Advanced configuration

Updated 3 months ago by admin

This section is for advanced users only. Please check with your service provider as to the level of support available for the options in this section.

The USS Gateway agent is essentially an Ubuntu Linux installation with various custom packages to deliver the features required. As such, advanced Linux administrators are able to install additional packages or implement advanced configuration options.

Custom squid proxy configuration

The USS Gateway server software uses a modified version of the open source Squid Proxy. If you are familiar with Squid you can take advantage of additional configuration options that are available.

The USS Gateway system supports two override files that can be used to load in additional squid configuration options. This file is upgrade-proof and should be used rather than editing the default configuration file directly, which is overwritten each time the ussgw_sysmond service runs (on boot or when changing UI options).

  1. Log in to the USS Gateway command line and sudo su to become root.
  2. Edit the file found in: /usr/local/uss-squid4/etc/squid.conf.pre-override and /usr/local/uss-squid4/etc/squid.conf.override and make the required changes. Use the pre-override file to insert overrides at the beginning of the squid.conf and the override file for inclusions at the end. The order of some Squid configurations is important - refer to the Squid documentation for further information.
  3. Reload squid with: service uss-squid reconfigure

Custom firewall rule configuration

Some administrators may attempt to add firewall rules to the USS Gateway server, but notice after changing settings via the UI or rebooting the server the new firewall rules are lost. This is because the ussgw_sysmond system service rewrites the iptables firewall each time the service is started. However, it is possible to add custom rules into a special file which is executed by ussgw_sysmond after it has finished configuring the base firewall rules needed by USS Gateway.

By default the ussgw_sysmond service only flushes the PREROUTING chain. To view the default rules execute: iptables -t nat -L --line-numbers
  1. Log in to the USS Gateway command line and sudo su to become root.
  2. Create the file /etc/ussgw_custom_firewall and make it executable with chmod +x /etc/ussgw_custom_firewall
  3. Add your iptables firewall rules to this file
  4. Test your script by stopping and starting the service: /etc/init.d/ussgw_sysmond stop; /etc/init.d/ussgw_sysmond start
The script must be idempotent so it does not create duplicate firewall rules each time the script is executed by ussgw_sysmond

The best practice would be to write the script as if the iptables are completely empty to begin with, then have flush or delete commands to delete all rules the script adds, followed by the commands to add said rules.

Custom Hosts file

Some administrators may find it useful to add custom entries to the standard /etc/hosts file. This file is typically overwritten by the USS Gateway server during configuration changes, so modifying it directly is not recommended. Instead, you should create an override file:

  1. Log in to the USS Gateway command line and sudo su to become root.
  2. Create the file /etc/hosts.override and enter your custom host file entries.
  3. Stop and start the service: /etc/init.d/ussgw_sysmond stop; /etc/init.d/ussgw_sysmond start
  4. Check the main /etc/hosts file which should now contain the custom entries

Changing the Captive/Guest Portal default timeout

The Captive/Guest Portal times out devices after 15 minutes of inactivity. This value can be changed to whatever value you'd prefer by following these steps:

  1. Log in to the USS Gateway command line and sudo su to become root.
  2. Edit the file: nano /usr/local/uss-squid4/libexec/ussgw_session_acl
  3. Alter the line that contains define("SESSION_TIMEOUT_INTERVAL", "15 minutes");
  4. Appropriate values may be 5 minutes, 1 hour, 30 minutes, 1 week, 1 month, etc.
  5. Save the file and exit.

This will take effect for any new Captive/Guest portal sessions created after the script was changed.


How did we do?