It’s a common use case scenario: you want to broadcast a public WiFi network for anyone to use, but you’ve got strict requirements that only cat images be permitted. Great news: your Raspberry Pi is a perfect transmoggification machine. Intrigued? Read on.
This project starts out identical to the Onion Router we built a few weeks back. We’ll make the Raspberry Pi into a standard WiFi network first, then place a proxy in the middle. The proxy will be filtering posts through a Perl script, which will replace the images on every HTTP request with cat GIFs from TheCatAPI.com. Watch as befuddled users are both intensely frustrated, yet strangely calmed. Here’s the BBC, post-cat modifications.
Making a WiFi Network
Since this part of the tutorial is exactly the same as the DIY Onion Router, please follow the instructions there up to the point of Install Tor.
The only small change we need to make is to broadcast an open WiFi network instead of one secured with WPA. Once you’ve followed the setup there, change /etc/hostapd/hostapd.conf, pasting in the following configurations instead. Restart to apply the changes.
interface=wlan0
driver=nl80211
ssid=Kittens
hw_mode=g
channel=6
auth_algs=1
wmm_enabled=0
You should now have a wireless network being broadcasted on your Raspberry Pi that’s publicly accessible. The rest of this guide will focus on getting the interesting stuff happening.
If things aren’t working, type:
ifconfig -a
and look for an IP address on wlan0. If one isn’t being assigned on reboot, try the following:
sudo nano /etc/default/ifplugd
Change the following lines from:
INTERFACES="auto"
HOTPLUG_INTERFACES="all"
to:
INTERFACES="eth0"
HOTPLUG_INTERFACES="eth0"
Reboot, and verify you’re able to connect to the WiFi network, and access the Internet.
Squid Proxy and IPTables
Start by installing the prerequisites, then create a new routing table. We’ll be serving images from the Raspberry Pi later, so we’ll also need Apache web-server.
sudo apt-get install squid3 bridge-utils apache perl
nano iptables.sh
Paste the following:
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.42.1:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
Save, then exit.
chmod +x iptables.sh
sudo cp iptables.sh /etc/init.d/
sudo update-rc.d iptables.sh start 99
Ignore the warnings, it just means we haven’t complied with some Debian rules (but doesn’t break anything). Lastly, we still have the old iptables rules on boot, so remove the following line from /etc/network/interfaces
up iptables-restore < /etc/iptables.ipv4.nat
(Delete or comment it out)
Then restart. Next We’ll delete the default Squid proxy config, and make a fresh one.
sudo rm /etc/squid3/squid.conf
sudo nano /etc/squid3/squid.conf
Paste the following into the blank file:
cache_mgr pi
cachemgr_passwd pi all
redirect_program /home/pi/cats.pl
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 192.168.42.0/24 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 transparent
umask 022
cache_mem 128 MB
cache_dir ufs /var/spool/squid3 1500 16 256
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
Save and exit. Initialise the cache directories with the following command, then edit the script we’ll use to catify all the images:
sudo squid3 -z
nano /home/pi/cats.pl
Paste in:
#!/usr/bin/perl
$|=1;
$count = 0;
$pid = $$;
open (DEBUG, '>>/tmp/cats.log');
autoflush DEBUG 1;
print DEBUG "########################################################################\n";
while (<>) {
chomp $_;
if (m/nosquid/) {
print DEBUG "Input NOSQUID: $url\n";
print "$_\n";
print DEBUG "Output NOSQUID: $_\n";
}
elsif ($_ =~ /(.*\.jpg)/i) {
$url = $1;
print DEBUG "Input: $url\n";
system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "http://thecatapi.com/api/images/get?format=src&type=gif&nosquid");
chmod 0777,"/var/www/images/$pid-$count.gif";
print "http://127.0.0.1/images/$pid-$count.gif\n";
}
elsif ($_ =~ /(.*\.gif)/i) {
$url = $1;
print DEBUG "Input: $url\n";
system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "http://thecatapi.com/api/images/get?format=src&type=gif&nosquid");
chmod 0777,"/var/www/images/$pid-$count.gif";
print "http://127.0.0.1/images/$pid-$count.gif\n";
}
elsif ($_ =~ /(.*\.png)/i) {
$url = $1;
print DEBUG "Input: $url\n";
system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "http://thecatapi.com/api/images/get?format=src&type=gif&nosquid");
chmod 0777,"/var/www/images/$pid-$count.gif";
print "http://127.0.0.1/images/$pid-$count.gif\n";
}
elsif ($_ =~ /(.*\.jpeg)/i) {
$url = $1;
print DEBUG "Input: $url\n";
system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "http://thecatapi.com/api/images/get?format=src&type=gif&nosquid");
chmod 0777,"/var/www/images/$pid-$count.gif";
print "http://127.0.0.1/images/$pid-$count.gif\n";
}
else {
print "$_\n";
}
$count++;
}
Make the script executable, and we also ned to make some directories for it to work with.
sudo chmod +x cats.pl
sudo mkdir /var/www/images
sudo chmod 777 /var/www/images
sudo usermod -a -G www-data proxy
sudo chown www-data:www-data /var/www
sudo chown www-data:www-data /var/www/images
touch /tmp/cats.log
chmod 777 /tmp/cats.log
You can tail the log at any time with:
tail -f /tmp/cats.log