[photopress:eback.jpg,full,center]
It’s tempting, isn’t it? You know you just really want to do this. And I can’t think of a reason why not. I’m considering it for my home router, as it and my MacBook Pro haven’t been getting along since the last Leopard update, but the prudent would instead side on the secure side and encrypt their network.
But where’s the fun in that? No, if these freeloaders are going to steal my Wi-Fi, I’m at least going to have some fun with them. Peter found me this little gem on Sunday and thought it might be a great Help-Key. I was traveling yesterday so you get it today instead, but he’s right, this is great.
Sadly, the link he provided had images of what happens (see above) but not the actual code to implement it. With some strategic Googling I was able to put together how it works, and it’s something you can do in an afternoon. It’s a little technical and not the easiest thing to do, but if you have a little hackery in your blood, it’s a lot of fun.
It won’t work on all routers, in fact cheap routers wont have a chance of making this work, however a ubiquitous and easy to find router, the Linksys WRT54G, should be your launching point.
The router runs portions of Linux, so Linksys was obliged to open it up to developers. That paved the way for our personal favorite replacement firmware, Talisman. Talisman completely erases and replaces the on-board programming, essentially turning a router that costs $60 new into a router that could retail for over $500. That’s cool, and much easier to do that you’d think.
Many other routers are supported, so check out the Talisman site to see if yours is.
Once we have our router, we download the appropriate firmware from the Talisman website. We then login to our router and do a regular firmware upgrade, which you’re on your own to figure out, each brand is different. But we’re instead going to navigate to the Talisman firmware we just downloaded.
It’ll click and whirl and reboot with the new firmware in place. You’ll have to re-set it up with your ISP, but that shouldn’t take too long. Now browse and be amazed at the different new options you’ve got.
We’re going to set up the router with two netblocks, one “trusted” and one “untrusted”. Set up your machines on the “trusted” netblock. You can do that by editing the dhcpd.conf file with the following code:
ddns-updates off;
ddns-update-style interim;
authoritative;shared-network local {
subnet *.*.*.* netmask 255.255.255.0 {
range *.*.*.* *.*.*.*;
option routers *.*.*.*;
option subnet-mask 255.255.255.0;
option domain-name “XXXXX”;
option domain-name-servers *.*.*.*;
deny unknown-clients;host trusted1 {
hardware ethernet *:*:*:*:*:*;
fixed-address *.*.*.*;
}
}subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.2 192.168.0.10;
option routers 192.168.0.1;
option subnet-mask 255.255.255.0;
option domain-name-servers 192.168.0.1;
allow unknown-clients;}
}
Now we can add some fun to the iptables that redirects everything to another site. Randall Munroe, (yes, that Randall Munroe,) the supplier of most of the code here, likes kittenwar, so he directs people to kittenwar:
sbin/iptables -A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp -j DNAT –to-destination 64.111.96.38
That final IP address can be anything, this one goes to kittenwar, but you could go find a lemonparty to send them to.
Now you need to run Squid, a popular web caching and proxy server. You might be able to get it to run on your router, if not you’ll have to use a local machine. Anyway, it’s going to do all the fun stuff that comes next.
Now we’re going to tell iptables to do this:
/sbin/iptables -A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp -m tcp –dport 80 -j DNAT –to-destination 192.168.0.1
That essentially takes the requests made by the untrusted netblock, and runs them through your machine running Squid, which uses the following code to make Mogrify turn the imags upside down. You can make it do many other things, too. Remember 192.168.0.0 is the usual default for most set-ups but this subnet could be anything. 10.1.0.0 is another popular choice.
Add this script:
#!/usr/bin/perl
$|=1;
$count = 0;
$pid = $$;
while () {
chomp $_;
if ($_ =~ /(.*\.jpg)/i) {
$url = $1;
system(“/usr/bin/wget”, “-q”, “-O”,”/space/WebPages/images/$pid-$count.jpg”, “$url”);
system(“/usr/bin/mogrify”, “-flip”,”/space/WebPages/images/$pid-$count.jpg”);
print “http://127.0.0.1/images/$pid-$count.jpg\n”;
}
elsif ($_ =~ /(.*\.gif)/i) {
$url = $1;
system(“/usr/bin/wget”, “-q”, “-O”,”/space/WebPages/images/$pid-$count.gif”, “$url”);
system(“/usr/bin/mogrify”, “-flip”,”/space/WebPages/images/$pid-$count.gif”);
print “http://127.0.0.1/images/$pid-$count.gif\n”;}
else {
print “$_\n”;;
}
$count++;
}
That makes everything on the untrusted computers look backwards and upside down. Awesome!
As we said, it’s fairly technical, but those familiar with Linux shouldn’t have a hard time of it. Thanks to Randall Monroe for publishing this code, we hope we’ve made it a little easier for you to work with.