check IDLE state if USE_FPING in config file is true.


fw_ipset_version checks for the ipset() major version number. ipset() version >= 4 introduced an incompatible API and CLI.

$capo->fw_start_session($ip_address, $mac_address)

Add tuple IP/MAC to the ipset named capo_sessions_ipset. Members of this ipset have Internet access and are no longer redirected to the login/splash page crossing the gateway.

$capo->fw_stop_session($ip_address, $mac_address)

Delete tuple IP/MAC from the ipset named capo_sessions_ipset.


This method is called during startup of the Captive::Portal when the old state of the clients must be preserved. Reads the sessions from disc cache and calls fw_start_session for all ACTIVE clients.


Counts the members of the ipset 'capo_sessions_ipset'. Returns the number of members in this set on success (maybe 0) or undef on error (e.g. ipset undefined).


Parses the output of: ipset list capo_sessions_ipset

and returns a hashref for the tuples { ip => mac, ... }


Reads and flushes the ipset 'capo_activity_ipset' and returns a hashref for the tuples { ip => mac, ... }

Captive::Portal doesn't rely on JavaScript or any other client technology to test for idle clients. A cronjob must call periodically: [-f capo.cfg] [-l log4perl.cfg] purge

in order to detect idle clients. The firewall rules add active clients to the ipset 'capo_activity_ipset' and the purger reads and flushes this set with this method.


Flushes the ipset 'capo_sessions_ipset', normally used in start/stop scripts, see


Calls the firewall templates in the order flush, init, mangle, nat and filter, see the corresponding firewall templates under templates/orig/firewall/. After the init step the ipsets are filled via fw_reload_sessions from disc cache.


Calls the firewall template flush, see the corresponding firewall template under templates/orig/firewall/.


Detect idle sessions, mark them as IDLE in disk cache and remove entry in ipset.


Karl Gaissmaier, <gaissmai at>


Copyright 2010-2012 Karl Gaissmaier, all rights reserved.

This distribution is free software; you can redistribute it and/or modify it under the terms of either:

a) the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version, or

b) the Artistic License version 2.0.

syntax highlighting: