Sputnik Docs

Sputnik Documentation
Complete Sputnik step-by-step documentation.

1 Sputnik Basics
1.1 Sputnik Overview 9

1.2 How Sputnik Works 16
1.3 Levels of SputnikNet Accounts and Subscriptions 23
2 Sputnik Agent Firmware
2.1 Using Sputnik-Powered DD-WRT Firmware 28

2.2 Flashing or Upgrading devices with Sputnik-Powered DD-WRT Firmware via the Web 37
2.3 Flashing Ubiquiti devices with Sputnik-Powered DD-WRT Firmware via tftp 45
2.4 Using Sputnik-Powered NexConnect Firmware 52
2.5 Upgrading Sputnik-Powered NexConnect Firmware 60
3 Sputnik-Powered Devices
3.1 Sputnik 720: Quick Start Guide 66

3.2 Sputnik 720: Adding Radios 79
3.3 Sputnik-Powered Linksys WRT54GL: Quick Start Guide 88
3.4 Sputnik-Powered NexAira NexConnect: QuickStart Guide 98
3.5 Sputnik-Powered Ubiquiti NanoStation2/5: Quick Start Guide 106
3.6 Sputnik-Powered Ubiquiti PowerStation2/5: Quick Start Guide 120
4 Deploying Sputnik-Powered Devices

4.1 Extending the range of your Sputnik-powered device using WDS. 134
5 SputnikNet Express
5.1 Getting Started with SputnikNet Express 145

5.2 User Experience: SputnikNet Express Splash and Welcome Page Themes 157
5.3 Finding your SputnikNet Express Account URL and Resetting Your Password 167
6 SputnikNet: Getting Started
6.1 Creating a new SputnikNet Account 172

6.2 Setting up Payment Information for SputnikNet Subscriptions 178
6.3 SputnikNet Status Overview Page 181
6.4 Logging Into your SputnikNet Account, Changing your Password, and Logging Out 183
6.5 Submitting a Lost Password Request 186
6.6 Configuring your SputnikNet Account 187
6.7 Using SputnikNet in read-only "Viewer" mode 192
7 Subscribing Sputnik-Powered Devices to your SputnikNet Account
7.1 Adding Sputnik-Powered Device Subscriptions to your SputnikNet Account 201

7.2 Subscribing Sputnik-Powered Devices to your SputnikNet Account with Sputnik Instant Setup 203
7.3 Correcting or Changing your Device's SputnikNet Subscription 206
8 Device Management with SputnikNet

8.1 Configuring Sputnik-Powered Devices: Basic Settings and Status 212
8.2 Pinging, Remotely Rebooting and Reflashing Sputnik-Powered devices 219
8.3 Overview of Policy and Authentication Overrides 224
8.4 Quality of Service (QoS) and Bandwidth Throttling 226
8.5 Executing commands on Sputnik-powered devices 230
8.6 Setting up OpenDNS on Sputnik-powered devices 235
9 Branding Networks with SputnikNet
9.1 Branding your Wi-Fi Network with Captive Portals 248

9.2 Advanced Captive Portal Techniques 264
9.3 Setting the Welcome Page Timeout 274
9.4 Branding the Session Monitor Window 276
9.5 Branding using Walled Gardens and Redirects 284
9.6 Removing Sputnik Branding 290
10 SputnikNet Authentication Basics
10.1 Creating a new Authentication System 294
11 Guest Authentication with SputnikNet
11.1 Guest vs. PrePaid Authentication 299

11.2 Requiring a Code for Access 302
11.3 Simple Click-Through with Terms of Service 314
11.4 Click-Through with Sponsorship (Guest Authentication plus Walled Garden) 320
11.5 Free, Time-Limited Wi-Fi followed by Paid Wi-Fi Access 328
11.6 Enabling All Users to Skip Captive Portal Login 336
11.7 Limiting Freeloaders 340
11.8 Spotting and Banning Network Abusers 346
12 Prepaid Authentication with Time and Bandwidth Limits
12.1 Creating and Managing Prepaid Cards in SputnikNet 354

12.2 Creating Prepaid Cards Externally, and Uploading them to SputnikNet 362
12.3 Printing Prepaid Cards 374
12.4 Paid Access with Prepaid Authentication 389
12.5 Free Access with Prepaid Cards 394
13 Billing for Wi-Fi Access with Time and Bandwidth Limits
13.1 Charging for Access: Authentication System Options 399

13.2 Setting up Rate Plans for PayPal or WorldPay 403
13.3 Using PayPal Website Payments Standard 410
13.4 Using PayPal Website Payments Pro 421
13.5 User Experience: Paying for Network Access using a Credit Card (Pro) 434
13.6 User Experience: Paying for Network Access using a Credit Card (Standard) 442
13.7 User Experience: Paying for Network Access using PayPal (Pro) 452
13.8 User Experience: Paying for Network Access using PayPal (Standard) 461
13.9 Using WorldPay for International Payments 469
13.10 PayPal and WorldPay User and Transaction Logs 475
14 Authenticating Users with SputnikNet
14.1 Users, Groups, and Network Policies 484

14.2 User Self-Registration 494
15 Authenticating Devices with SputnikNet
15.1 Authenticating Devices without Web Browsers 502

15.2 Enabling Selected Users to Skip Captive Portal Login based on Client Device 510
16 RADIUS Authentication with SputnikNet
16.1 Setting up RADIUS Authentication 515

16.2 Authenticating with Microsoft Active Directory 521
17 Advertising with SputnikNet (Beta)
17.1 Enabling Advertising for your SputnikNet Account 526

17.2 Enabling AnchorFree Advertising for Sputnik-Powered Devices 529
17.3 Applying AnchorFree Advertising to Authentication Systems 534
17.4 Combining Free Ad-Supported Access with Paid Access 545
18 SputnikNet Network Policies
18.1 Overview of Network Policies 556

18.2 Applying Network Policies to an Authentication System 561
18.3 Applying Network Policies to Groups within a User Authentication System 564
18.4 Blocking Private Networks 570
18.5 Walled Gardens with Allow/Accept Policies 576
18.6 Content Filtering with Destination NAT Policies 581
18.7 Port Forwarding 588
18.8 Blocking Specific Sites with Deny/Reject Policies 599
19 SputnikNet Reports
19.1 Standard Reports 607

19.2 Ad Hoc Reports 619
20 Troubleshooting
20.1 Sputnik Agent Error Messages 624

20.2 Extend DHCP Lease Range to Enable More Client Connections 628
Sputnik Basics
Sputnik Documentation - 8 © 2008 Sputnik, Inc.

Sputnik Overview
A quick, high-level overview of Sputnik and SputnikNet.
What is Sputnik? Wi-Fi as a web service.

Sputnik is a company that offers SputnikNet, a web service that enables you to run one
or many public-access Wi-Fi networks of any size. Our goal is to enable you to engage
your customers with location-based Wi-Fi experiences.

What does SputnikNet do? Branding.
First, SputnikNet gives you control over every aspect of the branding of your network.
You can create unlimited captive portals, walled gardens, welcome pages. You can
create any kind of user experience for your customers.

What does SputnikNet do? Subscriber management.
Second, SputnikNet gives you control over subscriber management. You can provide
free, paid, roaming-based, or advertising-supported Wi-Fi services-- or any mixture of
them-- over one or hundreds of Wi-Fi networks. SputnikNet supports virtually any Wi-Fi
business model you can dream up.

What does SputnikNet do? Provisioning and remote management.
Third, SputnikNet enables automatic provisioning and remote management of all of your
Sputnik-powered Wi-Fi access points (APs) wherever in the world they happen to be.
Need to add a new Wi-Fi hotspot? Plug a Sputnik-powered AP into the internet and
you're ready to go. You can see the status of any hotspot and reconfigure it over the web.

How does Sputnik work? At the edge of your network.
First, Sputnik puts software on wireless access points and routers called the Sputnik
Agent. (Generally, we call devices that run the Sputnik Agent "Sputnik-powered
devices".) You can purchase Sputnik-powered devices from Sputnik, or download the
Sputnik Agent for free and flash it onto compatible third-party devices.

How does Sputnik work? Over the internet.
Second, SputnikNet is a secure web application you access from your browser.
SputnikNet enables you to configure Sputnik-powered devices, remotely manage Wi-Fi
networks, create authentication policies, build captive portals, and track usage.

What does SputnikNet cost?
It is $49.95 (one time) to set up a SputnikNet Account. You pay an annual subscription
fee for each Sputnik-powered device on your network. There are no per-user fees or
limits, and Sputnik takes no cut of your revenue. Annual SputnikNet subscription fees
range from $199.50 to $499.50, with discounts and monthly subscription options for
volume customers.

How Sputnik Works
How to get started with Sputnik.
Sign up for a SputnikNet Account.

Purchase a SputnikNet Account from Sputnik's online store. There is a $49.95 setup fee.
Name your account after your business.
Sputnik will email you login and password information so that you can start using your
new SputnikNet account.

Design captive portals.
Use web standards (HTML, CSS, JavaScript) to create captive portal login pages that
reflect your brand.
Reinforce your brand experience with walled garden sites (web sites that can be viewed
before customers log in), welcome pages (pages that customers see after they log in),
session monitor windows (optional popup windows that display time online to users and
enable them to log out), and more.

Set up authentication systems, network policies, and media (beta).
SputnikNet enables you to configure a wide range of authentication systems, network
policies, and media systems. You have full control over free, fee-based, advertising
supported, roaming-based, or mixed Wi-Fi business models. Sputnik does not take a cut
of your Wi-Fi revenues.

Plug Sputnik-powered devices into broadband internet.
The first time you plug a Sputnik-powered device into broadband, and associate with it, it
displays a page asking for the name of your SputnikNet account. Once entered, your
Sputnik-powered device connects to your SputnikNet account over the internet,
downloads its provisioning information, and is ready to go.

Apply captive portals, authentication systems, and policies to Sputnik-powered devices.
Apply your captive portals to one or many Sputnik-powered devices across your
network. Apply one or more authentication systems, network policies, and media
systems to your captive portals and Sputnik-powered devices. You have full control over
the user experience and business models, which you can vary by site. No other system
comes close to offering SputnikNet's flexibility and control.

Authenticate users on your branded Wi-Fi network.
Users sign in via captive portal or click-through page. You can ask them to agree to
terms of service, pay for access, sign up for a user account, or simply click through for
advertising-supported Wi-Fi.

Manage your network over the web.
You have complete visibility into every Sputnik-powered WI-Fi access point on your
network. You can remotely manage Sputnik-powered devices, track subscribers,
terminate bandwidth hogs, identify network bottlenecks-- all securely, over the web.

Levels of SputnikNet Accounts and Subscriptions
An overview of SputnikNet accounts and levels of Sputnik Agent Subscriptions.
SputnikNet account levels.

There are two levels of SputnikNet accounts:
- SputnikNet Express, our free service for single-venue, basic hotspots

- SputnikNet, our flagship web services application for managing one or hundreds of
Wi-Fi networks over the web
For more detail about SputnikNet, see the product pages on Sputnik's web site.
Sputnik Agent Subscriptions.

As a free service, SputnikNet Express incurs no subscription fees.
SputnikNet pricing is based on the number of Sputnik-powered access points (APs) and
gateways managed on your network. Pricing for APs and gateways varies based upon
which Sputnik Agent firmware they run.
There are three levels of Sputnik Agent subscriptions:
- Sputnik Agent NMS - is free, and only enables device-management features in

SputnikNet (no user authentication). Devices subscribed to SputnikNet at the Sputnik
Agent NMS level are used as wired or wireless bridges.

- Sputnik Agent Standard - is for "business-class" access points/routers, capable of
authenticating up to about 30 simultaneous users
- Sputnik Agent Pro - is for "carrier-class" access points/routers, capable of

authenticating up to about 100 simultaneous users. At this time, the only Sputnik Agent
Pro-class device is the Sputnik 720.

SputnikNet Express network.
A SputnikNet Express network is always just one Sputnik-powered device. It's also free, so it
doesn't matter whether you're using a device that runs Sputnik Agent Standard or Sputnik Agent
Pro.

SputnikNet or SputnikNet On Site network.
With SputnikNet, you pay per Sputnik-powered device. As noted above, devices running
Sputnik Agent NMS (device management features only) are free. Sputnik Agent
Standard-class devices cost $199.50 per year; Sputnik Agent Pro-class devices cost
$499 per year.
This example shows a total of:
- 2 devices running Sputnik Agent Standard

- 1 device running Sputnik Agent Pro
- 5 devices running Sputnik Agent NMS
The total annual subscription fee would therefore be $898.
Managing Sputnik Agent subscriptions in SputnikNet.

Manage SputnikNet subscriptions inside SputnikNet. Simply change the number of
Sputnik Agent NMS, Standard and Pro subscriptions and click "Update". For more
information, refer to the online documentation chapter titled "Adding Sputnik-Powered
Device Subscriptions to your SputnikNet Account".

Sputnik Agent Firmware

Using Sputnik-Powered DD-WRT Firmware
How to enable and use Sputnik Agent functions in DD-WRT firmware, running on Linksys WRT-54GL, Sputnik 720, Ubiquiti NanoStation, Ubiquiti PowerStation, and
other compatible platforms.
Connect to the DD-WRT control panel on the Sputnik-Powered device.

Associate with the Sputnik-powered device (router) either wired or wirelessly.
Browse to the DD-WRT control panel at http://192.168.180.1. (Older versions of the

firmware, or versions obtained from DD-WRT's web site might use http://192.168.1.1.)
Log into the DD-WRT control panel.

Default username is "root". Default password is "admin".

Check Sputnik Agent status.
The main DD-WRT control panel page shows whether the Sputnik Agent is enabled or
not. This example shows the user interface of recent Sputnik-powered DD-WRT
firmware available from Sputnik's web site. We recommend that you always use the
latest Sputnik-provided firmware; for more information see the online documentation
chapter titled "Flashing or Upgrading devices with Sputnik-Powered DD-WRT Firmware
via the Web".
Default settings are:
- the built-in control panel is accessed at http://192.168.180.1

- the subnet for devices associating with the Sputnik-powered device is 192.168.180.x
- Sputnik's logo is at the top of the web page
- the Sputnik Agent and its settings are restored after a device restart
Check Sputnik Agent status (for non-Sputnik default DD-WRT firmware).

If you are using an older version of Sputnik-powered DD-WRT firmware, you'll see the
same information on the status page, and you'll follow the same steps to enable the
Sputnik Agent. However, there are a couple of differences:
- the built-in control panel is accessed at http://192.168.1.1

- the subnet for devices associating with the Sputnik-powered device is 192.168.1.x
- Sputnik's logo is absent from the top of the web page
- the Sputnik Agent and its settings are *not* restored after a restart of the device

Enable the Sputnik Agent.
Click on the "Hotspot" tab under the "Services" tab to access the Sputnik Agent. NOTE:
older versions of DD-WRT firmware locate the "Hotspot" tab under "Administration".
Click "Enable" to enable the Sputnik Agent.
Select Sputnik Agent mode (standard router).

If DD-WRT is running on a standard router, such as a Linksys WRT-54GL, the choices
are "Standard" or "NMS".
Choose "Standard" to enable both remote management of the router and user
authentication.
Choose "NMS" (for "Network Management System") to enable remote management of

the router (running in bridge mode) only.
For more information about Sputnik Agent Modes, see the chapter entitled "Sputnik
Agent NMS, Standard, and Pro".

Select Sputnik Agent mode (pro-class router).
If DD-WRT is running on a pro-class router, such as the Sputnik 720, the choices are
"Pro" or "NMS".
Choose "Pro" to enable both remote management of the router and user authentication.
Choose "NMS" (for "Network Management System") to enable remote management of

the Sputnik-powered device (running in bridge mode) only.
For more information about Sputnik Agent Modes, see the chapter entitled "Sputnik
Agent NMS, Standard, and Pro".

Choose Sputnik Instant Setup or SputnikNet Express.
"Sputnik Instant Setup" assigns the router to your SputnikNet Account.
"SputnikNet Express" uses Sputnik's free service for managing hotspots with branded,
click-through captive portal authentication. For more information about SputnikNet
Express, see the "SputnikNet Express" section.
For this example, we'll use Sputnik Instant Setup. Select it, then click "Apply Settings".
NOTE: Settings for Wifidog, Chilispot, HTTP Redirect and SMTP Redirect (if available)
do not apply to Sputnik, and for the purposes of this documentation, can be ignored.

Subscribe your Sputnik-Powered device to your SputnikNet Account.
You will be redirected to the SputnikNet Express Account set-up page (you may need to
refresh your browser). For more information see "Creating a new SputnikNet Express
Account".
Carefully enter your SputnikNet Account ID, as follows:
- a SputnikNet Account found at https://scc01.wifi.sputnik.com/mywifi would be:

mywifi@scc01.wifi.sputnik.com
- every SputnikNet Express ID is the same: express@express.sputnik.com
IMPORTANT: double-check to be sure your Account ID is typed correctly. Then click

"Assign".
For more information see the chapter entitled "Subscribing Sputnik-Powered Devices to
your SputnikNet Account with Sputnik Instant Setup".
Confirm that Sputnik Instant Setup settings took effect.

Be sure that the "SCC management ID" (otherwise known as the SputnikNet Account ID)
is correct. If it isn't, you'll need to submit a support request to change it. For instructions
on how to do this see the chapter entitled "Correcting or Changing your Device's
SputnikNet Subscription".
Wait a few minutes to be sure that your Sputnik-powered device has successfully
registered with your SputnikNet Account.

Check to be sure the Sputnik Agent is running.
In the DD-WRT control panel, click on the "Sputnik Agent" tab under the "Status" tab.
"Managed by" should show your SputnikNet ID.
"State" should show "Running normally - Managed". If it does, you're up and running.
NOTE: if "State" shows a different message, refer to the "Troubleshooting" section.
Sputnik Agent disabled status.

If the Sputnik Agent is disabled, there will be no "Sputnik Agent" tab under the "Status"
tab.
However you can see basic information about the Sputnik Agent's state by clicking on
the "Sys-Info" tab.

Confirming Sputnik Agent disabled status.
Sputnik Agent status is currently disabled. To enable it follow the instructions, above.
TIP: Temporarily changing your SputnikNet Account ID.

If at some point you want to temporarily subscribe your Sputnik-powered device to a
different SputnikNet Account, you can do that from the DD-WRT control panel.
Click on the "Hotspot" tab underneath the "Services" tab. Once you have successfully
subscribed your Sputnik-powered device to a SputnikNet Account, you'll see a new
"Use" field. Select it and enter the new SputnikNet Account ID. Click "Save".
IMPORTANT: your Sputnik-powered device will be subscribed to the new SputnikNet

Account only until the device is power cycled or rebooted. Typically this is done for
testing purposes.

In-depth DD-WRT firmware documentation.
For more detailed information about DD-WRT firmware, refer to the online
documentation posted at www.dd-wrt.com.

Flashing or Upgrading devices with Sputnik-Powered DD-WRT Firmware via the Web
How to flash or upgrade your compatible device with Sputnik-powered DD-WRT firmware using the device's built-in web interface.
Be sure your router is capable of running the Sputnik Agent.

See Sputnik's web site for a list of Sputnik-powered devices available from Sputnik. In
addition, Sputnik runs on a growing list of routers that run DD-WRT firmware. A list is
available on DD-WRT's web site. NOTE: Sputnik provides technical support only for
routers purchased from Sputnik.

Download Sputnik Agent Firmware from Sputnik's website.
Download Sputnik Agent Firmware from the "Support" section of Sputnik's website.
NOTE: while it can be possible to download newer versions of DD-WRT firmware from
dd-wrt.com, we strongly recommend that you download from Sputnik's website, as those
versions are fully tested with Sputnik Agent firmware.

Review the Sputnik Agent License Agreement.
Agree to the Sputnik Agent License Agreement.

Click "I Agree" at the bottom of the page.

Download Sputnik-Powered DD-WRT firmware.
The downloaded file will be saved to your computer. In this case, the file is named "dd-wrt.v24_sputnik_3.3.6.6_generic.bin".
If flashing a stock Linksys router, connect to the Linksys control panel on the Sputnik-Powered device.
Browse to the Linksys control panel at http://192.168.1.1.

Log into the Linksys control panel.
Leave username blank. Default password is "admin".
Upgrade the Linksys firmware.

Select the "Firmware Upgrade" tab from the "Administration" tab. Choose the

If upgrading an older version of DD-WRT, connect to the DD-WRT control panel on the Sputnik-Powered device.
Browse to the DD-WRT control panel at http://192.168.180.1 (note: some older versions
use 192.168.1.1).
Log into the DD-WRT control panel.

Default username is "root". Default password is "admin".

Choose the firmware you downloaded previously.
Click "Choose File", then browse to the firmware you downloaded previously.
Upgrade the DD-WRT firmware.

Click on "Upgrade" to start the upgrade process.

Wait for the firmware update to apply.
IMPORTANT: be sure not to turn off the power or press the reset button on the
Sputnik-powered device.
NOTE: if you see a message "Upgrade are failed" (sorry for the bad grammar, it doesn’t
come from us), you have hit the router's memory limit. In this case, repeat the above
process with DD-WRT mini firmware, and from there, flash again with Sputnik-Powered
DD-WRT firmware. You can obtain DD-WRT mini firmware from DD-WRT's web site, or
at this link (which is subject to change):
http://www.dd-wrt.com/dd-wrtv2/downloads/v24-sp1/Consumer/Linksys/WRT54GL_1.1/d
d-wrt.v24_mini_generic.bin.
Check to see that the Sputnik Agent is running.

Click on the "Sputnik Agent" tab under the "Status" tab.

Flashing Ubiquiti devices with Sputnik-Powered DD-WRT Firmware via tftp
How to flash or upgrade your Ubiquiti PowerStation, NanoStation or LiteStation with Sputnik-powered DD-WRT firmware using tftp. The tftp flash method works with
any Sputnik-compatible device but is required for all Ubiquiti devices at this time.
Download Sputnik Agent Firmware from Sputnik's website.

Download Sputnik Agent Firmware from the "Support" section of Sputnik's web site
specific to the device you intend to reflash.
NOTE: while it can be possible to download newer versions of DD-WRT firmware from
dd-wrt.com, we strongly recommend that you download from Sputnik's website, as those
versions are fully tested with Sputnik Agent firmware.

Review the Sputnik Agent License Agreement.
Agree to the Sputnik Agent License Agreement.

Click "I Agree" at the bottom of the page.

Download Sputnik-Powered DD-WRT firmware.
The downloaded file will be saved to your computer. In this example, the file is named "PS2.dd-wrt.bin" and is for the Ubiquiti
PowerStation 2.

Make sure your device is running the latest version of native firmware.
If necessary, upgrade your device to the latest version of native firmware. For Ubiquiti
products, visit their web site to download any available Air OS updates.

Set up your product for flashing.
Set up the cabling or wireless configuration needed to flash your device. For this
example, we're showing the Ubiquiti PowerStation 2.
IMPORTANT: the cabling configuration for tftp flashing from Ubiquiti default firmware to
Sputnik-powered DD-WRT firmware is different from what it will be when you operate the
device as a Sputnik-powered AP.
- AC power goes into the supplied PoE adapter

- LAN/PoE cable goes from the PoE port on the PoE adapter to the left-side port on the
back of the Ubiquiti device closest to the reset button (green cable in the photo) - in this
case it only carries power to the device
- WAN cable goes from the right-side port on the back of the Ubiquiti device to your PC,
from which you will flash (red cable in the photo)

Set up static IP networking on your PC.
Set your computer's IP address to 192.168.1.25.

Start a tftp session.
Launch a terminal application, then enter, after the ">" prompt:
> cd [path to the directory where you downloaded the Sputnik-powered firmware]
> tftp 192.168.1.20
You should then get a "tftp>" prompt. Enter:
tftp> binary
tftp> put NS2.dd-wrt.bin [or substitute the appropriate firmware file name]
Your terminal should show bytes being transferred, then return to a "tftp>" prompt.
tftp> q
That will quit tftp. Power cycle your device. Your Sputnik-powered firmware should now
be running.

Using Sputnik-Powered NexConnect Firmware
How to enable and use Sputnik Agent functions in NexConnect firmware, running on the NexAira NexConnect 3G Wireless Router.
Connect to the NexConnect control panel on the Sputnik-Powered device.

Browse to the NexConnect control panel at http://192.168.123.254.
Check Sputnik Agent status.

The main NexConnect control panel status page shows whether the Sputnik Agent is
enabled or not (scroll down to view).
Log into the NexConnect control panel.

Enter system password (default is "admin"), then click "Login".

Select Advanced Setup.
Select "Advanced Setup", then click "Enter".
Select Toolbox.
Click on the "Toolbox" tab next to the "Advanced Settings" tab.

Select Sputnik.
Click on "Sputnik" from the "Toolbox" tab.

Enable the Sputnik Agent.
Click "Enable" to enable the Sputnik Agent.
For "Control Center ID":
- "Sputnik Instant Setup" assigns the Sputnik-powered device to your SputnikNet

Account.
- SputnikNet Express" uses Sputnik's free service for managing hotspots with branded,
click-through captive portal authentication. For more information about SputnikNet
Express, see the "SputnikNet Express" section.
For "Agent Mode":
Choose "Standard" to enable both remote management of the Sputnik-powered device

and user authentication.
Choose "Bridge" to enable remote management of the router (running in bridge mode)
only. (Elsewhere this is referred to as Sputnik Agent "NMS", for "Network Management
System" only.)
For this example, we'll use Sputnik Instant Setup and run the Sputnik Agent in standard
mode. Click "Save" to save your settings.

Reboot.
Reboot the Sputnik-Powered device for your changes to take effect. To do this, click on
"Reboot" from the "Toolbox" tab.

You will be redirected to the SputnikNet Express Account set-up page. For more
information see "Creating a new SputnikNet Express Account".
NOTE: if the Sputnik Instant Setup page does not appear, power cycle your router by
unplugging it and plugging it back in again.
Carefully enter your SputnikNet Account ID, as follows:

- every SputnikNet Express ID is the same: express@express.sputnik.com

"Assign".
For more information see the chapter entitled "Subscribing Sputnik-Powered Devices to
your SputnikNet Account with Sputnik Instant Setup".

Be sure that the "SCC management ID" (otherwise known as the SputnikNet Account ID)
is correct. If it isn't, you'll need to submit a support request to change it. For instructions
on how to do this see the chapter entitled "Correcting or Changing your Device's
SputnikNet Subscription".
Wait a few minutes to be sure that your Sputnik-powered device has successfully
registered with your SputnikNet Account.

Check to be sure the Sputnik Agent is running.
Click on the "Status" tab and scroll down.
TIP: Temporarily changing your SputnikNet Account ID.

If at some point you want to temporarily subscribe your Sputnik-powered device to a
different SputnikNet Account, you can do that from the NexConnect control panel.
Click on the "Toolbox" tab underneath the "Administrator Options" tab, then select
"Sputnik". Once you have successfully subscribed your Sputnik-powered device to a
SputnikNet Account, you'll see a new "Use" field. Select it and enter the new SputnikNet
Account ID. Click "Save".
IMPORTANT: your Sputnik-powered device will be subscribed to the new SputnikNet

Account only until the device is power cycled or rebooted. Typically this is done for
testing purposes.

NexConnect documentation.
For more detailed information about the NexAira router and NexConnect firmware,
including how to flash upgrade the firmware, refer to the online documentation posted at
www.nexaira.com.

Upgrading Sputnik-Powered NexConnect Firmware
How to upgrade NexConnect firmware to the latest version running the Sputnik Agent.
Download Sputnik-Powered NexConnect Firmware from NexAira's website.

Download Sputnik Agent Firmware from the "Support" section of NexAira's website.
IMPORTANT: The NexAira NexConnect uses an incremental firmware upgrade process.

This means that in order to have the latest firmware installed, all previous versions of
firmware must also be installed.

Save the Sputnik-Powered NexConnect firmware to your PC.
The downloaded file will be saved to your computer. In this case, the file is named "
20080313_NexAira_NexConnect_R7.00c6.BIN".

Connect your PC to the LAN port of your NexConnect.
Connect an Ethernet cable from your PC to the LAN port on the NexConnect.
Connect to the NexConnect control panel.

Connect to the NexConnect control panel at http://192.168.123.254.

Log into the NexConnect control panel.
Enter system password (default is "admin"), then click "Login".
Select the Firmware Upgrade page.

Click on the "Firmware Upgrade" menu under the "Toolbox" tab.

Select the firmware file you downloaded previously.
Click "Browse..." and select the firmware file you downloaded previously. Click
"Upgrade" to begin the flash update process.
IMPORTANT: during reflashing, do not disconnect or power down the NexConnect.

Sputnik-Powered Devices

Sputnik 720: Quick Start Guide
How to get up and running with your Sputnik 720 and SputnikNet.
Plan your Sputnik-powered network.

The Sputnik 720 is a compact, rugged network gateway that, with the addition of up to two
optional 802.11a/b/g radios, becomes a managed wireless (and wired) router. The Sputnik 720
runs Sputnik Agent Pro firmware, and is capable of authenticating a hundred or more concurrent
users.
Both wired and wireless network users are authenticated by the Sputnik 720, as its LAN and
WLAN interfaces are bridged together. When used as a network gateway, users connected to
third-party wireless hardware (in bridge mode) are routed through the Sputnik 720 for
authentication and tracking. Service providers can leave existing wired and wireless networks in
place--whether Wi-Fi, WiMAX, mesh, or other internet protocol networks--routing traffic through
the Sputnik 720 for management.

Review Sputnik 720 port and network settings.
The Sputnik 720's ports are arranged as follows:
- the Ethernet 1 port on the left (next to the DC power port) is for LAN (local area
networking) and PoE (power over Ethernet) connections
- the Ethernet 2 port on the right is for WAN connections (wide area networking, or
broadband backhaul to the internet)
- default LAN IP address is 192.168.180.1; DHCP lease subnet is 192.168.180.x
- WAN is set up as a DHCP client
The Sputnik-powered DD-WRT control panel is available at:
- default URL: http://192.168.180.1

- default username: root
- default password: admin

Plug your Sputnik 720 into power and provide it with broadband (AC power option).
The cabling configuration for your Sputnik 720 running on AC power is:
- AC power adapter plugs into the DC port on the Sputnik 720 (black cable in photo)
- optional LAN cable plugs into the LAN/PoE port on the Sputnik 720 (yellow cable)
- WAN cable goes from the WAN port on the Sputnik 720 to your broadband connection
(red cable)

Plug your Sputnik 720 into power and provide it with broadband (PoE option).
The cabling configuration for your Sputnik 720 running on PoE is:
- DC power is supplied by your PoE adapter (available separately); an Ethernet cable

goes from the PoE output port on the adapter to the LAN/PoE (Ethernet 1) port on the
back of the Sputnik 720 (green cable in photo)
- for optional wired LAN connectivity, an Ethernet cable goes from the data port on the
PoE adapter to devices on your local network (PCs, printers, etc.) (yellow cable)
- WAN cable goes from the WAN (Ethernet 2) port on the back of the Sputnik 720 to your
broadband connection (red cable in the photo)
Set up your SputnikNet Account.

If you're intending to use your Sputnik 720 with SputnikNet Express, our free service for
branded Wi-Fi hotspots, you can skip this step.
Otherwise, sign up for SputnikNet, and make sure that you have an available
subscription for your Sputnik 720.
Each Sputnik 720 requires a Sputnik Agent Pro subscription (unless it's being used as a
bridge).
For more information, see the online documentation section titled "SputnikNet: Getting
Started".

Check to see that the Sputnik Agent is running on your Sputnik 720.
While the Sputnik Agent should be running by default, it's a good idea to be sure it is
active, and communicating effectively with the Sputnik Instant Setup server (for more
information about Sputnik Instant Setup, see the next step).
To check the Sputnik Agent status, first associate with the Sputnik 720 wired or
wirelessly.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik 720 as follows (if
your Sputnik 720 has already connected to your SputnikNet Account, you will need to log
in through its assigned captive portal, first):

To confirm that the Sputnik Agent is running:
- click on the "Sputnik Agent" tab under the "Status" tab.

- "Managed by" should show sputnik@wifi.sputnik.com/default (this is the URL of the
Sputnik Instant Setup server, which will be replaced by your SputnikNet Account URL
after you complete the next step)
- "State" should show "Running normally - Managed". If it does, you're up and running.
For more information about the Sputnik-powered DD-WRT control panel, see the online
documentation chapter titled "Using Sputnik-Powered DD-WRT Firmware".

Subscribe your Sputnik 720 to SputnikNet using Sputnik Instant Setup.
Be sure your Sputnik 720 has an active connection to the internet. That connection is
required for it to register with the Sputnik Instant Setup server.
Associate with your Sputnik 720 (wired or wirelessly), and open a browser. You should
be directed to the Sputnik Instant Setup page. Enter your SputnikNet ID to "subscribe"
your Sputnik 720 to SputnikNet or SputnikNet Express. For more information, refer to the
online documentation chapter titled "Subscribing Sputnik-Powered Devices to your
SputnikNet Account with Sputnik Instant Setup" or the section titled "SputnikNet
Express".
If you do not see the Sputnik Instant Setup page, refer to the "Troubleshooting" online
documentation chapter.

Make sure your Sputnik 720 is active in your SputnikNet Account.
Log into your SputnikNet Account and confirm that your Sputnik 720 is active.

Manage your Sputnik 720 in SputnikNet.
Click on the name of your Sputnik 720 in the "router list" to change its name, address,
and other settings such as the Wi-Fi channel and SSID. From the Sputnik-powered
device's "Edit Settings" page you can also change the captive portal that is assigned to
that device.
For more information, see the online documentation section titled "Device Management
with SputnikNet".

Set up authentication system(s) for your Sputnik-powered network.
Sputnik offers a wide range of authentication systems for free, advertising-supported, or
fee-based Wi-Fi. Any number of authentication systems can be applied to a captive
portal. For user gadgets without browsers, or when captive portal-based log in should be
skipped, you can configure an authentication system to detect and authenticate those
gadgets based on MAC address.
For more information, see the various online documentation sections on SputnikNet
Authentication Systems.
Set up captive portal(s) for your Sputnik-powered network.

You have full control over the content and branding of your captive portal pages.
SputnikNet supports standard HTML, CSS, JavaScript, and Adobe Flash, enabling you
to fully customize your customers' login experience. The login portion of the captive
portal page is inserted into your page layout automatically.
For more information, see the online documentation section titled "Branding Networks
with SputnikNet".

Apply captive portals, authentication systems, and network policies to your Sputnik 720.
Each Sputnik 720 is assigned to a specific captive portal. Each portal can be associated
with one or more authentication systems. Each authentication system can include
optional network policies that are applied to authenticated users. A walled garden is a
collection of network domains (URLs) that users are allowed to browse to before
authentication, so those policies are assigned directly to captive portals.
For more information, refer to the online documentation chapter titled "SputnikNet
Overview" and the "SputnikNet Network Policies" section.

Sign on as a network user to test your Sputnik-powered network.
Try out your Sputnik-powered Wi-Fi network to make sure everything is working the way you want
it to.

Accessing your Sputnik 720's control panel.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik 720 as follows (if
your Sputnik 720 has already connected to your SputnikNet Account, you will need to log


- "Managed by" should show your SputnikNet ID.

Get support if you need it.
Check out www.sputnik.com/support for additional information about the SputnikNet
service, documentation, and user forums.

Sputnik 720: Adding Radios
How to convert your Sputnik 720 into a wireless router by attaching one or two 802.11b/g or 802.11a antennae.
What's required.
The Sputnik 720 is a compact, rugged network gateway that, with the addition of up to
two optional 802.11a/b/g radios, becomes a managed wireless router. To add radios and
antennas to the Sputnik 720, you'll need:
- CM9 radio card(s)

- compatible radio pigtail(s)
- compatible antenna(e)
- a small Phillips screwdriver
- a Sputnik 720, of course

Remove Sputnik 720 metal casing.
Turn the Sputnik 720 upside down to remove the four screws holding the top and bottom
casing together.

If using 2.4 GHz, connect pigtail end connector to right-hand pin on radio card.
802.11b/g Wi-Fi uses 2.4GHz frequency. This is the most widely supported Wi-Fi
standard.

If using 5.8 GHz, connect pigtail end connector to left-hand pin on radio card.
802.11a Wi-Fi uses 5.8 GHz frequency. 802.11a is commonly used for long-range
point-to-point applications.

Place first radio card in left-hand radio slot of Sputnik 720.
Make sure that the card is seated and clips are connected.

If using two radios, place second card in right-hand radio slot of Sputnik 720.
You can mix and match 802.11b/g and 802.11a radios, or use two of each, depending
upon your application. The above shows two 802.11b/g radios.

Screw SMA connector(s) into Sputnik 720 casing.
Screw the SMA connector into one of the pass-through holes in the upper casing.

Replace Sputnik 720 casing.
Turn the Sputnik 720 over and reattach the four screws.

Attach compatible antenna(e).
Screw in standard SMA-RF antenna(e).

Sputnik-Powered Linksys WRT54GL: Quick Start Guide
How to get up and running with your Sputnik-powered Linksys WRT54GL and SputnikNet.

Sputnik sells the best-selling Linksys WRT54GL Wi-Fi-compliant 802.11g wireless
access point/router pre-flashed with Sputnik Agent firmware. That means it works out of
the box with SputnikNet to let you centrally manage and authenticate users on a
distributed Wi-Fi network.
Wired and wireless network users can be authenticated by the Sputnik-powered Linksys
device, as its LAN and WLAN interfaces are bridged together. When used as a network
gateway, end-users connected to third-party wireless hardware (in bridge mode) are
routed through the Sputnik-powered device for authentication. Service providers can
leave existing wired and wireless networks in place--whether Wi-Fi, WiMAX, mesh, or
other frequency--routing network traffic through the Sputnik-powered device for
authentication, tracking, and management.

Flash your Linksys device with Sputnik-Powered DD-WRT firmware, if needed.
Sputnik ships the Linksys devices with Sputnik-powered DD-WRT firmware pre-installed.
However, if you need to flash your Linksys device, follow the online documentation
chapter titled "Flashing or Upgrading Sputnik-Powered DD-WRT Firmware via the Web".
While it is possible to reflash your Linksys device wirelessly, we recommend directly

connecting your PC to any of the device's four LAN ports, shown.
After your Linksys device has been flashed with Sputnik-powered DD-WRT firmware, the
default port behavior will be:
-the RJ-45 Cat5 Ethernet port on the left is for WAN (wide area networking, or
broadband backhaul to the internet)
-the four Ethernet ports on the right are for LAN (local area networking) and PoE (power
over Ethernet)
- default LAN/WLAN IP address is 192.168.180.1; DHCP lease subnet is 192.168.180.x


If you're intending to use your Sputnik-powered Linksys device with SputnikNet Express,
our free service for branded Wi-Fi hotspots, you can skip this step.
subscription for your Sputnik-powered Linksys device.
Each Sputnik-powered Linksys device requires a Sputnik Agent Standard subscription

(unless being used as a bridge).
Started".
Check to see that the Sputnik Agent is running on your Sputnik-powered device.
To check the Sputnik Agent status, first associate with the Sputnik-powered device wired
or wirelessly.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik-powered device as
follows (if your Sputnik-powered device has already connected to your SputnikNet
Account, you will need to log in through its assigned captive portal, first):



Subscribe your Sputnik-powered Linksys device to SputnikNet using Sputnik Instant Setup.
Associate with your Sputnik-powered Linksys device (wired or wirelessly), and subscribe
it to your SputnikNet or SputnikNet Express Account using Sputnik Instant Setup. For
more information, refer to the online documentation chapter titled "Subscribing
Sputnik-Powered Devices to your SputnikNet Account with Sputnik Instant Setup".
If you're using SputnikNet Express, see the chapters in the online documentation section
titled "SputnikNet Express".

Manage your Sputnik-powered Linksys device using SputnikNet.
Log into your SputnikNet Account and confirm that your Sputnik-powered Linksys device
is active. Click on the name of the device to change its name, address, and other
settings such as the Wi-Fi channel and SSID. From the Sputnik-powered device's "Edit
Settings" page you can also change the captive portal that is assigned to that device.
For more information, see the online documentation chapter titled "Subscribing

fee-based Wi-Fi. For more information, see the various online documentation sections
on SputnikNet Authentication Systems.

You have full control over the branding on your captive portal pages. For more
information, see the online documentation section titled "Branding Networks with
SputnikNet".

Apply captive portals, authentication systems, and network policies to your Sputnik-Powered Linksys device.
Each Sputnik-powered device is assigned to a specific captive portal. Each portal can be
associated with one or more authentication systems. Each authentication system can
include optional network policies that are applied to authenticated users. A walled
garden is a collection of network domains (URLs) that users are allowed to browse to
before authentication, so those policies are assigned directly to captive portals.
Overview".

Try out your Sputnik-powered Wi-Fi network to make sure everything is working the way you
want it to.

Accessing your Sputnik-powered Linksys device's control panel.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik-powered Linksys
device as follows (if your Linksys device has already connected to your SputnikNet



Check out www.linksys.com for detailed information about the Linksys hardware.

Sputnik-Powered NexAira NexConnect: QuickStart Guide
How to get up and running with your Sputnik-powered NexConnect and SputnikNet.

Sputnik sells the NexAira NexConnect 3G wireless broadband router pre-flashed with
Sputnik Agent firmware. That means it works out of the box with SputnikNet to let you
centrally manage and authenticate users on a distributed Wi-Fi network.
The Sputnik-Powered NexAira NexConnect uses 3G cellular networks or traditional

DSL/cable service for backhaul. You can operate a managed Wi-Fi hotspot anywhere
within range of cellular service--even in a moving vehicle such as a bus, train, or taxi, or
ferry. Or, use the 3G connection for auto-failover in case wired broadband becomes
unavailable.
Wired and wireless network users can be authenticated by the Sputnik-powered Linksys
device, as its LAN and WLAN interfaces are bridged together. When used as a network
gateway, end-users connected to third-party wireless hardware (in bridge mode) are routed
through the Sputnik-powered device for authentication. Service providers can leave
existing wired and wireless networks in place--whether Wi-Fi, WiMAX, mesh, or other
frequency--routing network traffic through the Sputnik-powered device for authentication,
tracking, and management.

Flash your NexAira device with the latest Sputnik-Powered NexConnect firmware, if needed.
Sputnik and NexAira ship the NexConnect with Sputnik-powered NexConnect firmware
pre-installed. However, if you need to flash your NexConnect, refer to online
documentation chapter titled "Upgrading Sputnik-Powered NexConnect Firmware".
To reflash your NexConnect, we recommend directly connecting your PC to the device's

LAN port, shown.
After your NexConnect has been flashed with Sputnik-powered firmware, the default port
behavior will be:
- the RJ-45 Cat5 Ethernet port on the left is for WAN (wide area networking, or
broadband backhaul to the internet - this is optional, as the NexConnect can get its
backhaul via cellular 3G)
- the Ethernet port on the right is for LAN (local area networking) and PoE (power over
Ethernet)
The Sputnik-powered NexConnect control panel is available at:
- default URL: http://192.168.123.254


If you're intending to use your NexConnect with SputnikNet Express, our free service for
branded Wi-Fi hotspots, you can skip this step.
subscription for your Sputnik-powered NexConnect.
Each Sputnik-powered NexConnect requires a Sputnik Agent Standard subscription

(unless being used as a bridge).
Started".
Check to see that the Sputnik Agent is running on your Sputnik-powered NexConnect.
To check the Sputnik Agent status, first associate with the Sputnik-powered NexConnect
wired or wirelessly.
Log into the control panel on your Sputnik-powered NexConnect as follows (if your
NexAira device has already connected to your SputnikNet Account, you will need to log
- default URL: http://192.168.123.254


- click on the "Status" tab and scroll down.

after you complete the next step).
Subscribe your Sputnik-powered NexConnect to SputnikNet using Sputnik Instant Setup.

Associate with your Sputnik-powered NexConnect (wired or wirelessly), and subscribe it
to your SputnikNet or SputnikNet Express Account using Sputnik Instant Setup. For
more information, refer to the online documentation chapter titled "Subscribing
If you're using SputnikNet Express, see the chapters in the online documentation section
titled "SputnikNet Express".

Manage your Sputnik-powered NexConnect using SputnikNet.
Log into your SputnikNet Account and confirm that your Sputnik-powered NexConnect is
active. Click on the name of the device to change its name, address, and other settings
such as the Wi-Fi channel and SSID. From the Sputnik-powered device's "Edit Settings"
page you can also change the captive portal that is assigned to that device.

fee-based Wi-Fi. For more information, see the various online documentation sections
on SputnikNet Authentication Systems.

You have full control over the branding on your captive portal pages. For more
information, see the online documentation section titled "Branding Networks with
SputnikNet".

Apply captive portals, authentication systems, and network policies to your Sputnik-Powered NexConnect.
Each Sputnik-powered device is assigned to a specific captive portal. Each portal can be
associated with one or more authentication systems. Each authentication system can
include optional network policies that are applied to authenticated users. A walled
garden is a collection of network domains (URLs) that users are allowed to browse to
before authentication, so those policies are assigned directly to captive portals.
Overview".

Try out your Sputnik-powered Wi-Fi network to make sure everything is working the way
you want it to.

Accessing your Sputnik-powered NexConnect's control panel.
Log into the control panel on your Sputnik-powered NexConnect as follows (if your
NexAira device has already connected to your SputnikNet Account, you will need to log
- default URL: http://192.168.123.254

- click on the "Status" tab and scroll down.


Check out www.nexaira.com for detailed information about the NexConnect hardware.

Sputnik-Powered Ubiquiti NanoStation2/5: Quick Start Guide
How to get up and running with your Sputnik-powered Ubiquiti NanoStation 2 or NanoStation 5 and SputnikNet.

The Sputnik-powered Ubiquiti NanoStation is a versatile 802.11-based indoor/outdoor
wireless platform. It combines a high-gain 4 antenna system, advanced radio
architecture, and Sputnik-powered firmware, allowing extremely high throughput,
stability, performance, and centralized management at an affordable price.
Used with Sputnik-powered DD-WRT firmware and SputnikNet, the Ubiquiti NanoStation
becomes an easy-to-deploy Wi-Fi access point for access-controlled networks such as
hotspots or hotzones.

Flash your Ubiquiti NanoStation2/5 with Sputnik-Powered DD-WRT firmware, if needed.
Sputnik ships the Ubiquiti devices with Sputnik-powered DD-WRT firmware pre-installed.
However, if you need to flash your Ubiquiti device, follow the online documentation
chapter titled "Flashing Ubiquiti devices with Sputnik-Powered DD-WRT Firmware via
tftp".

- LAN/PoE cable goes from the PoE port on the PoE adapter to the RJ45 port on the
back of the Ubiquiti device (green cable in the photo)
- LAN cable goes from the LAN port on the PoE adapter to your PC, from which you will
flash (yellow cable in the photo)
Make sure that the WAN port is enabled.

follows:

Select "Basic Setup" under the "Setup" menu. For WAN Connection Type, change from
"Disabled" to "Automatic Configuration - DHCP". Click "Apply Settings" at the bottom of
the screen (not shown).

Make sure that the WAN port is correctly configured.
Select the "Networking" tab under the "Setup" menu. For WAN Port Assignment, change
from "Disabled" to "eth0". Click "Apply Settings" at the bottom of the screen (not shown).
Reboot the AP.

Sputnik-powered Ubiquiti default port and network settings.
After your Ubiquiti device has been flashed with Sputnik-powered DD-WRT firmware:
-the RJ-45 Ethernet port on the left is for WAN (wide area networking) and PoE (power
over Ethernet)
-the SMA port on the right is for attaching an optional external antenna
- default WLAN IP address is 192.168.180.1; DHCP lease subnet is 192.168.180.x


Plug your Sputnik-Powered Ubiquiti device into power and provide it with broadband.
The cabling configuration for operating your Sputnik-powered Ubiquiti device is:

- WAN cable goes from the PoE port on the PoE adapter to the RJ-45 port on the back
of the Ubiquiti device (purple cable in the photo)
- WAN cable goes from the LAN port on the PoE adapter to your broadband connection
(red cable in the photo)

If you're intending to use your Sputnik-powered Ubiquiti device with SputnikNet Express,
subscription for your Sputnik-powered Ubiquiti device.
Each Sputnik-powered Ubituiti NanoStation requires a Sputnik Agent Standard

subscription (unless it's being used as a bridge).

Started".
or wirelessly.



Subscribe your Sputnik-Powered Ubiquiti device to SputnikNet using Sputnik Instant Setup.
Be sure your Sputnik-powered Ubiquiti device has an active connection to the internet.
That connection is required for it to register with the Sputnik Instant Setup server.
Associate with your Ubiquiti device (wired or wirelessly), and open a browser. You
should be directed to the Sputnik Instant Setup page. Enter your SputnikNet ID to
"subscribe" your Ubiquiti device to SputnikNet or SputnikNet Express. For more
information, refer to the online documentation chapter titled "Subscribing
Sputnik-Powered Devices to your SputnikNet Account with Sputnik Instant Setup" or the
section titled "SputnikNet Express".

Make sure your Sputnik-powered Ubiquiti device is active in your SputnikNet Account.
Log into your SputnikNet Account and confirm that your Sputnik-powered Ubiquiti device
is active.

Manage your Sputnik-Powered Ubiquiti device using SputnikNet.
Click on the name of your Sputnik-powered Ubiquiti device to change its name, address,
that device.


with SputnikNet".

Apply captive portals, authentication systems, and network policies to your Sputnik-Powered Ubiquiti device.
Each Sputnik-powered Ubiquiti device is assigned to a specific captive portal. Each
portal can be associated with one or more authentication systems. Each authentication
system can include optional network policies that are applied to authenticated users. A
walled garden is a collection of network domains (URLs) that users are allowed to
browse to before authentication, so those policies are assigned directly to captive portals.

you want it to.

Accessing your Sputnik-powered Ubiquiti device's control panel.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik-powered Ubiquiti
device as follows (if your Ubiquiti device has already connected to your SputnikNet



Check out www.ubnt.com for detailed information about the Ubiquiti PowerStation
hardware.

Sputnik-Powered Ubiquiti PowerStation2/5: Quick Start Guide
How to get up and running with your Sputnik-powered Ubiquiti PowerStation2 or PowerStation5 and SputnikNet.

The Ubiquiti PowerStation is a versatile 802.11-based indoor/outdoor wireless platform
with exceptional radio and antenna design. The PowerStation runs the Sputnik Agent (as
part of DD-WRT firmware), making it possible to use it as an easy-to-deploy, centrally
managed Wi-Fi access point for access-controlled networks such as hotspots or
hotzones.
Both wired and wireless network users are authenticated by the Sputnik-powered
Ubiquiti device, as its LAN and WLAN interfaces are bridged together. When used as a
network gateway, users connected to third-party wireless hardware (in bridge mode) are
routed through the Ubiquiti device for authentication and tracking. Service providers can
leave existing wired and wireless networks in place--whether Wi-Fi, WiMAX, mesh, or
other internet protocol networks--routing traffic through the Sputnik-powered Ubiquiti
device for management.

Flash your Ubiquiti PowerStation2/5 with Sputnik-Powered DD-WRT firmware, if needed.
Sputnik ships the Ubiquiti devices with Sputnik-powered DD-WRT firmware pre-installed.
However, if you need to flash your Ubiquiti device, follow the online documentation
chapter titled "Flashing Ubiquiti devices with Sputnik-Powered DD-WRT Firmware via
tftp".

- LAN/PoE cable goes from the PoE port on the PoE adapter to the left-side port on the
back of the Ubiquiti device closest to the reset button (green cable in the photo) - in this
case it only carries power to the device
- WAN cable goes from the right-side port on the back of the Ubiquiti device to your PC,
from which you will flash (red cable in the photo)

Sputnik-powered Ubiquiti default port and network settings.
After your Ubiquiti device has been flashed with Sputnik-powered DD-WRT firmware, the
default port behavior will be:
-the RJ-45 Cat5 Ethernet port on the left is for LAN (local area networking) and PoE
(power over Ethernet)
-the Ethernet port on the right is for WAN (wide area networking, or broadband backhaul
to the internet)


Plug your Sputnik-Powered Ubiquiti device into power and provide it with broadband.
The cabling configuration for operating your Sputnik-powered Ubiquiti device is:
- AC power goes into the supplied PoE adapter (black cable in photo)
- LAN cable goes from the PoE port on the PoE adapter to the LAN/PoE port on the back
of the Ubiquiti device (green cable in the photo)
- optional second LAN cable goes from LAN port on the PoE adapter to devices on your
local network (PCs, printers, etc.) (yellow cable in the photo)
- WAN cable goes from the WAN port on the back of the Ubiquiti device to your
broadband connection (red cable in the photo)

If you're intending to use your Sputnik-powered Ubiquiti device with SputnikNet Express,
subscription for your Sputnik-powered Ubiquiti device.
Each Sputnik-powered Ubituiti PowerStation requires a Sputnik Agent Standard

subscription (unless it's being used as a bridge).
Started".

or wirelessly.



Subscribe your Sputnik-Powered Ubiquiti device to SputnikNet using Sputnik Instant Setup.
Be sure your Sputnik-powered Ubiquiti device has an active connection to the internet.
That connection is required for it to register with the Sputnik Instant Setup server.
Associate with your Ubiquiti device (wired or wirelessly), and open a browser. You
should be directed to the Sputnik Instant Setup page. Enter your SputnikNet ID to
"subscribe" your Ubiquiti device to SputnikNet or SputnikNet Express. For more
information, refer to the online documentation chapter titled "Subscribing
Sputnik-Powered Devices to your SputnikNet Account with Sputnik Instant Setup" or the
section titled "SputnikNet Express".

Make sure your Sputnik-powered Ubiquiti device is active in your SputnikNet Account.
Log into your SputnikNet Account and confirm that your Sputnik-powered Ubiquiti device
is active.

Manage your Sputnik-Powered Ubiquiti device using SputnikNet.
Click on the name of your Sputnik-powered Ubiquiti device to change its name, address,
that device.


with SputnikNet".

Apply captive portals, authentication systems, and network policies to your Sputnik-Powered Ubiquiti device.
Each Sputnik-powered Ubiquiti device is assigned to a specific captive portal. Each
portal can be associated with one or more authentication systems. Each authentication
system can include optional network policies that are applied to authenticated users. A
walled garden is a collection of network domains (URLs) that users are allowed to
browse to before authentication, so those policies are assigned directly to captive portals.

you want it to.

Accessing your Sputnik-powered Ubiquiti device's control panel.
Log into the Sputnik-powered DD-WRT control panel on your Sputnik-powered Ubiquiti
device as follows (if your Ubiquiti device has already connected to your SputnikNet



Check out www.ubnt.com for detailed information about the Ubiquiti PowerStation
hardware.

Deploying Sputnik-Powered Devices

Extending the range of your Sputnik-powered device using WDS.
How to establish a WDS link to extend the range of your Sputnik-powered device by connecting it wirelessly to another access point.
WDS for wireless range extension.

You can wirelessly extend the range of your Sputnik-powered device using WDS
(wireless distribution system). WDS creates a dedicated point-to-point link between the
main Sputnik-powered device and the range extender (often another wireless access
point). The main Sputnik-powered device handles user authentication and acts as a
DHCP server, which means it hands out IP addresses to clients and enables them to log
onto the network. The range extender acts as a bridge, passing traffic to the
Sputnik-powered device for DHCP leases and authentication.
WDS is a useful and often very stable way to increase the range of your wireless
network. We have found, however, that sometimes different manufacturers implement
WDS differently, and their devices are not compatible. It is therefore important to test
heterogeneous hardware for WDS compatibility before deploying in the field. Also, while
you can create multiple WDS links, because they are overhead, we suggest that you
limit them to no more than 2-4 per Sputnik-powered device.
In the following example, we'll show how to set up WDS between two Sputnik-powered
devices running DD-WRT firmware. The main Sputnik-powered device has the Sputnik
Agent enabled (for communication with SputnikNet); on the range extender the Sputnik
Agent is disabled.

Set up the main Sputnik-powered device for WDS.
Log into the DD-WRT control panel on the main Sputnik-powered device (the device that
will have its range extended). The default settings are:

Click on "Wireless" and then "WDS".
Select "LAN" from the first pop-up menu under "Wireless MAC".

Enter the range extender's MAC address.
Enter the wireless LAN MAC address of the range extender.
Click on the "Save" button (not shown) to save your settings.
IMPORTANT: take note of the main Sputnik-powered device's MAC address. It appears
at the top of the page, across from "Wireless MAC".

Take note of the main Sputnik-powered device's MAC address and channel.
Click on "Basic Settings" under the "Wireless" menu, and take note of the Wireless
Channel (here it is 6), and SSID ("javastop"). You'll need to match the channel on the
range extender. NOTE: we recommend that you set a different SSID on the range
extender. If they have the same SSID, it becomes impossible to select one device over
another.

Associate with the range extender and turn off Sputnik Agent (if running).
The range extender acts as a bridge, therefore if it is running Sputnik-powered firmware,
make sure that the Sputnik Agent is turned off. To do this, associate with the range
extender, log into its control panel, click "Services", then "Hotspot". Click the Sputnik
Agent "Disable" radio button and click "Save" to save your settings.

Set channel of range extender to match settings on main Sputnik-powered device.
Click on "Basic Settings" under the "Wireless" menu, and set the Wireless Channel (6) to
match the settings noted previously on the Sputnik-powered device. Also as noted,
choose a different SSID for the range extender than the one used by the
Sputnik-powered device. (The screen above shows the same SSID, which is allowed,
but not preferred from a device management perspective.)

Option 1: use site survey to find the main Sputnik-powered device's WDS network.
Click on "Status" under the Wireless" menu, scroll down and click on "Site Survey" at the
bottom of the page.
Join the main Sputnik-powered device's WDS network.

Find the device matching the SSID (and MAC and channel) of the main Sputnik-powered
device. Click "Join" to join its WDS network.

Option 2: manually join the main Sputnik-powered device's WDS network.
As an alternative to using site survey, you can enter the main Sputnik-powered device's
MAC address manually. To do this, click on "Wireless" and then "WDS". Select "LAN"
from the Wireless MAC pop-up menu, enter the MAC address of the main
Sputnik-powered device, and enter a descriptive name for it. Click "Save" to save your
settings.

Configure the range extender to work in bridge mode.
Click on "Basic Setup from the "Setup" menu. Set the Local IP Address to 192.168.180.x
where x does not match the address of the main Sputnik-powered device (typically
192.168.180.1) and is outside of the DHCP lease range. Here we've chosen
192.168.180.200. Do not change other "Router IP" settings.
Take note of the range extender's IP address in case you need to connect to its
web-based control panel in the future, In this example, it will be at http://192.168.180.200.
Under "Network Address Server Settings (DHCP)" click the DHCP Server "Disable" radio
button. Click the "Save" button at the bottom of the screen (not shown). Your connection
to the range extender's control panel will be disrupted.

Reconnect to the main Sputnik-powered device's control panel to monitor the WDS connection.
Log into the web based control panel on the main Sputnik-powered device. Click on
"Wireless" from the "Status" menu. Scroll down the page. The range extender's MAC
address is listed along with its signal strength.

SputnikNet Express

Getting Started with SputnikNet Express
How to create a new SputnikNet Express Account, configure your hotspot, and generate usage reports.
Make sure your Sputnik-powered device is ready.

Your router should be running the latest Sputnik Agent firmware. For more information, see the section titled "Sputnik Agent Firmware and Sputnik-Powered
Devices".
Using Sputnik Instant Setup to subscribe your device to SputnikNet Express.

If you are using Sputnik Agent firmware downloaded from www.sputnik.com, the Sputnik
Agent is enabled by default. The first time you plug your Sputnik-powered device into
broadband, it will display the Sputnik Instant Setup page, enabling you to assign the
device to SputnikNet Express.
Click on "Subscribe this device to SputnikNet Express", then click on "Apply to my

device".

Sputnik Instant Setup confirmation.
You will see a Sputnik Instant Setup confirmation page. Wait a few moments for your
settings to apply.
ALTERNATIVE: Subscribe your Sputnik-Powered Device to SputnikNet Express.

If the Sputnik Agent isn't running for some reason, you'll need to enable it from your
Sputnik-powered device's web control panel.
Associate with your Sputnik-powered device, log into its web-based control panel, and
browse to the Sputnik Agent setup page. For more specific information, see the
appropriate chapter for your device in the section titled: "Sputnik Agent Firmware and
Sputnik-Powered Devices".
Select "Enable" to enable the Sputnik Agent.
Select "Standard" for Sputnik Agent Mode.
Select "Use SputnikNet Express" for Sputnik Server ID.
Click "Apply Settings" to start the Sputnik Agent with these values.
Once done, click anywhere to refresh your browser window.
NOTE: Settings for Wifidog, Chilispot, HTTP Redirect and SMTP Redirect (if available)
do not apply to Sputnik, and for the purposes of this documentation, can be ignored.

SputnikNet Express welcome page.
You will be redirected to the SputnikNet Express welcome page. If this doesn't happen,
make sure the Sputnik Agent is "running normally - managed". For more information
about this, see the section titled "Sputnik Agent Firmware and Sputnik-Powered
Devices".
Click "Continue".
Set your SputnikNet Express Account password.

SputnikNet Express uses the same login password as your Sputnik-powered device's
web control panel.
If your Sputnik-powered device uses the default ("admin") or no password, SputnikNet

Express will ask you to change it to something more secure. IMPORTANT: changing the
password in SputnikNet Express changes the password you'll need to log into your
Sputnik-powered device's control panel, and vice versa.
Make a note of your new password in a safe place.
Click "Continue".

Password confirmation.
You will see a page that confirms that your password has changed. In 10 seconds, your
browser will refresh.
NOTE: if the window doesn't refresh in 10 seconds, click on the "here" link. If you return
to the Default Password page, you may need to set a unique password manually using
your Sputnik-powered device's control panel. To do this, unplug your device's WAN
connection so that you can browse to the local control panel without being redirected to
SputnikNet Express.
Re-log into SputnikNet Express with your new password.

Since your SputnikNet Express password has changed, you need to re-log in.

Fill out basic settings and location information.
Fill out the following fields:
- Network Name: the SSID or broadcast name that clients use to connect to your
network.
- Block Private Networks: blocks public access to your private network of computers,
printers, or other devices. For more information, see the chapter titled "Blocking Private
Networks".
- AP Owner E-Mail: the email we will use to validate your account, and to (very
infrequently) update you about SputnikNet Express.
- Address/Address 2/Country: the location of the Sputnik-powered device, used to locate
your hotspot in Google Maps, Yahoo Maps, or MSN Maps
- Time Zone: the time zone where your Sputnik-powered device is located, used to set
the time in bandwidth charges and usage stats
Click "Update".

New settings confirmation.
Any time you make a change to SputnikNet settings, you will see a confirmation pop-up
window. You can make changes to your settings at any time, for example, if you move
your Sputnik-powered device to a new location.
Click "OK" to continue.
Your new SputnikNet Express settings.

Your new SputnikNet Express settings will display, and yellow highlights (indicating
required fields that have not been filled out) will disappear.

Account verification email.
You will receive an email asking you to validate your SputnikNet Express Account. Do
this by clicking on the provided link. The email also contains a link to your SputnikNet
Express Account web address, which is a useful link to save.
NOTE: you won't receive this email until you complete your setup of SputnikNet Express.
Until then, full internet access is blocked.
Bookmark your SputnikNet Express Account home page.

It's a good idea to bookmark your SputnikNet Express Account home page for future reference.

Finding your SputnikNet Express Account home page without a bookmark.
If you lose the bookmark, you can return to your SputnikNet Express control center in the
future by going to: http://express.sputnik.com/sne/express/login. Use the email and
password you assigned in previous steps. For more information see the chapter titled
"Finding your SputnikNet Express Account URL and Resetting Your Password".

Upload graphics to your splash and welcome pages.
Click on the "portal" tab to set up venue information and upload graphics to your splash
and welcome pages.
- the splash page is the click-through page that users first see when they access the
internet through your Sputnik-powered device; it includes your brand
- the welcome page is the page that users see after they click through the splash page; it
contains your brand, content pulled from a Google, MSN, Yahoo! or Sputnik theme
(whichever you choose), and advertising
- Venue Name: the title that will appear on your splash and welcome pages.
- Venue Type: the type of venue where the Sputnik-powered device is installed. There
are over 100 possible venue types; try to pick the one that matches best. Venue
information is used, along with location information, to insert ads into the welcome page.
- Portal Theme: select Google, MSN, Yahoo! or Sputnik to define the theme for your
welcome page.
Click "Choose File" to select locally stored graphics for your splash and welcome pages.
Click "Update" to apply your changes to your splash and welcome pages.
For more information and to see what SputnikNet Express splash and welcome pages
look like, see "User Experience: SputnikNet Express Splash and Welcome Page
Themes".

Add devices that you want to access your network without logging in.
Click on the "devices" tab to enable up to 5 devices (by MAC address) to access your
Wi-Fi network without logging in. These devices, typically Wi-Fi VoIP phones, printers or
wireless gaming devices that can't display a captive portal, will automatically connect to
your network. Of course, you can add the MAC address of your laptop if you want to skip
logging in, too.
A device's "MAC" address is 12 numbers and letters usually separated by colons (e.g.
00:14:bf:aa:02:3c). It can be found printed on your wireless card, on the back of the
wireless device or can be viewed from a configuration menu on the device.
Add a device's MAC address and give it a name. Click "Update" for your changes to be
applied.
To remove a device from the list, erase its MAC address and click "Update".

View usage data.
Click on the "usage" tab to view usage data by MAC address (since users don't log on
they're tracked by MAC address).
Terminate sessions.
If you notice recurring bandwidth hogs, you can terminate their sessions remotely. Check
the box next to the appropriate client and click "Terminate Selected Sessions".

View usage graphs.
Click on the "charts" tab to view sessions and bandwidth usage over the past three days.
If you need better reporting capability, check out what SputnikNet can do in the section
titled "SputnikNet Reports".

User Experience: SputnikNet Express Splash and Welcome Page Themes
How to customize the appearance of your SputnikNet Express splash and welcome pages using your brand combined with location-aware page themes from
Google, Yahoo, MSN, and Sputnik.
Log into your SputnikNet Express Account.

Log into SputnikNet Express as described in the chapter titled "Getting Started with
SputnikNet Express".

Captive portal settings and venue graphics.
Click on the "portal" tab to set up venue information and upload graphics to your splash
and welcome pages.
- the splash page is the click-through page that users first see when they access the
internet through your Sputnik-powered device; it includes your brand
- the welcome page is the page that users see after they click through the splash page; it
contains your brand, content pulled from a Google, MSN, Yahoo! or Sputnik theme
(whichever you choose), and advertising
Be sure the following fields are filled out:
- Venue Name: the title that will appear on your splash and welcome pages.
- Venue Type: the type of venue where the Sputnik-powered device is installed. There
are over 100 possible venue types; try to pick the one that matches best. Venue
information is used, along with location information, to insert ads into the welcome page.
- Portal Theme: select Google, MSN, Yahoo! or Sputnik to define the theme for your
welcome page.
Click "Update" for any changes to take effect.

Upload graphics to splash and welcome pages.
Click "Choose File" to select locally stored graphics for your splash and welcome pages.
Splash page graphics should be no larger than 640x480 pixels. Welcome page graphics
should be no larger than 300x125 pixels.

Update your splash and welcome pages.
Click "Update" to apply your changes to your splash and welcome pages.
If you need more control over captive portal pages, check out SputnikNet's capabilities in
the section titled "Branding Networks with SputnikNet".

Splash page with your brand.
The user will see your branded splash page when they connect to your network. Accessing the
internet is hassle-free-- once they "Click to get on-line", they have internet connectivity.

Welcome page with your brand - Google theme.
Since the Google theme was selected, after users connect to the internet they see your
brand with the Google page theme.
The Google page theme includes a map of your location and location-aware links for:
- Weather
- Movies
- Local search
SputnikNet Express welcome pages show advertising from our sponsors. If you want to
control and monetize advertising on your site, see "Advertising with SputnikNet".
Location-aware weather.
For example, if the user clicks on the "Weather" link, they'll see a Google search result
for a weather forecast for your region.

Changing to a Sputnik page theme.
You can easily change page themes by simply selecting the one you want from the
"Portal Theme" pop-up menu.
Welcome page with your brand - Sputnik theme.

The Sputnik page theme includes your brand and a sponsorship note.

Changing to a Yahoo! page theme.

Welcome page with your brand - Yahoo! theme.
The Yahoo! page theme includes a map of your location and location-aware links for:
- Weather
- Movies
- Local search

Changing to an MSN (Microsoft Network) page theme.
Welcome page with your brand - MSN theme.

The MSN (Microsoft Network) page theme includes a map of your location.

Finding your SputnikNet Express Account URL and Resetting Your Password
How to find your SputnikNet Express Account control center if you don't know its web address (URL). Also, how to reset your SputnikNet Express password if you've
forgotten it.
Finding your SputnikNet Express Account home page.

If you lose the bookmark, you can return to your SputnikNet Express control center in the
future by going to: http://express.sputnik.com/sne/express/login. Use the email and
password you assigned in previous steps. Click "Submit" to see a list of your SputnikNet
Express Accounts.

Select the appropriate SputnikNet Express Account.
If you have multiple accounts, select the one you want to login to.
ALTERNATIVE: Finding your SputnikNet Account home page by MAC address.

If you know the address of your SputnikNet device, you can form the URL of your
SputnikNet Account home page as follows:
- https://express.sputnik.com/sne/express/MAC/main
where MAC is your Sputnik-powered device's MAC address with the colons removed, all
lower case.

Resetting your SputnikNet Account password.
Your Sputnik-powered device's password is the same as your SputnikNet Account
password. The way to reset both of them back to the default password is to reset the
To do this, hold the device's reset button in for 10 seconds. Re-associate with your
Sputnik-powered device and browse to your SputnikNet Express Account home page. (If
you see your SputnikNet Express splash page, click through to log into the internet.)
You will be prompted to log in. Enter the default password (typically, "admin).
Restarting the Sputnik Agent (optional).

Some versions of Sputnik-powered firmware do not restart the Sputnik Agent
automatically. If this happens, after restarting, your Sputnik-powered device will be
"open". In other words, it will not be connected to your SputnikNet Express Account, and
will allow unblocked access to the internet.
To restart the Sputnik Agent, log into your Sputnik-powered device's control panel (using
the default username and password), browse to the appropriate page, click "Enable"
next to the Sputnik Agent, and apply settings. For more information, see the appropriate
chapter for your device in the section titled "Sputnik Agent Firmware and
Sputnik-Powered Devices".

Changing your password to something more secure.
Remember to change your password to something more secure. Do this from your
Sputnik-powered device's control panel. In the case of DD-WRT firmware, change your
password from the "Management" page underneath the "Administration" tab.
Your SputnikNet Express password will automatically update.

SputnikNet: Getting Started

Creating a new SputnikNet Account
How to create a new SputnikNet Account.
Choose a SputnikNet Starter Kit with or without Sputnik-powered hardware.

Click on the "Store" tab from Sputnik's main web site (<a>http://www.sputnik.com) or go
directly to <a>http://store.sputnik.com.
SputnikNet Starter Kits include (1) a SputnikNet Account set-up, (2) a monthly or annual
pre-paid SputnikNet subscription, and, (3 - optional) a Sputnik-powered device.
SputnikNet subscriptions are either standard or pro, depending upon the device.
Intel-class devices such as the Sputnik 720 require a pro subscription; all other devices
require a standard subscription.
Need to add Sputnik-powered devices? You can purchase additional devices from our
online store, or through our partners, such as Streakwave.
Need to add SputnikNet subscriptions for those devices? Add those directly from
SputnikNet. See the online chapter titled: "Adding Sputnik-Powered Device
Subscriptions to your SputnikNet Account".

Enter your preferred Account Name, then click Add to Shopping Cart.
Enter your preferred SputnikNet account name. Valid SputnikNet Account names contain
from 1-12 alphanumeric characters, all lowercase; they cannot start with a number.
If the name chosen is not unique, we will contact you for an alternative.
View your shopping cart.

Click "View Cart" when you are ready to review your order.
Review your order and check out.

Double-check your order, then click "Proceed to Checkout".

Complete registration (if you don't already have a Sputnik Store Account).
Complete your registration if ordering for the first time, and then proceed to purchase.

Complete payment information, and purchase.
Enter your payment information. Credit card information is not stored by Sputnik, but
only with our payment processer, for your safety and security. IMPORTANT: make sure
the "Save My Credit Card Information" is checked. This information is used to process
recurring SputnikNet subscriptions, future payments, refunds, etc.

You'll receive a confirmation email from Sputnik.
You should receive an email within 12 hours confirming that your SputnikNet Account
has been created (most likely significantly sooner).
IMPORTANT: Save the email in a safe place as it includes your account name, URL,
and password.

Sign in to your SputnikNet Account.
Click on the URL in the email to go to your SputnikNet control center. Log in with your
username and password.
You're ready to build and manage your Sputnik-Powered network!

Setting up Payment Information for SputnikNet Subscriptions
In order for Sputnik to process recurring SputnikNet subscription transactions, you need to enter payment information into the Sputnik online store. (If you checked
"Save My Credit Card Information" when you made your original purchase with Sputnik, and your credit card information is up-to-date, you can skip this lesson.)
Browse to the Sputnik online store.

Either click on the "Store" tab from www.sputnik.com or go directly to
http://store.sputnik.com.

Log in.
Log in with your email address and password. Click "Continue".
Edit your Profile.

Click on "Edit Your Profile" under "Support".

Enter your payment information.
Select "Payment Information" under "Customer Profile". Enter the appropriate credit card
information. Click "Continue". IMPORTANT: make sure "Save My Credit Card
Information" is checked so that we can process future subscription payments. This is
also useful for expediting future purchases with Sputnik, for refunds, etc.

SputnikNet Status Overview Page
How to check the status of your SputnikNet network at a glance.
Log into SputnikNet and view the Status Overview page.

When you first log into SputnikNet, you will be redirected to the Status Overview page.
Click on Status Overview at any time to return to this page.
Site Statistics and Management System Status.

Site Statistics gives you a quick snapshot of your Sputnik-Powered network.
- Clicking on "active routers" displays currently active Sputnik-Powered devices

managed by your SputnikNet Account
- Clicking on "total router records" displays both active and inactive Sputnik-Powered
devices managed by your SputnikNet Account
See "Configuring and Managing Sputnik-Powered Devices" for more information about
these features.
- Clicking on "client sessions" displays currently active user sessions across all active
Sputnik-Powered devices
- Clicking on "View more client stats" displays all active and inactive user sessions
across all Sputnik-Powered devices
See "Generating Reports" for more information about these features.
Management System Status displays a checkpoint that tests database responsiveness

and integrity. If the checkpoint value exceeds 300 seconds (5 minutes), there may be a

problem with your SputnikNet Account. Please contact Sputnik to report the problem.
SputnikNet Terms and Usage.

The Terms and Usage section is a quick glossary of key SputnikNet concepts with some
useful links.
- Captive Portal "View All" link displays the Captive Portal list. For more information
about this topic, see "Branding your Wi-Fi Network with Captive Portals".
- Network Policy "View All" link displays the Network Policy list. For more information,
see "SputnikNet Network Policies".
- Router "View All" link displays the complete list of Sputnik-Powered devices. For more
information, see "Managing Sputnik-Powered Devices with SputnikNet".
- Session "View All" link displays all active and inactive user sessions across all
Sputnik-Powered devices See "SputnikNet Reports" for more information.

Logging Into your SputnikNet Account, Changing your Password, and Logging Out
How to log into your SputnikNet Account, change your password, and log out.
Log into your SputnikNet Account.

Log into your SputnikNet control center.
Your SputnikNet Account URL is of the form: https://scc01.wifi.sputnik.com/myaccount

where "scc01" is the number of the server your Account is hosted on (e.g. "scc07") and
"myaccount" is the name that you chose for your SputnikNet Account.
Login username is admin. Your original password was emailed to you.

Change your admin password.
It's a good idea to change your password periodically.
Log into your SputnikNet Account and select "Change Password" from the CONFIG menu.

Enter a new password for your admin account.
Enter your current password (originally emailed to you).
Type in a new password and re-enter it to make sure there are no typos.
Click "Change Password" for the new password to go into effect.
Be sure to record your password in a secure place.
Log out of SputnikNet.

Whenever you're ready to log out of SputnikNet, simply click on the "Sign Out" button at
the upper right hand side of any page.

Submitting a Lost Password Request
How to request a new password should yours become lost.
Browse to your SputnikNet Account.

Click "Report a bug".
Submit a lost password request.

Fill out the support request form as shown. We will email a new password to you.

Configuring your SputnikNet Account
How to set basic SputnikNet Account options, such as administrator email, alerts, and time zone.
Log into SputnikNet, then select Control Center under the CONFIG menu.
To configure SputnikNet Account options, select "Control Center" from the "CONFIG" menu.

Set up your SputnikNet site name, mailing list and alerts status.
If you want to change the name of your site as it appears on SputnikNet web pages,
enter it into the "Site Name" field.
The primary site contact email corresponds to your Sputnik online store account login. If
you need to change it, submit a support request by clicking on "Report a Bug" in the
upper right corner of the page.
If you would like the primary site contact to receive infrequent Sputniknet emails (usually
about software updates), make sure that the "SputnikNet Mailing List" box is checked.
If you would like the site administrator to receive emails if Sputnik-Powered devices
(routers) become inactive, select the checkbox next to "Send Router Inactive E-mails".
NOTE: if a different email is assigned to a particular Sputnik-Powered device, that email
will be used by default. The Site Contact email is used as a backup if a router has no
other email assigned to it.
Set the session monitor logo.

You can customize the logo on the session monitor window. For information on the
session monitor window and how to do this, see "Branding the Session Monitor Window".
Set idle timeout.

Session Idle Timeout is the amount of time, in seconds, before a user's session is ended
if no traffic is sent or received. The default is 900 seconds, or 15 minutes. In this case, if
a user were to leave a hotspot without terminating their session using the Session
Monitor window, their session would end within 15 minutes, after which they would have

to re-log in to access the internet. NOTE: if MAC authentication is enabled (for example,
in the case of paid Wi-Fi access), their device will re-log in automatically when they
re-associate with your hotspot.
For accounting purposes, user sessions end when they are terminated, either by the
user via the Session Monitor Window, or by idle timeout.
Note that the idle timeout value should be lower than the Sputnik-Powered device's
DHCP lease period in order to be effective (for devices that utilize DHCP). This is
because a DHCP lease renewal generates network traffic and restarts the idle timeout
clock.
Enable or disable router provisioning.

If you do not want new Sputnik-Powered devices to be able to automatically subscribe to
your SputnikNet Account, check "Disable Router Provisioning". This is used in cases
where you have unused Subscriptions that you do not want to make available to
anybody who subscribes their Sputnik-Powered device to your SputnikNet Account.
Set inactive AP handling.

This setting controls what happens to sessions on Sputnik-powered devices that have
lost contact with SputnikNet once they regain connectivity. In other words, it defines how
to handle idle timeout in the event that a Sputnik-Powered device temporarily loses
contact with SputnikNet. Options are:
- Retain until AP/Router returns: user sessions will continue after the Sputnik-Powered
device reconnects with SputnikNet
- Terminate after DHCP lease expires: user sessions will be terminated at DHCP lease

expiration
- Terminate 15 minutes after DHCP lease expires: user sessions will be terminated 15
minutes after DHCP lease expiration
- Terminate one hour after DHCP lease expires: user sessions will be terminated one
hour after DHCP lease expiration
Set session archive period.

Select the amount of time to keep user session and Sputnik-Powered device usage data
in your SputnikNet database. If your network is extremely active, you should select a
shorter period to improve performance.
License Serial Number.

This information is used to uniquely identify your SputnikNet Account. It is not editable.
Enter the number of Sputnik Agent NMS, Standard, and Pro Subscriptions you wish to assign to your account.
As your network expands or changes, you can increase or decrease the number of
Sputnik-Powered devices subscribed to your SputnikNet Account.
As you make changes, your recurring billing will be updated automatically.
For more information about SputnikNet Subscription levels, see "Sputnik Agent NMS,
Standard, and Pro".

Set time zone.
Set the primary time zone that you operate in. This setting controls the presentation of
most timestamps, including captive portal pages.
Save your changes.

Click "Update" (scroll down to the bottom of the page) to save your changes.

Using SputnikNet in read-only "Viewer" mode
How to provide read-only access to a SputnikNet Account, e.g. for support reps.
Log into your SputnikNet account as "admin".

Use your default administrative account to log into your SputnikNet account.

Choose the user authentication system.
Click "Users" from the left-side menu bar.

Choose the "default" user authentication system.
Click "default" under Authentication System.
Select users.
Click "Users" in the authentication system main menu.

Ad a new user account.
Click the "Add New Login" button.
Add a new user called "viewer".

The viewer user must be named "viewer". Their display name can be anything. Provide
and verify their password.

Confirm that the viewer user has been added.
The "viewer" user is listed under Login ID.
Add a new group for the viewer user account.

You must assign the viewer account to a group. To do this, click on the Groups menu,
then "Add New Group" Name the new group "viewer" (or something else if you prefer)
and click "Add Group".

Confirm that the new group has been added.
You will see the new group, here called "viewer", added to the list of groups.

Add the viewer user account to the new group.
Click on the Users menu and select the viewer account to edit it. Click the checkbox by
the name of the group you created to assign the viewer account to it. Click "Update".
Sign out as administrator.

Click "Sign Out" in the upper right hand side of the SputnikNet window.

Log in as viewer.
Enter "viewer" and the password you set previously. Click "Login".
Confirm that you are in viewer mode.

You will see "Logged in as VIEWER role. No site configuration changes can be made."
at the top of every screen. Every page in the SputnikNet user interface is available to
you, however buttons that would enable a user with administrative privileges to make
configuration changes do not appear.

Subscribing Sputnik-Powered Devices to
your SputnikNet Account

Adding Sputnik-Powered Device Subscriptions to your SputnikNet Account
How to increase (or decrease) the number of Sputnik-Powered devices subscribed to your SputnikNet Account.
Log into your SputnikNet Account, then select Control Center under the CONFIG menu.
To configure SputnikNet Account options, select "Control Center" from the "CONFIG" menu.

Enter the number of Sputnik Agent NMS, Standard, and Pro Subscriptions you wish to assign to your account.
As your network expands or changes, you can increase or decrease the number of
Sputnik-Powered devices subscribed to your SputnikNet Account.
As you make changes, your recurring billing will be updated automatically.
For more information about SputnikNet Subscription levels, see "Sputnik Agent NMS,
Standard, and Pro"
Save your changes.

Click "Update" to save your changes.

Subscribing Sputnik-Powered Devices to your SputnikNet Account with Sputnik
Instant Setup
How to use Sputnik Instant Setup to subscribe a Sputnik-Powered device to your SputnikNet Account, and provision it automatically. [need screens]
What is Sputnik Instant Setup?

Sputnik Instant Setup is a web site that enables you to assign a Sputnik-Powered device to a specific SputnikNet Account. Once you've done this, you can use your
SputnikNet Account to manage the device from anywhere over the web.

Connect to your Sputnik-powered device and attempt to browse to any page (other than
the administrative control panel).
You will be redirected to Sputnik Instant Setup (SIS).
Carefully enter your Sputnik Account ID, as follows:


"Assign".

Wait a few minutes to be sure that your Sputnik-Powered device has successfully
registered with your SputnikNet Account. If you are not redirected to your SputnikNet
administrative account, reboot the Sputnik-powered device and reconnect to it.
WARNING: a typo here can screw things up.

A common error people first trying out Sputnik make is to enter an email address or some
other bogus SputnikNet ID. For example, if you mistype "wif.sputnik.com" instead of
"wifi.sputnik.com" your Sputnik-powered device will attempt to find the non-existent
SputnikNet site.
Unfortunately, the Sputnik Instant Setup server doesn't know whether the ID is valid or not,
and the invalid entry sticks in our database. This renders your Sputnik-Powered device
useless until we reset it to a valid SputnikNet ID.
To recover from this error see "Changing or Correcting your Device's SputnikNet
Subscription".
Check to see that your Sputnik-powered device connects to your SputnikNet Account.
Log in to your SputnikNet Account and look for the Sputnik-powered device to show up on the Router List.
NOTE: If you're using SputnikNet Express, you'll be redirected to the SputnikNet Express configuration pages automatically. See "Creating a new SputnikNet
Express Account" for more information.

Troubleshooting: check to be sure the Sputnik Agent is running.
If you don't get the Sputnik Instant Setup page, log into the local web interface on the
Sputnik-Powered device. If running DD-WRT, login at http://192.168.180.1 with
username root, password admin. For Sputnik-Powered NexAira firmware, go to
http://192.168.123.254; default password is admin.
Select "Status/Sputnik Agent".
"State" should show "Running normally - Managed". If it shows a different message,

refer to the "Troubleshooting" section.

Correcting or Changing your Device's SputnikNet Subscription
How to recover if you enter a typo into Sputnik Instant Setup, and how to change your Sputnik-powered device's subscription to a new SputnikNet Account.
Entering an invalid SputnikNet ID in Sputnik Instant Setup.

A common error people first trying out Sputnik make is to enter an email address or
some other bogus SputnikNet ID. For example, if you mistype "wif.sputnik.com" instead
of "wifi.sputnik.com" your Sputnik-powered device will attempt to find the non-existent
SputnikNet site.
Unfortunately, the Sputnik Instant Setup server doesn't know whether the ID is valid or
not, and the invalid entry sticks in our database. This renders your Sputnik-Powered
device useless until we reset it to a valid SputnikNet ID.
Review Sputnik Instant Setup confirmation page.

It's a good idea to review the SputnikNet Account ID (here called "SCC management
ID") setting in the confirmation page that appears next. Here you'll notice that the
Sputnik-powered device has been "assigned" to an non-existent SputnikNet Account.

"Server not found" error.
You will be redirected to your SputnikNet Account's control center-- but in this case, it
doesn't exist, so your browser will display a "server not found" error.
"Not connected to messaging system" error.

If you attempt to go to any other page, you'll get an error saying that you are "not
connected to a messaging system". (It may also briefly say "preparing to reconnect with
messaging system".) This means your Sputnik-powered device has been unable to find
the non-existent SputnikNet server.
IMPORTANT: take note of the AP MAC Address, shown on this page, as you'll need it to
subscribe your Sputnik-powered device to a valid SputnikNet Account.
Gaining Internet access through the Sputnik-powered device until it is re-subscribed to the appropriate server.
This and the next two steps describe how you can open the Sputnik-powered device until your able to correct or change its subscription settings. This involves
disconnecting the Sputnik-powered device from the Internet, disabling the Sputnik Agent, and then using the device as an open AP.
First, disconnect the Sputnik-powered device from the Internet by unplugging the ethernet cable from its WAN (or "Internet") port. Then power cycle the device.

Re-associate with your Sputnik-powered device and disable the Sputnik Agent.
Follow instructions appropriate for your specific device in the "Sputnik Agent Firmware
and Sputnik-Powered Devices" section.
For example, using DD-WRT firmware, select "Disable" next to "Sputnik Agent" and click
"Apply Settings".
Re-connect your Sputnik-powered device to the internet.

Plug the ethernet cable back into the Sputnik-powered device's WAN (or "Internet") port. Your Sputnik-powered device is now operating in open AP mode - it will not
attempt to reach SputnikNet nor authenticate users.
Submit a support incident to Sputnik from your SputnikNet Account...

Initiate a support request from your SputnikNet control center...

...or from Sputnik's web site.
or from the "Support" tab on Sputnik's web site.
Fill out the support request form.

Enter your company name, email address, subject, and SputnikNet domain name.
Select "SputnikNet" for Support Issue.
Select "Sputnik Instant Setup: assign to new SputnikNet ID".

Complete the support request form.
IMPORTANT: be sure to include your device's WAN or LAN MAC address (if you forgot
to write it down, you can obtain it from the back of the device or from the status page on
the device's web-based control panel).
Also, be sure to include the name of the SputnikNet site that you want to subscribe the
device to.
Click "Send your request".
Wait for an email from Sputnik confirming the change.

You will receive email confirmation from Sputnik.
Follow the steps in "Subscribing Sputnik-Powered Devices to your SputnikNet Account

with Sputnik Instant Setup" to re-enable the Sputnik Agent and subscribe your device to
the correct Account.

Device Management with SputnikNet

Configuring Sputnik-Powered Devices: Basic Settings and Status
How to configure Sputnik-powered devices, assign them to locations and venue categories, and view status.
Log into SputnikNet, then select Routers under the CONFIG menu.
To configure Sputnik-powered devices, select "Routers" from the "CONFIG" menu.

Displaying all Sputnik-Powered devices.
By default, you'll see a list of all Sputnik-powered devices that are subscribed to your
SputnikNet Account.
Active routers are highlighted.

Displaying active Sputnik-Powered devices and changing which fields are shown.
You can change the fields that get displayed in the router list, view active or inactive
routers only, and expand the list to show 10, 25, 50 or all Sputnik-Powered Devices.
Possible fields include:
- Active Since: most recent date/time that the Sputnik-powered device went active
- Sessions: the number of user sessions, if any, that are active on the device
- Location: brief description of where the Sputnik-powered device is located
- Contact: name of the contact person for the device
- Provisioned: date/time that the Sputnik-powered device was first provisioned
- MAC: LAN MAC address of the Sputnik-powered device
- Firmware Version: version of Sputnik Agent software running on the device (if a more
recent version exists, there will be a "Reflash" button on the upper right of the page)
- SSID: the name of the device's wireless network
- Channel: wireless channel on which the Sputnik-powered device is transmitting/receiving
- Interfaces: WAN (wide area network - route to internet) and LAN/WLAN (local area
network/wireless local area network - IP addresses served to clients via DHCP) - the
latter are bridged if there are LAN ports, otherwise just WLAN
Searching for Sputnik-powered devices.

You can search for Sputnik-powered devices (or captive portals) by name. Simply enter
your search in the "Router search" field, then click on "Search for Routers".
NOTE: searches are case-sensitive (e.g. "Foo" is different from "foo"). The wild-card %
can stand for one or more alphanumeric characters.

Selecting a Sputnik-powered device.
To select a specific Sputnik-powered device, click on its name in the "Configure Router"
column.
Editing basic settings for a Sputnik-Powered device.

Here's where you enter basic settings for the Sputnik-powered device such as:
- Router Name: the name of the Sputnik-powered device that is displayed in SputnikNet
(ignore the "Lock Name?" checkbox as it is not supported by current routers)
- Admin Contact: the name of the administrative contact and his or her email address (if
not supplied, the default email address for the SputnikNet Account is used)
- Location (brief): a brief description of the Sputnik-powered device that is displayed in
SputnikNet
- Venue type: more on that, below
- Address: street address of the Sputnik-powered device
- SSID: the name of the device's wireless network
- Power: ignore this setting; instead, use the power setting in the device's built-in web
management interface
- Portal: the name of the captive portal assigned to the Sputnik-powered device
For more information about captive portals, see "Branding your Wi-Fi Network with
Captive Portals".
Click "Save Settings" to apply any changes to the Sputnik-powered device's

configuration.

Setting the venue type.
Set the type of venue where the Sputnik-powered device is installed from the pop-up menu. There
are over 100 possible venue types; try to pick the one that matches best.
Venue information is used, along with location information, to insert ads into the user experience
when using SputnikNet advertising functions. For more information, see "Advertising with SputnikNet
(Beta)".

Mapping a Sputnik-powered device.
Click "Map" to display the location of the device.
Displaying the Sputnik-powered device in Google Maps.

A new browser window will pop up showing the Sputnik-powered device's location in
Google Maps.

Sputnik-Powered device status information.
Under "Current Status" there is a brief realtime summary of the status of the
Sputnik-powered device:
- Platform/Hardware: hardware type

- Agent Mode: NMS, Standard or Pro (for more information see: "Sputnik Agent NMS,
Standard, and Pro")
- Firmware Version: version of Sputnik Agent software running on the device (if a more
recent version exists, there will be a "Reflash" button on the upper right of the page)
- Interface Configuration and MAC address: WAN and LAN/WLAN - the latter are
bridged if there are LAN ports, otherwise just WLAN - plus corresponding MAC addresses
- Provisioned: date/time that the Sputnik-Powered device was first provisioned
- Active Since: most recent date/time that the Sputnik-Powered device went active
- Current Sessions: user clients currently connecting to the internet through the
Sputnik-Powered device; clicking on any one of them goes to more detailed session
information about that client
Sputnik-Powered device policies.

Under "Router Policies" there is a summary of policies applied to the Sputnik-Powered
device including:
- Network Policies inherited from the captive portal applied to the device
- Walled Garden Policies, typically applied directly to the device
- Additional Network Policies inherited from authentication systems applied to the device
For more information about policies and walled gardens, see "SputnikNet Network
Policies".

Pinging, Remotely Rebooting and Reflashing Sputnik-Powered devices
How to ping, reboot and reflash Sputnik-powered devices over the internet.
Selecting a Sputnik-Powered device.

column.
Pinging a Sputnik-Powered device.

To send a ping to a Sputnik-Powered device, click on the "Ping" button at the upper right
side of the page. The button will say "Pinging..."
If the ping is successful, the button will briefly flash green, stating "ALIVE", then the ping
time in seconds. An unsuccessful ping indicates that there is a network problem
somewhere between the Sputnik-powered device and the SputnikNet server. See
"Troubleshooting" for networking tips.

Rebooting a Sputnik-Powered device.
To reboot a Sputnik-Powered device, click on the "Reboot" button at the upper right side of the page.
Confirm that you want to reboot the device.

If there are active client sessions, you will be asked to confirm. (Client sessions will be
briefly terminated during rebooting.)

Wait approximately one minute.
A second pop-up window will appear notifying you that the reboot request was sent.
SputnikNet will ping the device after a reboot.

When the rebooting process is complete, the button will change from "Rebooting..." back
to "Reboot". SputnikNet will then attempt to ping the device.
If the ping is successful, the button will briefly flash green, stating "ALIVE", then the ping
time in seconds.

Reflashing a Sputnik-powered device.
If the "Reflash" button appears at the upper right side of the page, there is a newer version of Sputnik Agent
software available for your Sputnik-Powered device. If you hover over the "Reflash" button, a tooltip will
appear indicated the current and available Sputnik Agent versions.
Click on "Reflash" to initiate a software update.
Confirm that you want to reflash the device.

If there are active client sessions, you will be asked to confirm. (Client sessions will be
briefly terminated during reflashing.)

Wait approximately two minutes.
A second pop-up window will appear notifying you that the reflash request was sent.
Check to see if the reflash is successful.

If the software update is successful, the "Flashing..." button will disappear ( there will no longer be a "Reflash"
button).
You may need to refresh your browser window manually.

Overview of Policy and Authentication Overrides
How to apply network policies, walled gardens, and authentication systems directly to a Sputnik-powered device. (See "SputnikNet Network Policies" for more
information.)
Selecting a Sputnik-Powered device.

column.
Setting policy and authentication overrides.

Click on "Policy and Authentication Overrides" for the Sputnik-powered device.

Overriding policies and authentication systems.
Select walled garden rules, other network policies, and authentication systems that you
wish to apply directly to the device. Click "Save Overrides" to apply your changes.
Typically, policies and authentication systems are applied to a Sputnik-powered device

through the captive portal assigned to it. However, in some cases you may want to apply
them directly to the Sputnik-powered device, in which case they override (in the case of
network policies) or supplement (in the case of authentication systems) captive portal
settings.
Typically the only type of network policy applied directly to Sputnik-powered devices are
port forwarding rules, which could, for example, enable you to remotely log into the web
management interface of a device (say a security camera) on the Sputnik wireless local
area network.
For more information about network policies, see "SputnikNet Network Policies".

Quality of Service (QoS) and Bandwidth Throttling
How to apply basic quality of service (QoS) and bandwidth throttling to your Sputnik-powered devices.
Access the Sputnik-powered device ("routers") list.

Even one user running a peer-to-peer (P2P) file sharing program can ruin network performance for all of the customers on your
Wi-Fi network.
- Quality of Service (QoS) management enables you to stop users running common P2P applications from abusing your bandwidth
- Bandwidth throttling enables you to cap the total amount of bandwidth used by your Sputnik-Powered device, useful if it is part of
a larger network
SputnikNet enables you to utilize these features on Sputnik-powered devices using Sputnik-powered DD-WRT firmware running
Sputnik Agent version 3.3.6.2 or higher. To turn on QoS/Throttling for selected Sputnik-powered devices on your network, log into
SputnikNet and select "Routers".

Select the Sputnik-powered device you want to configure.
Click on the name of the router you want to configure in the Sputnik-powered device list.

Turn on QoS/Throttling for the Sputnik-powered device.
If basic QoS management and bandwidth throttling is available for that Sputnik-powered
device, you will see a "QoS/Throttling" checkbox. Check it to continue.

Set upload and download bandwidth throttling limits.
Once "QoS/Throttling" is selected, you can set upload and download limits. Those
settings prevent the Sputnik-powered device from utilizing fixed bandwidth limits, useful
if it is part of a larger network. Click "Save Settings" to apply your changes.

Executing commands on Sputnik-powered devices
How to execute basic Unix commands on Sputnik-powered devices using SputnikNet's built-in pseudo-shell.
Select the Sputnik-powered device you want to manage.

Log into SputnikNet, click on "Routers" from the main SputnikNet menu on the left-hand
side. Select the router you want to manage and click on its name from the "Configure
Router" column.

Select Execute Command.
Click on "Execute Command" from the Router menu.
Execute Command page.

The Execute Command page provides a pseudo-shell window where you can view the
results of the most recent command sent to the Sputnik-powered device, but which does
not preserve "state" as a regular shell or terminal window would. You can enter a
command manually or choose from a pre-defined list of commands.
You can also choose whether or not to view the results of the command. Click the "No"
button next to "Output?" if you do not want to see results. You would do this, for
example, to send a "reboot" command to the Sputnik-powered device; otherwise your
browser would get stuck waiting for results that the device would not return.

Pre-defined commands.
Pre-defined commands include:
- DHCP Config: tells you how many DHCP leases you have, how long they are valid for,
how many clients the router will support
- DHCP Clients: lists active DHCP leases
- DHCP Configs: similar to DHCP Config, but provides raw values, more data
- Dynamic DNS config: parameters used for dynamic DNS registration
- Dynamic DNS log: latest results of dynamic DNS registration
- WAN Details: WAN interface configuration settings
- LAN Details: LAN interface configuration settings
- Custom DDNS Details: similar to Dynamic DNS config, but provides raw values, more
data
- All DDNS Details: same as above, but for all Dynamic DNS settings, not just custom
- Interface Details: shows IP addresses assigned to various interfaces on the
Sputnik-powered device
- Uptime (chosen in this example): how long the device has been up and load averages
- Hosts File: lists entries in Sputnik-powered device's host database (IP addresses and
domain names)
- Hostname: Sputnik-powered device hostname
- Iptables List: firewall rules
- Iptables List No Lookup: firewall rules listed as IP addresses, not domain names
- Iptables NAT: firewall NAT listing
- Iptables NAT No Lookup: firewall NAT listing shown as IP addresses, not domain names
- Iptables MANGLE: firewall mangle listing
- Iptables MANGLE No Lookup: firewall mangle listing shown as IP addresses, not
domain names
- Iptables FILTER No Lookup: firewall filter listing
- NVRAM Show All Sorted: show all Sputnik-powered device settings
- NVRAM Show Sputnik: show all Sputnik Agent configuration settings

Sending a pre-configured command.
Select the command from the list, make sure "Output?" is set to "Yes", and click "Send
Command".
Review the command output.

The output of your command will appear in the pseudo-terminal window. You can copy
and paste the results into another application.
Sending a command using the Input field.

Enter the command at the Input field, make sure "Output?" is set to "Yes", and click
"Send Command".

Review the output of your command.
The output of your command will appear in the pseudo-terminal window. You can copy
and paste the results into another application.

Setting up OpenDNS on Sputnik-powered devices
How to use OpenDNS' free service to enable content filtering on your Sputnik-powered devices.
If you don't have a free OpenDNS account, create one.

Sign up for a free account at www.opendns.com. If you already have an account, skip
ahead.
Please note: while not required when creating your OpenDNS account, later on you will
need to log into OpenDNS from the same network where you'll be hosting your first
Sputnik-powered device. The reason is that, when you configure your first OpenDNS
network settings, your session's IP address will need to match the network IP that you
are managing.
Select OpenDNS account type.

For the purpose of working with SputnikNet, it doesn't matter what type of account you
select. Small/Medium Business or Enterprise are fine.

Choose "Router" for OpenDNS setup.
Click on "Router" since you'll be applying OpenDNS to one or more Sputnik-powered
routers.
Select a router type.

Again, for the purpose of working with SputnikNet, it doesn't matter what type of router
you select. You simply need to select one to skip forward to Step 2. Click on "general
router instructions" to continue.

Continue to step 2.
You can ignore the instructions on the setup page, since this will be handled automatically by SputnikNet. Simply
click on the "Continue to Step 2" button.
Enter your account information.

Fill out your account information and click "Create Account".

Account setup confirmation.
You will receive a confirmation email from OpenDNS. Click the provided link to confirm
your registration. You can then click on "Manage settings in your Dashboard" to
configure your OpenDNS account.
Sign in to your OpenDNS Dashboard.

Enter your username and password to sign into your OpenDNS Dashboard.

Set up your OpenDNS network.
Click on the "Networks" link. Remember, you need to log into OpenDNS from the same
network where you'll be hosting your first Sputnik-powered device. The reason is that,
when you configure your first OpenDNS network settings, your session's IP address will
need to match the network IP that you are managing.
Add your first network.

Your IP address should be filled in automatically. You'll see your current IP address in
the upper right hand side of the browser window. Click "Add this Network" to continue.

Name your network.
Give your network a name that you can remember. Select whether the network is
dynamic (default) or static. Click "Done".

Manage your network.
Your new network will appear in the list. (As noted above, if you add a network with a
different IP than your current session, you will not be able to continue until you log in
from that network's IP.)
Click on the wrench icon under "SETTINGS" to configure your network.

Set your content filtering level.
Review OpenDNS content filtering policies on their web site, and select the level
appropriate to your business. This level will be applied across all Sputnik-powered
devices that use OpenDNS in your various locations.

Select the first Sputnik-powered device you want to use with OpenDNS.
Log into SputnikNet, click on "Routers" from the main SputnikNet menu on the left-hand
side. Select the Sputnik-powered device you want to apply OpenDNS to, and click on its
name from the "Configure Router" column.

Select OpenDNS Settings.
Click on "OpenDNS Settings" from the main menu of the Sputnik-powered device's "Edit
Settings" page.
Enable and configure OpenDNS.

Click "Enable" to use OpenDNS with this device. Enter your OpenDNS Username and
Password. Click "Save Settings" to apply them to your Sputnik-powered device.

OpenDNS setup confirmation.
The page will refresh briefly to indicate that your Sputnik-powered device ("node") has
been updated, and that DNS services are restarting. Your OpenDNS settings will take
effect in a few minutes.
Testing OpenDNS content filtering.

Attempt to surf to what you might consider an inappropriate site, such as
www.playboy.com. The site will be blocked, and instead you will see a message along
with a search field and sponsored links.
You can customize the page's logo as we did here with the Sputnik logo. Simply follow
instructions on www.opendns.com to customize your blocked/error page settings. The
search widget and results cannot be replaced however, as they support OpenDNS'
business model-- remember, the service is free.

Adding additional Sputnik-powered devices to OpenDNS.
Important: in order to follow the above steps in SputnikNet to quickly use more
Sputnik-powered devices with your OpenDNS account, you need to upgrade your
account to "Nomad" status. This enables you to skip the step of configuring more
networks in your OpenDNS account.
There is no cost to do this. However, you do need to apply for Nomad status with
OpenDNS. To do this, send an email to nomad at opendns dot com (spelled out to
discourage spam crawlers). The folks at OpenDNS will get back to you about your
account status.

Branding Networks with SputnikNet

Branding your Wi-Fi Network with Captive Portals
How to create custom-branded captive portal pages that users see as they log into your network.
Log into SputnikNet, then select Captive Portals under the CONFIG menu.
To create or modify captive portals, select "Captive Portals" from the "CONFIG" menu.
Add a new captive portal.

Click on "Add New Captive Portal" to create a new captive portal. Or, to edit an existing
captive portal, click on its name, and skip the next two steps.
Note that you can quickly jump to an existing captive portal's assigned router(s) and
authentication system(s) from this page.

Name your captive portal.
Give your captive portal a name, which will appear in the Sputniknet control panel.
The other settings are optional:
- Use (insecure) HTTP: this option is hardly ever used, because it isn't secure. Select it if
you are running your own server (SputnikNet On Site), and don't have an SSL certificate
installed (though we highly recommend you use SSL). Selecting this option means that
user login credentials could be intercepted by a hacker on the wireless network.
- Redirect UR: if supplied, the user will be redirected to this web site after logging in.
- Append session information: this is used in conjunction with the redirect URL. If
selected, session information is appended to the redirect URL. This is used if the site
being redirected to is logging session information.
Click "Add New Portal" to apply your settings.

Select your captive portal.
Your new captive portal appears in the "Portal Name" column. It hasn't been assigned to
any Sputnik-powered devices (routers) yet, but it is assigned the default authentication
system.
Click on the name of your new captive portal to continue editing it.
View default captive portal HTML.

Click on "Text/Images" to view and edit your captive portal page.
Captive portals are web pages written in HTML, CSS and JavaScript. However,
SputnikNet adds a few additional tags:
- [login] is where the authentication system(s) applied to the captive portal will place a
login form (e.g. the username/password fields, or )
- [style] and [/style] are required to include CSS definitions
- [javascript] and [/javascript] are required to include JavaScript code
None of these additional tags are required. However, if the [login] tag is omitted, the
login form will appear at the bottom of the captive portal page. For more information
about using CSS and JavaScript, see "Advanced Captive Portal Techniques".
The default portal content field illustrates basic HTML, contains an image and login form.
All of these can be modified as needed.

To see how the captive portal displays click "View Saved".
Preview default captive portal.

The default captive portal appears in a pop-up window, You can leave this window open
and refresh it to see the effect of any changes you make.

Start an image upload.
To upload an image, click "Add".

Specify the path to the local image for upload.
Click "Choose File" to select the image you want to use.

Select the image in your file system.
You can use any web-standard image file format, such as PNG, JPEG, GIF, etc.

Confirm your selection.
Click "Upload" to add the local image file to SputnikNet.
Add as many images as you like to SputnikNet.

As you add new images, they appear as thumbnails on the right hand side of your
screen.

Add an image to your captive portal.
To add an image to your captive portal, select the place in the HTML where you want the
image reference to appear.
Click the thumbnail of the image you want to add. A reference to the image (i.e. an
<img> tag) will be added at the insertion point. Any selected text will be replaced with the
image reference.
Confirm the image addition.

Click "OK" to confirm the upload.

Review and save captive portal content.
The selected text has been replaced with a path to the uploaded image. You can revert
to the previous version if you make a mistake by clicking on "Return to Captive Portals".
If you approve of the change, click "Save Portal Content".

Preview your captive portal.
Click on "View Saved" to display the most recently saved captive portal page.

Review your captive portal.
A pop-up window displays the captive portal. The default user authentication system is
displayed.
You can iterate the design of the captive portal until you get it exactly right.

Assign authentication systems to your captive portal.
Once you're happy with the design of the captive portal page, click "Walled Garden and
Authentication" to assign authentication systems and walled gardens to it.
In this case, we will assign "Joe's Java Guest" authentication system, and "Allow to
www.joesveryfinecafe.com" walled garden.
The former will place the "Joe's Java Guest" authentication system first (if you have
multiple authentication systems), where the [login] tag appears in the captive portal
content.
The latter adds the sites defined by www.joesveryfinecafe.com to your captive portal's
walled garden. If a user clicks on the link in "Please view our breakfast or lunch menu"
(see above) they will be able to browse walled garden sites, for example, to see the
menu of the day.
Click "Update" for these changes to take effect.

Assign secondary authentication systems to your captive portal.
After clicking "Update" you can add as many additional authentication systems as
required, which will be provided as options for the user. Authentication systems are listed
in the captive portal in the order in which they are originally applied.
In this case, we assign the "Joe's Cafe PayPal" authentication system as the second
option.

Preview your revised captive portal.
Now, the original default login form is replaced with the selected authentication systems
in the order applied.
In this case, the user can surf for a half hour for free using a guest authentication
system. After that time has expired, she will be required to pay for access using a
PayPal/credit card authentication system.

Preview all authentication options.
Click on "Paid Wi-Fi Access" to preview the secondary authentication system. When the
user selects this option, the screen changes to ask them to sign in or to create a new
account.
SputnikNet is very flexible when it comes to authentication-- it's possible to do practically

anything you want. For more information, see the chapters covering various authentication
systems.

Advanced Captive Portal Techniques
How to create elegant, custom-branded captive portal pages with CSS, JavaScript, and Flash.
Log into SputnikNet, then select Captive Portals under the CONFIG menu.
You have full control over the HTML used in captive portal pages, and can use advanced techniques such as CSS, JavaScript, and
Adobe Flash to build extremely sophisticated designs. Here's we'll create a captive portal that utilizes all of these options.
To create or modify captive portals, select "Captive Portals" from the "CONFIG" menu.

Click on "Add New Captive Portal" to create a new captive portal. Or, to edit an existing
captive portal, click on its name.

Name your new captive portal.
For this example, we'll create a new captive portal and name it "Rodeo".
Apply appropriate authentication system(s) to your new captive portal.

Authentication systems create login forms on captive portal pages. We'll add them first
since they're part of the page's design. Here we're adding a guest authentication system
called "Mandan Rodeo".

Review authentication system content.
Login forms inserted into the captive portal by authentication systems can include HTML.
Here we've applied paragraph tags with class "greeting". We'll see later how you can use
CSS to style the greeting text however you want.

Upload graphics to your captive portal.
Follow instructions in online documentation chapter titled "Branding your Wi-Fi Network with Captive Portals" to upload
graphics for your captive portal. Once uploaded, you can use graphics in any captive portal.

Preview your captive portal with basic CSS.
If you want CSS style definitions to apply to both your captive portal content and the login form from the
authentication system, place them between [style] and [/style] tags.
Here is the complete captive portal HTML previewed above. We've created an asterisk ("all") CSS selector
to apply styles-- in this case, a dark blue background and white text-- to everything in the captive portal.
[style]
*{
background-color: #071f31;
color: white;
}
[/style]
[login]
Create walled garden policies for external content.

Elements fetched from external sites for display on captive portal pages need
corresponding walled garden ("allow") policies so that they are not blocked before the
user logs in. Here we intend to add some JavaScript from "mrodeo.com". First we'll
create the walled garden policy, then we'll apply it to the Rodeo captive portal.
For more details on walled garden policies, see online documentation chapter titled "
Branding using Walled Gardens and Redirects".

Add JavaScript to your captive portal page.
To use JavaScript in a captive portal page, it needs to be saved to a site external to
SputnikNet. Here the JavaScript calls a nice animation of the photos of past rodeo
winners from mrodeo.com. The following is pasted into the "portal content" field just after
the CSS definition [/style] tag:
<script type="text/javascript" src="http://www.mrodeo.com/flash/swfobject.js"></script>

<script type="text/javascript" src="http://www.mrodeo.com/flash/bz.js"></script>
<div id="BZ06B0C49547644155862B"><div
style="background-color:#ffffff;color:#000000;padding:1em;"><div style="margin: 0pt
auto; max-width: 500px; text-align: justify;"></div></div></div>

Add a graphic and position it using CSS.
We'll add a CSS definition to place a logo over the JavaScript banner. The following
goes between the [style] and [/style] tags:
img#mandan {
position: absolute;
top: 100px;
left: 580px;
}
The following HTML can go anywhere in the content below the closing [/style] tag:
<img id="mandan" src="/sputnik/pc/14/33" alt="mandan-230.png">

Use a table to layout additional design elements.
We'll add a few more graphics to the bottom of the captive portal, flanking the login form.
An HTML table is an easy way to do this:
<div align="center">
<table border=0">
<tr>
<td width="200" ><img src="/sputnik/pc/14/36" alt="mandan-tix.png" align="right"></td>
<td width="60"> </td>
<td width="400">[login]</td>
<td><img src="/sputnik/pc/14/34" alt="bareback-horse-rider.png"></td>
</tr>
</table>
</div>

Style the login form with CSS.
Add more CSS selectors to style the greeting text (which we tagged with class
"greeting"), the login form itself, and the login button. Sputnik provides a few CSS
classes to help you style these elements, but each element is not present in every
authentication system. They are:
- login_form: the overall form

- login_username: username field
- login_password: password field
- login_error: error message displayed for failed login
- login_submit: login button
NOTE: since some authentication systems don't include all of these classes, it's a good
idea to use your browser to "view source" of the captive portal under construction. For
example, the guest authentication system doesn't use the "login_submit" class for the
login button, but you can select the element based on input type, as shown below:
p.greeting {
font: normal x-large Georgia, "Times New Roman", Times, serif;
text-align: center;
}
.login_form {
font: large "Lucida Grande", Lucida, Verdana, sans-serif;
}
input[type="button"],input[type="submit"] {
font: small-caps xx-large Georgia, "Times New Roman", Times, serif;
color: white;
background-color: #369;

}
Add some more flair to the login form.

Since in this example the captive portal will be viewed outdoors, we'll highlight the
access code and login button in its "hover" state with some additional CSS definitions.
You have full control over the branding of your captive portal and can create any kind of
customer experience you desire.
input[type="text"] {
font: bold x-large "Lucida Grande", Lucida, Verdana, sans-serif;
padding:3px;
color: yellow;
}
input[type="button"],input[type="submit"]:hover {
font: small-caps xx-large Georgia, "Times New Roman", Times, serif;
color: #369;
background-color: yellow;
}

Setting the Welcome Page Timeout
The Welcome Page is the page a user goes to after successful login, but before being sent to their home page or redirect page. By setting the welcome page not to
timeout, the end user will have a place to go to pop up the session monitor window.
Select Captive Portals from the main menu.

Log onto SputnikNet and click on the Captive Portals main menu.

Select a captive portal.
Click on the name of the captive portal you want to edit.
Set welcome page timeout.

Enter a value in the "Welcome screen timeout" field. A value of 10 seconds is the default
if nothing is entered.
If you want the welcome page to remain after the user logs in, set the value to 0. This
blocks automatic redirect to the Internet, which means that the page remains in the users
browser. The user can return to the page if they need to pop up a session monitor
window, for example to see their time online, or to log out. The user can also click on the
link embedded in the welcome page to go to their intended page; doing so will spawn a
new window so that the welcome page remains available to them.

Branding the Session Monitor Window
How to create custom-branded (or unbranded) session monitor windows that users see after they log in.
The session monitor window.

The session monitor window is a small window that pops up after a user logs in (assuming pop-up blocking is
not enabled). The session monitor allows the user to see how long they've been logged in, and to quickly log
out . By default, the session monitor window shows Sputnik's logo.
Prepare your logo.

Save your logo as a JPEG, GIF, PNG or other web-compatible graphic file format, with
dimensions no larger than 127 x 53 pixels.

Save your logo in a captive portal.
SputnikNet stores graphics (such as logos) in captive portals. To use a logo in a session monitor window, we'll upload the logo to
SputnikNet, then copy its path into the "Session Monitor Logo" field in the "Control Center" page. The new logo will then appear in
session monitor windows across all Sputnik-powered devices.
Here's how to do it:
Log into your SputnikNet Account and choose "Captive Portals" from the "CONFIG" menu.
Create a new captive portal for session monitor logos.

You can add your session monitor logo to any captive portal, but it's just as easy to create a new captive portal to
store it.
To do this, click on "Add New Captive Portal".

Add your logo graphic to the captive portal.
We've named the new captive portal "Infinity Nets Session Monitor" - making it easy to
find should we want to store multiple session monitor logos. Click "Add" to initiate an
image upload.
Specify your logo graphic.

Click "Choose File" to specify the graphics file stored locally on your computer that you want to upload.
Upload your logo graphic to SputnikNet.

Once you've selected the logo, click "Upload" to save it to the captive portal.

Insert the logo graphic into the captive portal content.
Click on the thumbnail of the logo in order to insert its path into the captive portal content.
Confirm the change to your captive portal content.

Confirm that you want to add the logo. Remember, you're doing this not to create a
captive portal, but to get the path to the graphic.

Copy the path to the logo graphic.
Copy the path to the logo graphic, which appears within the double quotes inside the
<img> tag. Optionally, click "Save Portal Content" if you want to keep the graphic's path
in the captive portal content for future reference.

Go to the Control Center setup page.
To configure the Session Monitor window, select "Control Center" from the "CONFIG" menu.
Paste the logo graphic path into the "Session Monitor Logo" field.
Paste the path to the logo graphic in the "Session Monitor Logo" field.
Save your changes.

Click "Update" (scroll down to the bottom of the page) to save your changes.

Custom-branded session monitor window.
Users will see your branded session monitor window when they are logged in.
Deleting all logos from the session monitor window.

If you do not want any logo on the session monitor window, type "none" in the "Session
Monitor Logo" field.

Unbranded session monitor window.
Users will see an unbranded session monitor window.

Branding using Walled Gardens and Redirects
How to reinforce your brand by providing walled garden and redirect pages before and after user login, respectively.
Log into SputnikNet, then select Network Policies from the CONFIG menu.
Walled gardens are internet domains that users can access before they log in. Redirects send the user to a specific web site after
they log in. Both present opportunities to put information about your products or services in front of the customer surfs the wider
internet.
Walled gardens are "allow/accept" policies that are applied to captive portals because they take effect before the user
authenticates. To start creating a new Walled Garden, click on "Network Policies".

Define a new network policy.
Click "Define New Network Policy" to do just that.
Configure the new policy as "allow/accept".

- Name; the name of your walled garden policy

- Action: should be set to "Allow/Accept", since the policy permits internet access
- Protocol: TCP, for accessing web sites
- Match Destination Hostname: the name of the web site you want to allow access to
(skip the http://www)
- Is Dynamic: use if the web site is not at a fixed IP address
- Interval: how often SputnikNet should check for a new IP address
- TCP or UDP Port: set to 80 (for http, standard web protocol)
Click "Add Policy" to do just that.

Your walled garden is now available for use.
Your new policy is added to your list of Network Policies. If you want to allow
unauthenticated users to visit additional internet domains, repeat the previous steps.
Apply your walled garden to one or more captive portals.

Find the captive portal you want to apply the walled garden policy to. Click "Walled
Garden and Authentication" from the "Configure Portal Properties" menu.
You'll see a list of available walled gardens. (In this example, there is only one.) Check
the box next to the walled garden you created, and click "Update".

Users can access walled garden sites before they log in.
Your users will be able to visit www.gourmetselect.com before they log in to take a look
at your tasty menu.

Create a redirect rule.
You can redirect customers after they log in to any site you want. This site will override
the destination they requested before logging in (for example, their home page). Since
they will have authenticated, no policy rule is needed.
To create a redirect rule, select "Settings" in the "Captive Portal Properties" menu. Enter
the web destination in the "Redirect URL" field. This time the "http://www" is needed.
Click "Save Settings".

Users will be redirected to the site you chose after they log in.
Now, after the user logs in, they'll see you're daily special.

Removing Sputnik Branding
How to remove the Sputnik logo from pages that your customers see.
Sputnik logo is shown, by default, on captive portal pages.

By default, a Sputnik logo appears at the bottom of captive portal pages.

Submit a support request.
To remove the Sputnik logo, click on "Report a bug" at the upper right corner of every
SputnikNet page.
Set the "case type" to "Remove SputnikNet Branding".

Enter your company name, email address, subject, and SputnikNet domain name.
Select "SputnikNet" for Support Issue.
Select "Remove SputnikNet Branding".
Click "Send your request" to submit your request to Sputnik.

Sputnik's logo is removed.
Give us about 24 hours. Your brand is now the only brand on captive portal pages.

SputnikNet Authentication Basics

Creating a new Authentication System
How to create and configure new authentication systems.
Log into SputnikNet and select "Authentication".

Click on "Authentication" to create a new authentication system of any type. Or, if you know the type of authentication system you
want, choose it from the list. (Note, if there is a single authentication system of the type you select, you'll skip the "Add New..." step
and be directed to its configuration pages.)

Add the new authentication system.
Click on the "Add New Authentication System" button to do just that.
Select the type of authentication system you want to use.

Select an authentication system from the pop-up menu.

Name your authentication system.
The "name or description" is what will appear in SputnikNet. The "visible name" is
displayed to users when there are multiple login choices.
Check "Allow Duplicate Logins" if you want multiple users to be able to log in with the
same credentials at the same time. If not checked, older sessions will terminate when a
new login with the same credentials occurs.
Check "Display warning about popup" to show a message to users warning them not to
close the popup window, which they can use to track their time online and to terminate
their session.
Click "Add" to create the new authentication system.
Popup warning.
Here is a sample of what the popup warning looks like. It is not editable.

Edit your authentication system settings.
Each authentication system has an "Edit Settings" page where you can configure
specific settings for that system. For more information, refer to the appropriate chapters
in our online documentation on authentication.
Add as many authentications as needed.

SputnikNet enables you to configure and use multiple authentication systems, any of
which can be applied to multiple captive portals and Sputnik-powered devices. This
gives you enormous flexibility in building your wireless network.

Guest Authentication with SputnikNet

Guest vs. PrePaid Authentication
How to determine when to use guest versus prepaid authentication systems.
Guest authentication is based on fixed dates and times.

Each guest authentication code has a fixed "start" and "stop" time.

Prepaid authentication is duration-based.
Each user authentication account has a set period of time for which it is valid. The time
starts when the user first logs in, and ends when the time assigned to the account is
used up. Also, accounts can be "continuous" (only valid for one session) or
"discontinuous" (valid for multiple sessions until the time is used up.
Both enable codes that can be shared by multiple users (Guest example).
You can enable guest authentication codes to be shared by multiple users.

Both enable codes that can be shared by multiple users (Prepaid example).
While less commonly used, authentication systems can also allow duplicate logins. In
this case, each session uses up the amount of time assigned to the account. So, if two
users share an account with a total of 60 minutes, their aggregate sessions cannot
exceed that time.
Both can be used for free, time-limited Wi-Fi, or paid Wi-Fi.

You can use guest or user authentication systems for free, time-limited Wi-Fi, or for paid Wi-Fi. We offer numerous examples in our online documentation. The main
reason to choose one or the other is how you want to account for time.

Requiring a Code for Access
How to use the guest authentication system to generate and use time-limited access codes.
Navigate to the guest authentication system overview.

Log into SputnikNet and click on "Guests" from the Authentication menu. Or simply click "Authentication" to start with a generic
authentication system which you can configure as a guest authentication system.

Add a new guest authentication system.
Click on "Add New Authentication System" to do just that.
Name your new guest authentication system.

For more information on basic authentication system settings, see the online
documentation chapter titled "Creating a new Authentication System".

Configure guest authentication settings.
- Leave "Allow DHCP login?" unchecked since you want users to log in via captive
portal.
- Check "Require an Access Code" to force users to enter a valid access code before
logging onto the internet.
- Select a "Guest Expiration Interval" if you want to set an amount of time after which the
user will need to log in again. This is useful if you have an advertising-driven site and
want to force periodic viewing of the captive portal.
- Select "Guest Blackout Period" if you want to set an amount of time during which users
will be prevented from logging in again after their initial session expires (based on client
MAC address).
- Check "Display Greeting?" if you want to show a greeting on the captive portal's login
form.
- Enter text or HTML into the "Greeting Text " field. This text is show above the login
field/button.
- Enter text or HTML into the "Proceed Prompt" field. This text is shown to the left of the
login button.
- Enter text into the "Proceed Label" field. This will appear in the login button. You have
complete control over the appearance of the login button. See the online documentation
chapter titled "Advanced Captive Portal Techniques" for more information.
Click "Update Configuration" to apply your new settings.
Navigate to the access codes setup page.

Click on "Access Codes" in the authentication system menu.

Adding access codes one at a time.
You can quickly add an access code by entering a unique code along with valid from and
expiration times. Click "Add Access Code" and you're done.
View your access codes.

It's easy to search for specific access codes or groups of codes.
IMPORTANT: use the percent (%) symbol as a wild-card character to enclose the string
you are searching for. For example, if you want to find all of the codes that include "VB",
your search would be "%VB%. Searches are case sensitive.
If you need to delete an access code, select it, then click "Delete Selected Codes".
Create access codes in a spreadsheet.

You can create access codes in a spreadsheet application such as Microsoft Excel. You
just need three columns of data:
- access code
- valid from time in the format mm/dd/yy hh:mm:ss
- expire time in the format mm/dd/yy hh:mm:ss

Generating random access codes.
The web site www.random.org is a useful place to generate any number of random
access codes.

Formatting access code dates.
You can use custom number formatting in Excel to format the date fields as mm/dd/yy
hh:mm:ss.

Save your access code spreadsheet as a csv file.
Once your access code spreadsheet is ready, save it as a comma separated value (.csv) file.

Upload your access codes to SputnikNet.
Select your csv file, decide whether you want to replace existing codes or not, then click
on "Import Access Code File".
Review your new access codes.

Once you are happy with the access codes click "Commit Import". If you decide not to
upload your codes, click on any other link to refresh your browser.

Access code summary.
Your access codes now appear in SputnikNet, where you can search for them, delete
them, or copy and paste them into a spreadsheet.

Apply your guest authentication system to one or more captive portals.
Select a captive portal, click on "Walled Garden and Authentication", check the
authentication system(s) you want to apply, and click "Update". In this example, we're
applying the guest authentication system with our access codes to the "Transfair 1"
captive portal.

Apply the captive portal to one or more Sputnik-powered devices.
Select a Sputnik-powered device ("router"), and choose a captive portal from the "Portal"
pop-up menu. In this example, we're applying the Transfair 1 captive portal to the
Sputnik-powered device named "Transportation Trade Show East". The codes we
generated will now be required for network access for users connecting to this

Test your guest codes.
Associate with a Sputnik-powered device and test your access codes.

Simple Click-Through with Terms of Service
How to use guest authentication to create a simple click-through captive portal with terms of service.




- Leave "Allow DHCP login?" and "Require an Access Code?" unchecked. This will
force the user to click a login button on a captive portal page to get internet access, but
will not require that they enter a code.
MAC address).
form.
field/button.
login button.
- Enter text into the "Proceed Label" field. Here we've entered "I agree" to indicate
acceptance of the terms of service. This will appear in the login button. You have

Create a new captive portal or edit an existing one.
Click "Add New Captive Portal" from the captive portal list to do just that. Or click on the name of a captive portal
to edit an existing one.

Design your captive portal page with terms of service.
Here we've used CSS styles to design the terms of service legal copy. The height, width,
and overflow: auto styles insert the terms of service copy into a box with a scrollbar.

Apply your authentication system to a captive portal; apply your captive portal to a Sputnik-powered device.
Once your captive portal design is complete, select its "Walled Garden and
Authentication" page. Click the checkbox next to the guest authentication system you
created and click "Update" to save your settings. Then apply your captive portal to one
or more Sputnik-powered devices ("routers"). Finally, test your click-through
authentication system by logging on as a user.

Click-Through with Sponsorship (Guest Authentication plus Walled Garden)
How to create a click-through captive portal using guest authentication with walled garden policies to enable display of externally hosted sponsor content.




MAC address).
form.
field/button.
login button.

Navigate to the network policies overview.
Sponsor content is frequently hosted on a server external to SputnikNet. In order for that content to display on the captive portal
(before the user logs in), you need a walled garden "allow" rule to the sponsor's domain.
Click on "Network Policies" from the CONFIG menu.
Add a new network policy.

Click on "Define New Network Policy" to do just that.

Configure a walled garden policy.
- Name: enter the name of your walled garden policy, or leave blank if you want
SputnikNet to generate one for you
- Action: set to "Allow/Accept", since this is a walled garden rule that allows
pre-authenticated access to an external domain
- Protocol: set to "TCP" - standard web protocol
- Match Destination Hostname: enter the domain where the sponsor content is hosted;
leave off "http://www"
- Is Dynamic: check "Interval" and set a time that tells SputnikNet how often the IP
address of the domain should be checked for any change
- Match Destination IP or Network/Netmask: leave blank
- TCP or UDP Port: set to 80 - standard web port
Click "Add Policy" to create the new walled garden policy.
Navigate to the captive portals overview.

Click "Captive Portals" from the CONFIG menu.

Create a new captive portal or edit an existing one.
Click "Add New Captive Portal" from the captive portal list to do just that. Or click on the name of a captive portal
to edit an existing one.
Design your captive portal to pull content from the sponsor's web site.
Here we've added a simple HTML src tag to pull an image from the sponsor's web site.
Any time the sponsor changes the image, the captive portal will update automatically.

Apply the guest authentication system to your captive portal.
Click on "Walled Garden and Authentication" from the captive portal properties page,
click the check box next to the authentication system and walled garden policy created
earlier and click "Update".

Apply the captive portal to a Sputnik-powered device, and test it.
Apply your captive portal to one or more Sputnik-powered devices ("routers"). Finally,
test your click-through authentication system by logging on as a user. Here the walled
garden rule enables the sponsor's graphics to appear in the captive portal. Also, users
can browse the sponsor's web site before logging onto the internet.

Free, Time-Limited Wi-Fi followed by Paid Wi-Fi Access
How to use guest and PayPal authentication systems to offer users a free, time-limited online "test drive", followed by paid Wi-Fi access.




- Select a "Guest Expiration Interval" to set a time limit for free Wi-Fi access.
- Select "Guest Blackout Period" to set an amount of time during which users will be
prevented from logging in again (using this guest authentication system) after their initial
session expires (based on client MAC address).
- Check "Display Greeting?" to show a greeting on the captive portal's login form.
field/button.
login button.

Add a new paid authentication system.
Here' we'll add a PayPal authentication system (for both PayPal and credit card accounts). You could just as easily use WorldPay,
prepaid, guest or any other authentication system. Click on "PayPal" under the Authentication menu, then click the "Add New
Authentication System" button to do just that.
Name your new paid authentication system.


Apply the guest authentication system to a captive portal.
Authentication systems appear in captive portals in the order in which they are applied in
SputnikNet. Since we want the time-limited click-through authentication system to
appear first, apply it by clicking on the checkbox next to its name, then click "Update".

Apply the paid authentication system to the captive portal.
We want the paid authentication system to appear on the captive portal after the
click-through option. Add it by clicking on the checkbox next to its name, then click
"Update".

Apply the captive portal to a Sputnik-powered device, and test click-through authentication.
Apply your captive portal to one or more Sputnik-powered devices ("routers"). Test your
click-through authentication system by logging on as a user. After 15 minutes, your session
will terminate, and you'll return to the captive portal page. In this example, we set the "Guest
Blackout Period" to one day, so you won't be able to re-log in using click-through
authentication for 24 hours.

Test paid authentication.
Select the paid authentication option and buy time, just as a user would. Then log in to test your
paid authentication system. For more information about paid Wi-Fi access, see the various
chapters in online documentation section titled "Charging for Wi-Fi Access with SputnikNet".

Enabling All Users to Skip Captive Portal Login
How to enable all users to skip captive portal login, tracking sessions by MAC address. (If you want to enable specific users or devices to skip captive portal login,
see "Authenticating Devices without Web Browsers".)




Check "Allow DHCP login?" to enable all users to bypass captive portal authentication.
(DHCP is the process that assigns IP addresses to client devices, providing them with
network access.) NOTE: user sessions will still be tracked by MAC address, enabling
you to spot squatters or bandwidth hogs.

While you can apply the authentication system directly to Sputnik-powered devices ("routers"), we
recommend that you apply it to a captive portal instead. Then apply the captive portal to one ore more
Sputnik-powered devices. This will give you more flexibility to change your business model in the future.
Select "Captive Portals" from the CONFIG menu, then click the "Add New Captive Portal" to do just that.
This captive portal will never be seen, so there is no reason to edit its content.
Apply the guest authentication system to the captive portal, then apply the captive portal to Sputnik-powered devices.
Apply the guest authentication system to the captive portal, then apply your captive
portal to one or more Sputnik-powered devices ("routers"). Test your authentication by
associating with the router. You will be logged in automatically.

Test your DHCP-based authentication in SputnikNet.
Log into SputnikNet to see your active session, which will be tracked by MAC address.
Similarly, SputnikNet provides complete reporting of all client activity by MAC address.

Limiting Freeloaders
How to use the guest authentication system's expiration interval and blackout period to create a click-through captive portal login experience that limits customers'
time online.




- Select a "Guest Expiration Interval" to set an amount of time after which the user will
need to log in again. Here we've set it to 30 minutes, to encourage table turn.
- Select "Guest Blackout Period" to set an amount of time during which users will be
prevented from logging in again after their initial session expires (based on client MAC
address). Here we've set it to 1 day to limit their daily network usage.
- Check "Display Greeting?" to show a greeting on the captive portal's login form.
field/button.
login button.

Create a new captive portal, or select an existing one.
Click on "Captive Portals" in the CONFIG menu.

Apply the guest authentication system to your captive portal(s).
Click on "Walled Garden and Authentication" from the captive portal page. Click on the
checkbox next to the name of your authentication system and click "Update" to apply.

Apply your captive portal to a Sputnik-powered device, sign in as an end user to test.
Apply your captive portal to one or more Sputnik-powered devices ("routers"). Test your
click-through authentication system by logging in as a user. After 30 minutes, your
session will terminate, and you will be blocked from logging in again for 24 hours.
Don't worry though, your SputnikNet site is still reachable. Simply enter its address into
your browser, log in, and modify authentication settings to restore your network access.
For example, you could create a new device-based authentication system that allows the
MAC address of your computer, and then apply it to the Sputnik-powered device you're
associated with. From then on, you'll bypass the captive portal page and log onto the
internet directly from that location.

Spotting and Banning Network Abusers
How to identify and block abusive network behavior, whether from "cybersquatters" (people who use your network for excessive periods of time) or "bandwidth hogs"
(people who soak up more than their fair share of bandwidth).
First be sure that QoS/Throttling is enabled on your Sputnik-powered devices.

You can preempt many network abuses (such as peer-to-peer file sharing) using the
QoS/Throttling setting from your Sputnik-powered device's settings page. This feature is
available for Sputnik-powered DD-WRT firmware running Sputnik Agent version 3.3.6.2
or higher.
If basic QoS management and bandwidth throttling is available for that Sputnik-powered
device, you will see a "QoS/Throttling" checkbox.
For more information, see the online documentation chapter titled "Quality of Service
(QoS) and Bandwidth Limits".

Also, be sure guest expiration interval and blackout period are set.
You can limit the amount of time users spend on your network by setting a guest
expiration interval and guest blackout period. For more information, see the online
documentation chapter titled "Limiting Freeloaders".

View client summary report.
Log into SputnikNet, then select "Client Summary" from the REPORTS menu.

Identify exceeding long sessions.
The default report includes session length data, making it easy to spot "cybersquatters".
If you need to search further back in time, set the display limit higher. Copy the MAC
addresses of any network abusers for future use.
Identify high-bandwidth sessions.

Click the checkbox next to "Include Bandwidth?" and then click "Execute". This enables
you to spot "bandwidth hogs". If you need to search further back in time, set the display
limit higher. Copy the MAC addresses of any network abusers for future use.

Edit your guest authentication system.
Select "Guests" from the Authentication menu.

Enter network abuser MAC addresses into "Blocked Devices list.
Select your guest authentication system, then choose "Blocked Devices". Here is where
you can paste the MAC addresses of network abusers. They will no longer have access
to your network.

Add and delete network abuser MAC addresses.
Continue to add MAC addresses until all network abusers have been blocked. You can
always remove the blocks later from this page if they promise to mend their ways.

Prepaid Authentication with Time and
Bandwidth Limits

Creating and Managing Prepaid Cards in SputnikNet
How to use SputnikNet's prepaid authentication system to generate, display, download, and delete prepaid cards.
Log into SputnikNet, then navigate to the prepaid authentication system overview.
Log into SputnikNet, then click on "Prepaid" from the Authentication menu.

Add a new prepaid authentication system or select an existing one.
Click on "Add New Authentication System" to do just that. Or, select your existing
prepaid authentication system from the list (if you have just one, you will skip this step.)
Generate a prepaid card batch.

In SputnikNet, prepaid cards are not necessarily physical cards, but user accounts with
the following information:
- User ID (the login name)

- Password
- Type: either continuous or discontinuous (see below for explanation)
- Minutes: the amount of network access time allowed ("account time limit")
- Bandwidth (optional): amount of upload + download bandwidth allowed in megabytes
(2^20 bytes or 1,048,576 bytes)
Note:
- "Continuous" starts the clock when the user first logs in; the clock keeps ticking
continuously until the account time limit is used up regardless of whether the user is
logged in or not
- "Discontinuous" starts the clock when the user first logs in; the clock ticks only when
the user is logged in (has an active session); the account is valid until the account time
limit is used up
- if you set both time and bandwidth limits, the account will expire when either the time or
maximum bandwidth is used up, whichever comes first
- set the bandwidth limit as 0 if you want only time limits to apply

- maximum total bandwidth setting is approximately ten exabytes (ten trillion megabytes)
To create prepaid cards in SputnikNet, click "Edit Settings" from the Prepaid
Authentication System menu. Fill out the fields under "Generate Paid Cards" as follows:
- Name for this batch: a unique name for the set of generated prepaid cards that will be
displayed in SputnikNet, and can be used for searching, managing, and downloading
cards
- Username prefix: text that is appended to the beginning of each user ID code
- Starting suffix number: starting number for this batch of prepaid cards, which will be
incremented for each new card
- Number of accounts to create: the number of cards in the new batch
- Number of minutes for each account: the amount of network access time allowed by
the prepaid card
- Amount of upload + download bandwidth allowed for each account, in megabytes
- Continuous/discontinuous: see above
Click "Execute" to create your new prepaid card batch.

Review your prepaid cards.
SputnikNet displays the newly generated prepaid cards for review.
Download your prepaid cards.

Click "Download as CSV" to download your new prepaid card batch to format that you
can open with a text editor or spreadsheet application, such as Microsoft Excel.
Click "Continue" to save your prepaid cards in SputnikNet. If you do not want to do this,
click on a different link on the page.

View your downloaded prepaid cards.
Open the CSV ("comma separated values") file in a spreadsheet application such as
Excel to review. If you want to print the user IDs on cards, see the online documentation
chapter titled "Printing Prepaid Cards".

Downloading a prepaid card batch.
You can download prepaid card batches at any time. Under "Download Paid Card CSV File" select the
batch you want and then click "Execute". A CSV file is downloaded to your PC for use in a spreadsheet
or other application.
Displaying selected prepaid cards.

Under "Display Cards":
- choose the prepaid card batch you want to display

- select whether you want to see all cards, unused, partially used, or completely used
cards
- filter by username (leave blank for all)
- filter by use date (select "All" to view all dates)

Review selected prepaid cards.
SputnikNet displays the cards that match your selection criteria. Copy these values for
use in an external application, such as a spreadsheet.
Deleting prepaid cards.

Under "Delete Pre-Paid Card(s)":
- choose a batch from which you will delete one or more cards
- filter by username
- confirm that you want to delete the entire batch (also leave username field blank)
Reviewing prepaid codes to be deleted.

SputnikNet displays the prepaid cards that match your selection criteria. Click "Delete" to
delete them.

Review delete confirmation.
SputnikNet confirms the deletion. Click "Continue" to do just that.

Creating Prepaid Cards Externally, and Uploading them to SputnikNet
How to use external applications to create prepaid cards and upload them for use in SputnikNet.
Creating prepaid cards in a spreadsheet.

- User ID (or login ID)

- Password
(2^20 bytes or 1,048,576 bytes)
Note:
logged in or not
limit is used up
To generate prepaid cards for upload to SputnikNet, create a new spreadsheet. A

single-batch prepaid card spreadsheet has four columns, or if applying bandwidth caps,

five columns (shown):
- site code - use if you want to assign prepaid cards to a specific site
- login id - must be unique
- password - should be unique and random - here, left blank for now
- amount of time in minutes - here, 1440 translates to 1 day)
- total bandwidth in megabytes (optional)
Random passwords are difficult to generate in a spreadsheet. Fortunately there are

many good online resources.
Generating random passwords for uploading to SputnikNet.

A good online resource for generating random codes is www.random.org. Click on
"String Generator" to get started.

Using www.random.org to generate passwords.
Random.org gives you a lot of control over the kinds of random codes you generate, and
you can generate 10,000 of them at a time.

Copy random codes.
Once you've generated random codes, select them and copy them to your clipboard.

Paste random codes into a spreadsheet.
We've pasted the random codes into the password column.

Save the spreadsheet as CSV file.
Use your spreadsheet's "save as" function to save a CSV file. Important (for Macintosh users): be sure to select
"Windows Comma Separated (.csv)" as both a carriage return and linefeed are required at the end of each row.


prepaid authentication system from the list (if you have just one, you will skip this step).

Upload the CSV file to SputnikNet.
Click "Edit Settings" under the Authentication System menu. Scroll down, and under
"Load Pre-Paid Card CSV File - single batch":
- Give your batch a unique name. This name will be displayed in the SputnikNet
administrative interface, and can be used for searching, managing, and downloading
codes.
- Choose the CSV file you created previously.
- Select whether the time should be continuous or discontinuous.
Review sample of uploaded data.

SputnikNet will display a few records so that you can make sure your spreadsheet is
correct before continuing. Note that here 1,000 megabytes = 1,000*1,048,576 bytes.
Click "Next" to upload the codes to SputnikNet.

Review upload confirmation.
SputnikNet will display the new codes and indicate how many were added. Click
"Continue" to do just that.
Uploading multiple batches at once.

You can upload multiple prepaid card batches at once. Create a spreadsheet with six
columns, or if applying bandwidth caps, seven columns (shown):
- batch code
- site code
- unique code (login ID)
- password (paste random codes here)
- amount of time in minutes (these are 2 hour cards)

- whether the card should be continuous ("C") or discontinuous ("D")
- total bandwidth in megabytes (optional)
Save your spreadsheet as a CSV file. Important (for Macintosh users): be sure to select
"Windows Comma Separated (.csv)" as both a carriage return and linefeed are required
at the end of each row.
Upload the CSV file to SputnikNet.

Under "Load Pre-Paid Card CSV File - multi batch" select the file you created previously.
Click "Execute" to upload the file.

Review sample of uploaded data.
SputnikNet will display a few records so that you can make sure your spreadsheet is
correct before continuing. Click "Next" to upload the codes to SputnikNet.

Review upload confirmation.
SputnikNet will display the new codes and indicate how many were added. Note that
1,000 megabytes = 1,000*1,048,576 bytes. Click "Next" to upload the codes to
SputnikNet. Click "Continue" to do just that.

Printing Prepaid Cards
How to print your prepaid cards, whether using an online print shop or by formatting your cards for printing in Microsoft Word.

prepaid authentication system from the list (if you have just one, you will skip this step).
Download a prepaid card batch as a CSV file.

Select "Edit Settings" from the Authentication System menu. Scroll down, and select the
prepaid card batch that you want to print. Click "Execute" to download the batch as a
CSV file.

Save the file on your PC.
Find card printing services.

There are numerous card printing resources available online. A quick google search
found more than a quarter million of them. Many of these allow you to upload codes for
printing on scratch-off cards. Some will even generate the prepaid card codes for you,
which you can upload to SputnikNet.

Using Microsoft Word's mail merge manager to create cards for printing.
You can use software such as Microsoft Word to create prepaid cards for printing. Launch Word and
select the "Mail Merge Manager" from the "Tools" menu.

Select labels.
Click on "Create New" and select "Labels..." from the drop-down menu.

Select your preferred label format.
Business cards (at 2 x 3.5 inches) work well for pre-paid cards.

Prepare your CSV file for import.
IMPORTANT: Microsoft Word assumes the first line of your CSV file is a header row. If you
intend to the codes in the first line, add a header row above it, for example:
"login,password,continuous,time".

Open a data source for your labels.

Select your CSV file as a data source.

Insert login ID field into your labels.
The login ID field is the first field. Select it from the "Insert Merge Field" menu.

Insert password field into your labels.
The password field is the second field. Select it from the "Insert Merge Field" menu.
Then click "OK".
NOTE: ignore the "M_" string. It simply indicates that the field is a number, and will not
print.

Preview your results
Click on the preview icon to see your cards with the login ID codes.

Review your prepaid cards to make sure the login IDs imported correctly.

Apply designs to your prepaid cards.
Once your prepaid card codes are imported, you can apply design elements to the cards.

Test your pre-paid cards.
Log into a Sputnik-powered device using a captive portal that is assigned to your prepaid
authentication system to test it out.

Paid Access with Prepaid Authentication
How to use prepaid authentication for paid, time-limited and optionally bandwidth-limited Wi-Fi services.
Define your rate plan.

Decide what account time limits, and optionally bandwidth limits, you want to offer (e.g.
an hour, a day, a week, etc.), and how much you want to charge. (The above is given for
information purposes, and does not constitute a pricing recommendation.)
You can have multiple rate plans that you apply to different network locations, of course.
And you can change prices at any time to run specials.
Accounts expire when time or bandwidth limits are reached, whichever comes first.
Maximum bandwidth includes upload plus download. One megabyte equals 2^20 or
1,048,576 bytes.
Sputnik does not take a cut of your PayPal or WorldPay revenues.



Generate prepaid cards.

- Password
(2^20 bytes or 1,048,576 bytes)
Note:
logged in or not
limit is used up
cards

the prepaid card
Apply the prepaid authentication system to captive portal(s) and Sputnik-powered device(s).
Apply the authentication system that includes the prepaid cards to one or more captive
portals. Apply the captive portals to one or more Sputnik-powered devices. Here we
apply both the prepaid and a PayPal authentication system to the "Special Guest"
captive portal, enabling users to pay via prepaid card, credit card, or PayPal account.

Print prepaid cards.
For more information see the online documentation chapter titled "Printing Prepaid
Cards".

Free Access with Prepaid Cards
How to use prepaid authentication for free, time-limited Wi-Fi services.
Prepaid cards do not need to be associated with a cash payment. For example, you can hand them out to customers who make a
minimum purchase in a cafe, or to registered guests at a hotel.
To create prepaid cards, log into SputnikNet, then click on "Prepaid" from the Authentication menu.

Generate prepaid cards.


- Password
(2^20 bytes or 1,048,576 bytes)
Note:
logged in or not
limit is used up

cards
the prepaid card

Apply the prepaid authentication system to captive portal(s) and Sputnik-powered device(s).
Apply the authentication system that includes the prepaid cards to one or more captive
portals. Apply the captive portals to one or more Sputnik-powered devices.
Print prepaid cards.

For more information see the online documentation chapter titled "Printing Prepaid
Cards".

Billing for Wi-Fi Access with Time and
Bandwidth Limits

Charging for Access: Authentication System Options
How to choose the best payment system to charge customers for access to your Wi-Fi network.
Charging for Wi-Fi access using PayPal or WorldPay.

SputnikNet enables you to charge customers' PayPal accounts, credit cards, debit cards, or accept payment via bank account transfers. Sputnik does not take a cut
of your PayPal or WorldPay revenues.
SputnikNet supports both PayPal and WorldPay internet payment systems. SputnikNet works with PayPal Website Payments Standard and PayPal Website
Payments Pro.
-PayPal Website Payments Standard is less expensive, but redirects customers to PayPal's website for payment.
- PayPal Website Payments Pro, using the Direct Payment method, can process credit card transactions "behind the scenes" (without any redirect to PayPal's site)
for U.S. and U.K. service providers. Alternatively, the Express Checkout method allows payment through PayPal, but requires the customer to use their PayPal
account (or sign-up for a new account) if paying by credit card. Both methods are robust and neither is prone to user error.
For best results (especially for U.S. accounts), we recommend Website Payments Pro.
- WorldPay enables customers to pay in 144 local currencies and can be customized to fit the local language in many countries around the world. It's a good choice
if you want to charge customers in a currency that PayPal doesn't support.

More about PayPal Website Payments Standard.
- No monthly PayPal fees apply.
- PayPal transaction fees apply (approximately 1.9% to 2.9% + $0.30 USD).
- Enables your customers to pay by credit card or with a PayPal account.
- Payment process redirects your customer to the PayPal website and supports the IPN
interface.
- Supports 16 currencies, including U.S. Dollar, Canadian Dollar, Euro, Pound Sterling,
Yen, Australian Dollar, New Zealand Dollar, Swiss Franc, Hong Kong Dollar, Singapore
Dollar, Swedish Krona, Danish Krone, Polish Zloty, Norwegian Krone, Hungarian Forint,
and Czech Koruna.
- Additional PayPal Website Payments Standard information is available on

www.paypal.com.

More about PayPal Website Payments Pro.
- Monthly PayPal merchant fee of $30 USD applies (check PayPal for latest pricing).
- PayPal transaction fees apply (approximately 2.2% to 2.9% + $0.30 USD).
- Enables your customers to pay by credit card or with a PayPal account.
- Checkout process is completely integrated with your website, without PayPal branding
or redirects, and supports the IPN interface.
- Supports 16 currencies, including U.S. Dollar, Canadian Dollar, Euro, Pound Sterling,
Yen, Australian Dollar, New Zealand Dollar, Swiss Franc, Hong Kong Dollar, Singapore
Dollar, Swedish Krona, Danish Krone, Polish Zloty, Norwegian Krone, Hungarian Forint,
and Czech Koruna.
- Supports both Express Checkout and Direct Payments (U.S. only) methods. Express
Checkout requires your customer to have or sign up for a PayPal account. This method
redirects your customer to PayPal's web site for payment. Direct Payments processes
your customer's credit card on your site without redirecting to PayPal. Your customer
does not need a PayPal account.
- Additional PayPal Website Payments Pro information is available on www.paypal.com.

More about WorldPay.
- Enables your customers to pay by a variety of methods, including credit card or debit
card.
- Supports 144 currencies and customized payment to match the language of your
website, enabling your business almost anywhere in the world.
- Supports localized transfers in over 45 countries.
- Completely secure transactions, fraud protection and recognized secure data storage.
- Additional WorldPay information is available on www.worldpay.com.

Setting up Rate Plans for PayPal or WorldPay
How to set up rate plans (time limits, prices, and optionally bandwidth limits) in PayPal and WorldPay authentication systems.
Define your rate plan.

Decide what account time limits, and optionally bandwidth limits, you want to offer (e.g.
an hour, a day, a week, etc.), and how much you want to charge. (The above is given for
information purposes, and does not constitute a pricing recommendation.)
You can have multiple rate plans that you apply to different network locations, of course.
And you can change prices at any time to run specials.
Purchased accounts expire when time or bandwidth limits are reached, whichever
comes first. Maximum bandwidth includes upload plus download. One megabyte equals
2^20 or 1,048,576 bytes.
Sputnik does not take a cut of your PayPal or WorldPay revenues.

Log into SputnikNet, then navigate to the authentication system overview.
Log into SputnikNet, then click on "Authentication" from the CONFIG menu.

Select the PayPal or WorldPay authentication system that you want to use, or create a new one.
Setting up rate plans works identically whether you're using a PayPal or WorldPay
authentication system. First, select the authentication system you want to use or click
"Add New Authentication System" to create a new one.
For more information about creating a new authentication system, see the online
Add a new network access product.

Click on "Add New Product" to define your first Wi-Fi service offering, or select an
existing one to edit it.

Name your product, set price, expiration, and optionally, bandwidth limits.
- New Name: enter the name of the product that your customers will see. It's a good idea
to mention the allowed time in the name.
- Price Amount: enter amount you want to charge for the product.
- PayPal or WorldPay Currency Code: select the desired currency from the pop-up list
(see next step).
- Hard Expiration Interval: set the amount of time that the account will be valid for,
following creation, in the format hh:mm:ss.
- Total bandwidth in megabytes
To disable bandwidth limits, leave maximum bandwidth value set to zero (0). Maximum
bandwidth setting is approximately ten exabtyes (ten trillion megabytes).
NOTE: The PayPal and WorldPay authentication systems only support continuous
usage plans that are valid only during the hard expiration interval. Users often neglect to
use the session monitor window to terminate their sessions manually, which means that
the session length tracked by SputnikNet can be greater than the amount of time the
user believes they spent online. It is therefore simpler to offer continuous
hourly/daily/weekly plans that have unambiguous expirations (from the user's
perspective). This approach causes less of a support burden for the service provider and
avoids disputes.

Select desired currency (PayPal).
Choose the appropriate currency for your network access product from the pop-up list.

Select desired currency (WorldPay).
Choose the appropriate currency for your network access product from the pop-up list.

Add and apply additional network access products.
You can create as many products as you like.
Click the checkbox under "Use?" to make the network access product available to
customers who log in using the authentication system.

Using PayPal Website Payments Standard
How to configure the PayPal authentication system to use PayPal Website Payments Standard to process user payments for network access.
Log into your PayPal Account.

In order to accept payments using PayPal you need to have a Premier or Business Account. Upgrade your PayPal
Personal Account if necessary.

Go to Payment Data Transfer (PDT) setup.
Log into PayPal, and click on My Account, Profile, and Website Payment Preferences to
access the Payment Data Transfer page.

Turn on Auto Return.
Click "On" next to "Auto Return".
The Return URL is supplied automatically by SputnikNet at the time of purchase.

However, PayPal's system requires that you enter a valid web address. So, just type in
your favorite URL--it won't be used.
Turn on Payment Data Transfer.

Despite the "(optional)" on PayPal's page, this step is required. Click "On" next to
"Payment Data Transfer".
In the next two sections we recommend that you set both "Block Non-encrypted Website
Payment" and "PayPal Account Optional" to "Off" to reduce the probability of error.
Finally, click "Save" at the bottom of the page.
After confirming, you should have a long Identity Token. Copy your PDT Identity Token.

Go to Custom Payment Page Styles (optional).
You can customize the look and feel of the payment pages your customers will see--
your customers need not know that PayPal is behind the scenes. To do this, click on "My
Account", "Profile", and "Custom Payment Pages".
Set up Custom Payment Page Styles (optional).

Follow instructions on the PayPal website to set up your custom payment pages.

Navigate to the PayPal authentication system in SputnikNet.
Log into SputnikNet and select "PayPal" from the "Authentication" menu.
Add a new PayPal authentication system or select an existing one.

Click on "Add New Authentication System" to do just that. Or, select your existing PayPal
authentication system from the list (if you have just one, you will skip this step.)

Name your PayPal Authentication System and apply basic settings.
- Select a module: select "PayPal Module" (authentication system).
- Name or description: provide a name for the authentication system that will be
displayed in SputnikNet.
- Visible name: provide a descriptive name that users will understand. This name will be
displayed in the captive portal window if users have to select from more than one
authentication systems.
- Allow duplicate logins?: check this box if a subscriber can log in multiple simultaneous
sessions (usually disallowed).
- Display warning about popup?: warns users not to close the session monitor window
(which they can use to log out, rather than have the system timeout after they leave).
Because PayPal authentication only supports continuous account time limits, it isn't
necessary to check this box.
Click "Add" or "Save Changes" when done.

Apply PayPal Merchant settings.
- PayPal API Method: select Website Payments Standard (see "PayPal Website
Payments Pro" for more information about PayPal's alternative payment method).
- Use Sandbox?: only check the box if you are using PayPal's developer sandbox to
process transactions in test mode.
- PayPal Account: enter your PayPal Account Name (usually an email address).
- PDT Authentication (Identity) Token: paste in your Payment Data Transfer token, which
you copied earlier. Click "Find It" to open a PayPal browser window.
- Page Style: enter the name of the PayPal page style you want to use for completing
payments or leave blank to use the default.
- Sign-up Prompt: enter the text the user will see on the Captive Portal next to the
sign-up button.
- Sign-up Button Text: enter the text you want to display on the sign-up button.
- Disable MAC authentication: if left unchecked, users with current accounts will be able
to simply click through to log in-- authentication is performed using the client device's
MAC (hardware) address. Check the box if you want to force users to log in every time.

existing one.

Name your product, set price and expiration.
- PayPal Currency Code: select the desired currency from the pop-up list (see next step).
avoids disputes.

Select desired currency.
Choose the appropriate currency for your product from the pop-up list.

Add more network access products.
Apply the authentication system to one or more captive portals.

Click on "Captive Portals" from the CONFIG menu. Then click on "Walled Garden and
Authentication". Click the checkbox next to the authentication system that uses the rate
plan you set up previously. Click "Update" to save your settings.

Apply the captive portals to one or more Sputnik-powered devices.
Click on "Routers" from the CONFIG menu. Then click on the name of any
Sputnik-powered device ("router"). From the pop-up "Portal" menu, select the captive
portal that uses the authentication system you set up previously. Click "Save Settings" to
do just that.
To see what users experience when logging in, see the online documentation chapter
titled "User Experience: Paying for Access using the PayPal Authentication System".

Using PayPal Website Payments Pro
How to configure the PayPal authentication system to use PayPal Website Payments Pro to process user payments for network access.
Log into your PayPal Account.

In order to accept payments using PayPal you need to have a Premier or Business Account. Upgrade your PayPal
Personal Account if necessary.

Apply for Website Payments Pro.
Apply for Website Payments Pro, or activate it if you already have an account.
Accept Billing Agreement.

Click Agree to accept PayPal charges.

Go to Custom Payment Page Styles (optional).
You can customize the look and feel of the payment pages your customers will see--
your customers need not know that PayPal is behind the scenes. To do this, click on "My
Account", "Profile", and "Custom Payment Pages".

Go to API Access.
You need API credentials from PayPal in order to use Website Payments Pro. To do
this, click on "My Account", "Profile", and "API Access".

Request API Credentials (or view existing Credentials).
Click on "Request API Credentials" if you need them, or "View or Remove Credentials" if
you already have them. If the latter, you can skip the next few steps.
Request an API Signature.

Select "API Signature", review and agree to the Terms of Use, and click "Submit".

Wait for PayPal to email you with access to your API credentials.
You should receive an email from PayPal giving with a link to your API Credentials. Click
on the provided link, or navigate manually to PayPal's site to retrieve your API
Credentials.
Access your PayPal API Credentials.

Return to the PayPal API Set-up page, and click on "View or Remove Credentials".

Copy your API Username, Password, and Signature.
Copy your API Username, Password and Signature. You will need to enter this
information into SputnikNet.
Navigate to the PayPal authentication system in SputnikNet.

Log into SputnikNet and select "PayPal" from the "Authentication" menu.

Add a new PayPal authentication system or select an existing one.
Click on "Add New Authentication System" to do just that. Or, select your existing PayPal
authentication system from the list (if you have just one, you will skip this step.)
Name your PayPal Authentication System and apply basic settings.

- Select a module: select "PayPal Module" (authentication system).
Because PayPal authentication only supports continuous account time limits, it isn't

Select Website Payments Pro.
Select "Edit Settings" from the Authentication System menu and choose "Website
Payments Pro" as the PayPal API Method. Then click "Update Configuration".
Apply PayPal Merchant Settings.

Paste or carefully type your API Username, API Password and Signature into the
corresponding fields in your PayPal authentication method in Sputnik Control Center or
SputnikNet. Click "Update Configuration".
Note that if you do not select the Direct Payments checkbox (for example, if you are a
non-U.S.-based service provider), then the Express Checkout path will be used to
process customer purchases and the user will either need a PayPal account or to pay by
credit card while signing up for an account.
Click "Update Configuration" to apply your settings.

existing one.
Name your product, set price and expiration.

- PayPal Currency Code: select the desired currency from the pop-up list (see next step).
avoids disputes.

Select desired currency.
Choose the appropriate currency for your product from the pop-up list.

Add and apply additional network access products.


do just that.
titled "User Experience: Paying for Access using the PayPal Authentication System".

User Experience: Paying for Network Access using a Credit Card (Pro)
What a customer sees when paying for network access using a credit card processed by PayPal Website Payments Pro. Using this method, customers pay through
the captive portal without being redirected to PayPal.
Purchasing Wi-Fi access using a credit card.

New customers click "Buy a Plan" to do just that.

Choosing an access plan.
Customer choose an access plan from the list that you created in the PayPal
authentication system applied to the captive portal. You can set prices and time limits
however you like; Sputnik does not take a cut of your revenues.

Selecting credit card payment with automatic login.
Customers can skip username/password login by checking the box next to
"Automatically recognize my computer or wireless card". As long as there is time
remaining on the plan that they purchase, they will be logged in automatically, and won't
see a captive portal.
If you don't want this option to appear, from the "Edit Settings" page of the PayPal
authentication system in SputnikNet, check "Disable MAC Authentication".

Selecting credit card payment with standard captive portal login.
Customers enter their desired login ID (username) and password. They select "Credit Card"
and click "Continue".

Providing billing information.
Customers complete a standard credit card billing form, and click "Submit Order".

Payment confirmation.
Customers will briefly see a payment confirmation screen before being redirected to a
welcome screen.

Login confirmation.
Customers will briefly see a login confirmation screen before being redirected to their
home page, or the site they originally attempted to go to.

Future logins.
As long as there is time remaining on their account, they will be able to log in with their
username and password (if they selected "Automatic login" they'll skip this page).

User Experience: Paying for Network Access using a Credit Card (Standard)
What a customer sees when paying for network access using a credit card processed through PayPal Website Payments Standard.
Multiple authentication methods: signing on with a prepaid card account.

Warp 9 Wi-Fi, a fictional service provider, provides fee-based Wi-Fi service. They want
end-users to have the flexibility of paying with credit cards or PayPal accounts. Also,
Warp 9 wants to give out pre-paid cards as promotional items.
To do this, Warp 9 uses two authentication systems: prepaid and PayPal. If the customer
has a Warp 9 prepaid card, they simply enter their username and password, as shown
here, and start browsing.

Signing on with an already purchased account.
Similarly, if the customer has already purchased an account from you, they click on
"Credit Card or PayPal", enter their username and password, and login.

Signing up for, and purchasing a new account.
If the customer doesn't have an account, they click the "Need an account?" button,
choose their preferred login ID and password, and click "Proceed to Purchase".

Optional: signing up for, and purchasing a new account with automatic login.
If you haven't disabled MAC authentication, the user can click on "Automatically
recognize my computer or wireless card" to skip the login process in the future. After
their purchase, they system will recognize the MAC address of their wireless card and
enable them to login automatically.

Choosing a rate plan.
The customer can now choose among the various billing options set up by Warp 9. You
have complete control over the duration and price of all of the offerings.

Checkout.
The customer can now choose whether they want to pay by credit card or via PayPal.
They do not need a PayPal account to pay.

Billing information.
The customer enters their credit card billing information.

Once the credit card or PayPal payment is approved, the customer briefly sees a
confirmation screen.

Login confirmation.
The customer is automatically routed to a page confirming that their account has been
created, they've successfully logged in, and that they're on the internet.

Session monitoring.
The customer sees a pop-up window that shows how much time they've used and how much bandwidth they've
consumed. The customer can also use the session monitor window to log out.
Note: if the customer has pop-up blocking on, they will not see this window unless they click on the "Monitor Session"
button on the previous screen. If the Session Monitor window is not available, the system will log them out automatically
after the idle time configured in SputnikNet.

User Experience: Paying for Network Access using PayPal (Pro)
What a customer sees when paying for network access using a PayPal account processed by PayPal Website Payments Pro. Using this method, customers pay
through the captive portal without being redirected to PayPal.
Purchasing Wi-Fi access using PayPal.

New customers click "Buy a Plan" to do just that.

Choosing an access plan.
Customer choose an access plan from the list that you created in the PayPal
authentication system applied to the captive portal. You can set prices and time limits
however you like; Sputnik does not take a cut of your revenues.

Selecting PayPal payment with automatic login.
Customers can skip username/password login by checking the box next to
"Automatically recognize my computer or wireless card". As long as there is time
remaining on the plan that they purchase, they will be logged in automatically, and won't
see a captive portal.
If you don't want this option to appear, from the "Edit Settings" page of the PayPal
authentication system in SputnikNet, check "Disable MAC Authentication".

Selecting PayPal payment with standard captive portal login.
Customers enter their desired login ID (username) and password. They select "PayPal" and
click "Continue".

Redirection to PayPal's web site.
Customers will briefly see a payment confirmation screen before being redirected to a
welcome screen.

Paying via PayPal.
Customers log into PayPal to complete their payment. You can set up custom-branded
page styles in your PayPal profile. Reference the name of the PayPal page style in the
"Edit Settings" page of your PayPal authentication system within SputnikNet to use it.

After paying, customers will briefly see a payment confirmation screen before being
redirected to a welcome screen.

Login confirmation.
Customers will briefly see a login confirmation screen before being redirected to their
home page, or the site they originally attempted to go to.

Future logins.
As long as there is time remaining on their account, they will be able to log in with their
username and password (if they selected "Automatic login" they'll skip this page).

User Experience: Paying for Network Access using PayPal (Standard)
What a customer sees when paying for network access using their PayPal account processed through PayPal Website Payments Standard.
Multiple authentication methods: signing on with a prepaid card account.

Warp 9 Wi-Fi, a fictional service provider, provides fee-based Wi-Fi service. They want
end-users to have the flexibility of paying with credit cards or PayPal accounts. Also,
Warp 9 wants to give out pre-paid cards as promotional items.
To do this, Warp 9 uses two authentication systems: prepaid and PayPal. If the customer
has a Warp 9 prepaid card, they simply enter their username and password, as shown
here, and start browsing.

Signing on with an already purchased account.
Similarly, if the customer has already purchased an account from you, they click on
"Credit Card or PayPal", enter their username and password, and login.

Signing up for, and purchasing a new account.
If the customer doesn't have an account, they click the "Need an account?" button,
choose their preferred login ID and password, and click "Proceed to Purchase".
If you haven't disabled MAC authentication, the user can click on "Automatically
recognize my computer or wireless card" to skip the login process in the future. After
their purchase, they system will recognize the MAC address of their wireless card and
enable them to login automatically.

Choosing a rate plan.
The customer can now choose among the various billing options set up by Warp 9. You
have complete control over the duration and price of all of the offerings.

Checkout.
The customer can now enter their PayPal account credentials to pay. Or, they can pay
via credit card, in which case they don't need a PayPal account.

Paying with a PayPal account.
The customer signs in with their PayPal account information, and confirms payment.
Once payment is approved, the customer briefly sees a confirmation screen.

Login confirmation.
The customer is automatically routed to a page confirming that their account has been
created, they've successfully logged in, and that they're on the internet.

Session monitoring.
The customer sees a pop-up window that shows how much time they've used and how much bandwidth they've
consumed. The customer can also use the session monitor window to log out.
Note: if the customer has pop-up blocking on, they will not see this window unless they click on the "Monitor Session"
button on the previous screen. If the Session Monitor window is not available, the system will log them out automatically
after the idle time configured in SputnikNet.

Using WorldPay for International Payments
How to configure the WorldPay authentication system to process user payments for network access.
Navigate to the WorldPay authentication system in SputnikNet.

Log into SputnikNet and select "WorldPay" from the "Authentication" menu.

Add a new WorldPay authentication system or select an existing one.
WorldPay authentication system from the list (if you have just one, you will skip this step.)
Name your WorldPay Authentication System and apply basic settings.

- Select a module: select "WorldPay Module" (authentication system).
Because WorldPay authentication only supports continuous account time limits, it isn't

Configure WorldPay settings.
Click "Edit Settings" under the Authentication System menu to enter your WorldPay
account data.
- WorldPay API Method: this will show "Select Junior" by default. It refers to a WorldPay
merchant payment system.
- Test mode?: only check the box if you are using WorldPay's developer sandbox to
process transactions in test mode.
- WorldPay Installation ID: enter your WorldPay Installation ID, available from
WorldPay's merchant control panel.
- Sign-up Prompt: enter the text the user will see on the Captive Portal next to the
sign-up button.
- Sign-up Button Label: enter the text you want to display on the sign-up button.
- Disable MAC authentication: if left unchecked, users with current accounts will be able
to simply click through to log in-- authentication is performed using the client device's
MAC (hardware) address. Check the box if you want to force users to log in every time.
Click "Update Configuration" to apply your settings.

Add new network access products (rate plans).
existing one. You can create as many products as you like.
For more information about setting up network access products, see the online
documentation chapter titled "Setting up Rate Plans for PayPal or WorldPay".


do just that.
titled "User Experience: Paying for Access using the WorldPay Authentication System".

Be sure to configure WorldPay's callback URL.
Be sure to set your callback URL in WorldPay's account configuration page. This
ensures that users are redirected to your website after purchasing access. Set it to:
https://<WPDISPLAY ITEM=MC_callback>.
See WorldPay's online knowledge-base for more information on that subject.

PayPal and WorldPay User and Transaction Logs
How to use PayPal and WorldPay user and transaction logs to keep track of user activity and billing.
User and transaction logs.

PayPal and WorldPay user and transaction logs work the same way. Here's a quick
overview:
- The user log (under the "Users" menu) shows a list of all user accounts in the selected
authentication system
- User details provides information about a specific user account, and lets you modify
basic settings, such as account expiration time, password, and whether the account is
enabled or disabled
- User transactions provides a list of all of the selected user's purchase transactions;
clicking on any one of them provides details about that transaction
- The transaction log ("Transaction Log" menu) shows a list of all transactions in the
selected authentication system
- Clicking on any transaction provides details for that transaction, and a link to the "Edit
Settings" page of the Sputnik-powered device where the purchase transaction occurred

Corresponding records in PayPal or WorldPay.
SputnikNet logs include PayPal or WorldPay user and transaction IDs, making it easy to
find the corresponding user accounts or transactions in your online merchant account.

To view the user or transaction logs for your PayPal or WorldPay authentication system, click on "Authentication" from the
"CONFIG" menu.

Select the PayPal or WorldPay authentication systems you want to view.
As noted, PayPal and WorldPay user and transaction logs work the same way. For this
example, we'll look at the logs for Joe's Cafe PayPal authentication system.

Browse or search for users.
Click "Users" from the Authentication System menu.
You can browse a list of users who have registered with your PayPal Authentication
System. User accounts are displayed in reverse chronological order from the time they
were created (in other words, most recently created user accounts are on top).
To browse all users, type "%" (wild-card character) into the text field, set the "Display
Limit" to the number of rows you want to view, and click the "Search" button. To narrow
your search, type in a portion of the login ID followed by %. For example, to find all users
with login IDs that start with "Ni", e.g. "Nicholas" or "Nick", search for "Ni%". To find all
matches with the "ic" in them, search for %ic%-- in this case, you'd find both of the
previous login IDs as well as "nicka". Searches are case sensitive.
Click on a Login ID to see details, edit settings.

Clicking on a Login ID provides more information about that user, and enables you to
edit settings:
- Display Name: this is the account name displayed in SputnikNet, along with the
associated Login ID. It is also displayed to the customer on the welcome page they see
after a successful login. You can edit it here.
- Expires: shows the current expiration time of the account, which you can modify.
- New Password: enables you to change the password associated with this login ID.
- Payee ID: the ID assigned to the customer by PayPal (or WorldPay).
- Disabled: check this box if you want to disable the account.
Click on "Update" to apply any changes.

Click on "View Transaction Log" to see a summary of the user's transactions in the
current authentication system.
User transaction log.

Here you can view the user's prior transactions, which appear in reverse chronological
order (most recent on top):
- PayPal (or WorldPay) Transaction ID: matches the corresponding transaction record in
your PayPal (WorldPay) merchant account. Click on a transaction ID to examine details.
- Order Time: time of purchase.
- Assigned Login: the user can have multiple assigned logins - for example, if
MAC-based (automatic) authentication is enabled, their MAC address becomes the
assigned login; further, users can change their login ID at any time. Regardless of login
ID, they are tracked by a single PayPal (WorldPay) payee ID.
- Product/Plan: the product purchased from your rate plan.
- Amount Paid: the price set by you for the network access product.
- Action Taken: indicates the new, post-purchase expiration time for the user's account.

Transaction details.
Clicking on a specific user transaction displays detailed information for that transaction.
"Originated at" provides a link to the "Edit Settings" page of the Sputnik-powered device
where the transaction occurred.

Complete transaction log.
Click on "Transaction Log" from the Authentication System menu to view a summary of
recent transactions for the selected authentication system, in reverse chronological
order. These transactions will also be viewable from your PayPal (WorldPay) merchant
account. Click "Next >" (and optionally increase the "Display Limit") to view older
transactions.
Click on a Transaction ID to view transaction details, as shown above.
Click on an Assigned Login to view and edit settings for the user account, as shown
above.

Authenticating Users with SputnikNet

Users, Groups, and Network Policies
How to use the user authentication system to create user accounts and groups, and to automatically assign network policies to authenticated users based upon
group membership.

Click on "Authentication" under the "CONFIG" menu.

Add a new user authentication system, or select an existing one.
Click on "Add New Authentication System", or on the name of the user authentication
system you want to edit.
Name your user authentication system.

Be sure "Basic User Database Module" is selected. For more information about creating
authentication systems, see online documentation chapter titled "Creating a new
Authentication System".

Edit your authentication system settings (optional).
Each authentication system has an "Edit Settings" page. The user authentication system
has an account self sign-up option. Leave this option unchecked; see the online
documentation chapter titled "User Self-Registration" for more information.
Add a new user account.

Select "Users" from the "Authentication System" menu. Click "Add New Login" to add a
new user account.

Enter basic user account settings.
Enter basic settings:
- Login ID: the unique case-sensitive ID the user will log in with; once created, it cannot
be edited
- Display Name: the name of the user that appears in the SputnikNet interface and on
the page the user sees after a successful login
- Expires: optional termination date for the account, after which it will no longer be active
- Password: password the user will log in with
Enter user account details (optional).

Enter more details, if desired:
- Email address
- Title
- Organization
We'll set up groups and assign memberships later.

Add additional user accounts, as needed.
You can add as many user accounts as you want.
Add a new group.

Groups are collections of users that can have specific network policies. To create a new
group, select "Groups" from the "Authentication System" menu and click on "Add New
Group".

Enter group settings.
Enter basic group settings:
- Group Identifier: unique name for the group; once created, it cannot be edited
- Description: comments or more details about the group
Add additional groups, as needed.

You can enter as many groups as you want. Groups are ordered in chronological order -
first group created on top. If users are assigned to multiple groups, group policies are
applied in that order.

Assign users to groups.
To assign a user to a group, click "Users" from the "Authentication System" menu, then
click on the Login ID of the user account you want to edit. Check the boxes next to the
group or groups you want to assign them to. As noted, if you assign a user account to
multiple groups, policies will be applied in group order.
Select a group to view member list.

To view the members of a group, select "Groups" from the "Authentication System"
menu, and then click on the corresponding Group ID.

Review group member list.
The members of the group are displayed. To apply network policies to the group, click on
"Group Policies" from the "Authentication System" menu.
Edit group policies.

Click "[Edit]" next to the name of the group whose policies you want to edit.

Apply network policies to a group.
Click the checkbox next to the name of the network policy (or policies) you want to apply
to that group. In this example, "Block Private Nets" and "Content filtering" policies will be
applied to authenticated users who belong to the "Members of SF Tennis Club" group.
Network policies are applied to group members in the same order that they are applied
to the group itself. For example, if you want to ensure that "Block Private Nets" policies
apply before "Content filtering" policies, click the checkbox next to "Block Private Nets",
then click the "Update Policies Button". Next, click the checkbox next to "Content
filtering" and click the "Update Policies" button again.
To see more detail about a specific network policy, or to modify a policy setting, click on
its name.
For more information about network policies, see the online documentation section titled
"SputnikNet Network Policies".
Review groups and network policies.

Different network policies can apply to various group. Here the SFT Members group will
have content filtering applied, and will not be able to access private network resources.
SFT Pros don't have content filtering, they can freely access network resources except
the blocked finance server.

End user login.
Apply your user authentication system to one or more captive portals; apply your captive
portals to Sputnik-powered devices.
Users who log in are automatically assigned to the group(s) of which they are members,
and network policies are applied to them as soon as they authenticate.

User Self-Registration
How to enable users to sign up for new accounts, to assign network policies to self-registered users, and track usage.
Log into SputnikNet, then navigate to the user authentication system overview.
Log into SputnikNet and click on "Users" from the Authentication menu. Or simply click "Authentication" to start with a generic
authentication system which you can configure as a user authentication system.

Add a new user authentication system, or select an existing one.
Click "Add New Authentication System" to do just that. Or, select a Authentication
System from the list, as shown in this example.
Enable self sign-up

Click on "Edit Settings" from the Authentication System menu. Click the checkbox next to
"Allow Self Sign-up?" Enter text for the self sign-up description and button, or use the
defaults. Click "Update" to apply your changes.

User experience: how self sign-up works
Users see the self sign-up description and button on the captive portal.

User experience: creating a new account
Users must supply the following information to create a new account:
- Requested User ID: their login ID

- Your Full Name: user's "Display Name", which is used in SputnikNet and displayed to
users on the welcome page shown after a successful login
- Password
Everything else is optional.
User experience: welcome page

Users briefly see a welcome page after they create their account, enabling them to pop
up a session monitor window (even if their browser blocks pop-up windows).

View users in SputnikNet.
You can view all user accounts, including those created by self-signup, in SputnikNet.
Click on a user's login ID to edit settings or delete the account.

Edit user account settings.
You have control over a number of user settings:
- Display Name: change the name of the user account displayed in SputnikNet and on
welcome pages, as shown above
- Expires: change expiration date and time of the account (default is "Never")
- Password: note, if changed the new password is not sent to the user
- Email
- Title
- Organization
- Group membership: click checkboxes next to the group(s) you want to assign the user
to; network policies inherited from the group(s) are applied to the user when they log in
You can also delete the user account.
By default, self sign-up users are not assigned to any group. However, you can create a
"Guest" group, apply network policies to it, and manually assign self sign-up users to it.
For more information about network policies, see the online documentation section titled
"SputnikNet Network Policies".
Track user activity in SputnikNet.

To track user activity, click on "Client Sessions" from the REPORTS menu.

Client session details.
Browse or search for users whose activity you want to track. SputnikNet provides
detailed reports on bandwidth usage by user account. For more information, see the
online documentation section titled "SputnikNet Reports".

Authenticating Devices with SputnikNet

Authenticating Devices without Web Browsers
How to use device authentication to enable devices to automatically log in based on MAC address. This is useful for devices without web browsers (e.g. printers,
VoIP phones, gaming devices) or frequently used employee computers. MAC-authenticated devices are still tracked in SputnikNet.
Log into SputnikNet, then navigate to the device authentication system overview.
Log into SputnikNet and click on "Devices" from the Authentication menu. Or simply click "Authentication" to start with a generic
authentication system which you can configure as a device authentication system.

Add a new device authentication system, or select an existing one.
Click "Add New Authentication System" to do just that. Or, select an existing device
authentication system from the list.
Name your device authentication system.

Be sure "Basic Device Database" is selected. For more information about creating
Add new devices.

Click on "Devices" from the "Authentication System" menu.
Every network device has a MAC address ("media access control") that uniquely
identifies it. You can automatically log in devices by entering their MAC addresses into
the device authentication system. The MAC address format for SputnikNet is six pairs of
hexadecimal digits (lower case), separated by colons (:).
- MAC Address: enter the MAC address of the device you want to grant access to (or of
its wireless card)
- Description: enter a memorable name for the device, which will appear in SputnikNet

Click "Add New Device Authorization" to add that device's MAC address to the
authentication system database.
Check entered MAC addresses.

Your newly entered device MAC will display; review it for accuracy. If there is an error,
click the checkbox next to the incorrect MAC address, select "Delete Selected Devices",
then re-enter.

Continue to add MAC addresses.
You can add as many MAC addresses as needed.
Apply the device authentication system to Sputnik-powered devices.

Device authentication systems are applied directly to Sputnik-powered devices (routers) instead of captive portals, because their
network policy ("allow rule") applies before the captive portal is displayed.
To apply a device authentication to a Sputnik-powered device, click on "Routers" from the "CONFIG" menu.

Select the Sputnik-powered device you want to edit.
Click on the name of the Sputnik-powered device (router) that you want to edit.
Select the device's overrides settings.

Click on "Policy and Authentication Overrides" from the "Edit Settings" menu.

Apply the device authentication system as an override.
Select the device authentication system(s) you want to apply to the Sputnik-powered
device from the "Override Authentication Systems" list. Click on "Save Overrides" to
apply your settings. You can apply multiple authentication systems to a single
Sputnik-powered device - including multiple device authentication systems.
Continue to add the device authentication system to all of the Sputnik-powered devices
where you want it to operate.
User devices with matching MAC addresses bypass captive portal login.
Important: if you want to immediately test device authentication with a client device, turn
off both the client device and the Sputnik-powered device. Turn on the Sputnik-powered
device first, let it boot, and then turn on the client device.This last step is needed
because if a client device already had a DHCP lease with the Sputnik-powered device
when you applied the authentication system, then the device authentication is not
invoked because the only time a MAC address is checked against the database is when
that client device requests an IP address via DHCP. Thus, device authentication does
not work if you assign static IP addresses to client devices-- it only works with DHCP.

Track MAC-authenticated devices in SputnikNet.
Click on "Client Sessions" from the "REPORTS" menu to view data for all client
sessions. Click on the client name (in this case a MAC address) to view more details
about that device.

View detailed bandwidth reports.
MAC-authenticated devices are tracked the same as all other clients in SputnikNet.

Enabling Selected Users to Skip Captive Portal Login based on Client Device
How to enable selected users to skip captive portal login in the future by adding their device's MAC address to a device authentication system.
Find the MAC address of the device(s) you want to automatically login.
If you need the MAC address of an existing user's device, you can find it in SputnikNet. To do this, click on "Client Sessions" from the
"REPORTS" menu.

Copy the device MAC address.
Click on the name of the device you want to automatically authenticate in the future.
Select the device's MAC address, and copy it.

Add the MAC address to a device authentication system.
From the "Authentication" menu under "CONFIG", select an existing device
authentication system or create a new one. Paste the device's MAC address into the
"MAC Address" field, and name it. Click on "Add New Device Authentication" to update
the device database.
NOTE: you can give the device a new name, or keep its current name. Reports
differentiate the device based on the authentication system used. For example, "Bob's
iPhone" manually logged in using the "204 Users" authentication system in the report,
above.

Apply the device authentication system to Sputnik-powered device(s).
Make sure that your device authentication system is applied as an authentication system
override to the Sputnik-powered device(s) where the user's device will be logging in. For
more information, see the online documentation chapter titled "Authenticating Devices
without Web Browsers".

RADIUS Authentication with SputnikNet

Setting up RADIUS Authentication
How to set up a RADIUS authentication system for authenticating users against a remote RADIUS server.
Log into SputnikNet, then navigate to the RADIUS authentication system overview.
SputnikNet RADIUS authentication enables the authentication of accounts (maintained on a separate RADIUS server) on your
Sputnik-powered network.
Log into SputnikNet and click on "RADIUS" from the Authentication menu. Or simply click "Authentication" to start with a generic
authentication system which you can configure as a RADIUS authentication system.

Add a new RADIUS authentication system, or select an existing one.
Click "Add New Authentication System" to do just that. Or, select an existing device
authentication system from the list.
Name your RADIUS authentication system.

Be sure "RADIUS Module" is selected. For more information about creating

Configure RADIUS connection settings.
Enter the following information into the "Edit Settings" page:
- Authentication Server: fully qualified domain name of your RADIUS authentication

server
- Authentication Port: the port on the server that is assigned to RADIUS authentication
communications
- Authentication Secret: the password for your RADIUS authentication server
- Accounting Server: fully qualified domain name of your RADIUS accounting server
- Accounting Port: the port on the server that is assigned to RADIUS accounting
communications
- Accounting Secret: the password for your RADIUS accounting server
- RADIUS communications timeout: the amount of time, in seconds, that SputnikNet will
wait for a response from the RADIUS server.
Click "Update" to save your settings.
Test RADIUS connection settings.

To test the connection to your remote RADIUS server, enter a known username and password, then click "Test".
SputnikNet will attempt to "authenticate" the user against the RADIUS database. Review your RADIUS server logs
to make sure that the authentication transaction is accounted for properly.

Add additional RADIUS authentication systems.
You can authenticate accounts on one or many external RADIUS servers. Repeat the
above steps to set up additional RADIUS authentication systems.
Apply RADIUS authentication systems to captive portals.

Authentication" from the "Captive Portal Properties" menu.
Click on the checkbox next to the RADIUS authentication system(s) you want to apply to
the captive portal. Click "Update" to save your settings. To view more information or to
edit the settings of any authentication system, click on its name in the list.
If applying more than one authentication system, select them, one at a time, in the order
you want them displayed, and click "Update" after each selection.

Apply captive portals to Sputnik-powered devices (routers).
Click on "Routers" from the "CONFIG" menu. Select the portal that is associated with the
RADIUS authentication system. Click "Save Settings" to do just that.

User experience: logging in using RADIUS credentials.
Users who associate with a Sputnik-powered device with the chosen captive portal will
be able to authenticate using their account on any of the remote RADIUS servers.

Authenticating with Microsoft Active Directory
How to use RADIUS with SputnikNet to authenticate users against a remote Windows Active Directory server.
Install Microsoft Internet Authentication Services (IAS).

NOTE: it is best to install IAS on your Active Directory primary server, however you can install in on any 2000/2003 server that is a member of your Active Directory
domain, as follows:
1. Install IAS by going to Start -> Settings -> Control Panel -> Add/Remove Programs.
2. Once the Add/Remove Programs window is open click the Add/Remove Windows Components Icon in the left side window.
3. When the Windows Components Wizard window opens scroll down the list and highlight Networking Services and then click the Details button.
4. Now check the box for Internet Authentication Services. Then click OK.
5. When you get back to the Windows Components Wizard click next. IAS will then be installed. Click Finish when the installation is complete.
For more information about IAS see Microsoft TechNet documentation.
Configure Microsoft IAS.

1. Go to Start -> Programs -> Administrative Tools -> Internet Authentication Services.
2. Once IAS is open you need to first register it with Active Directory. In the Left window highlight the Root of Internet Authentication Services then click on Action
at the top menu and select "Register Server in Active Directory" from the drop down.

Create a RADIUS client for your SputnikNet account.
1. In the left window, right click on the RADIUS Clients folder and select "New RADIUS Client" from the drop-down menu. This will open the New Client Wizard.
2. Now you will need to enter a friendly name for the client. We use Sputnik.
3. Enter the DNS name of the server. To verify a DNS name click the Verify button. Once verified click the Next button.
4. For Client-Vendor select RADIUS Standard.
5. Enter a pass phrase for the Shared secret and confirm it.
6. When finished click the Finish button.
Configure remote access policies.

1. In the left window click on Remote Access Policies. The right window will now display the default Access Policies.
2. Right click on the "Connections to other access servers" policy and select Properties.
3. Click the "Edit Profile" button.
4. Go to the Authentication Tab. Check the box for "Unencrypted authentication (PAP, SPAP)".
5. Click OK.
6. At the bottom of the "Connections to other access servers" properties window change the "If a connection request matches the specified conditions:" to "Grant
remote access permission" Then click OK.

Configure a RADIUS authentication system in SputnikNet.
1. Log into SputnikNet.
2. Click on "RADIUS" from the "Authentication" menu.
3. Click "Add New Authentication System."
4. Choose "RADIUS Module" from the "Select a module" pop-up menu.
5. Supply an administrative and user-visible name and click "Save Changes". You should see your new RADIUS authentication system listed in the authentication
system overview.
6. Click on the name of your RADIUS authentication system to configure it.
7. Click on "Edit Settings" from the "Authentication System" menu.
8. Enter the DNS name of your RADIUS server. The Authentication and Accounting Servers are one and the same.
9. Set the port for the Authentication Server to 1812 and the port for the Accounting Server to 1813. The Authentication and Accounting Secret will be the same as
the Secret you set up for the RADIUS client in IAS.
10. Set the RADIUS communications timeout to whatever you wish. We use 14000.
11. When complete click the "Update" button.
12. Click on "Captive Portals" from the "CONFIG" menu.
13. Click on the name of the captive portal you wish to use with RADIUS authentication, or create a new one.
14. Click on "Walled Garden and Authentication" from the "Captive Portal Properties" menu.

15. Under "Authentication Systems" click the checkbox next to the name of your RADIUS authentication system.
16. When finished click "Update".

Advertising with SputnikNet (Beta)

Enabling Advertising for your SputnikNet Account
How to apply to use SputnikNet's advertising features.
Adding advertising to your SputnikNet Account.

SputnikNet does not include advertising functions out-of-the-box, as the feature is still in beta.

Submit a support request.
To add advertising features, click on "Report a bug" at the upper right corner of every
SputnikNet page.
Complete the support request form.

Enter:
- Company Name: your company name

- Email address: your email address
- Subject: "Advertising"
- Your SputnikNet FQDN: your SputnikNet Account name
- Support Issue: select "SputnikNet" from the pop-up menu
- Case Type: select "SputnikNet admin support"
- Description: request to have the advertising system turned on

Advertising menu.
"Advertising" will be added as a new menu item after the list of authentication systems.

Enabling AnchorFree Advertising for Sputnik-Powered Devices
How to enable and configure the AnchorFree advertising system for your Sputnik-powered devices.
Navigate to the advertising system.

Sputnik partner AnchorFree provides targeted local advertising for Wi-Fi hotspots. You can use SputnikNet in conjunction with the
AnchorFree advertising system to monetize hotspot service with advertising revenue. Contact AnchorFree for more information
about their service.
To start using AnchorFree advertising, click on "Advertising" from the "CONFIG" menu.

Enable advertising on a Sputnik-powered device.
Advertising systems can be applied directly to Sputnik-powered devices. The device's
location and venue information is passed to AnchorFree, enabling them to provide
relevant local advertising (where available).
Choose "click to enable" to turn on advertising for a selected Sputnik-powered device

("router").
Use "Search Options" to find a specific Sputnik-powered device or narrow the list. Use
the % symbol to match one or more wild-card characters; searches are case-sensitive.

Edit AnchorFree advertising settings.
Enter the following information:
- SSID: this is typically configured in the Sputnik-powered device's "Edit Settings" page,
however you can change it here
- AF Venue Type: select the type of venue where the Sputnik-powered device is located;
this will help AnchorFree better target ads
- Address/City/State/Postal Code/Country: enter the address where the Sputnik-powered
device is located; again, this helps in ad targeting
- Publish Location: click the checkbox if you want AnchorFree to display your location in
their hotspot directory maps
Click "Enable Advertising" to turn on Anchorfree advertising for that Sputnik-powered

device.
NOTE: you can click on the "Node Name" link to see or edit additional settings for the
Sputnik-powered device; be sure to save your changes first.

User experience: browsing the web with AnchorFree banner ads.
Users will see an AnchorFree ad banner at the top of all of the web pages they visit

Updating or disabling AnchorFree advertising.
You can return to the Sputnik-powered device's "AnchorFree Advertising Settings" page
to modify your settings or to disable advertising.
Reactivating the AnchorFree advertising system.

AnchorFree advertising settings are saved even if you disable advertising for a
Sputnik-powered device. To re-enable advertising service, click on "Deactivated" next to
the name of the Sputnik-powered device ("router").

Applying AnchorFree Advertising to Authentication Systems
How to apply AnchorFree advertising to authentication systems.


Enable AnchorFree Advertising.
Advertising systems are typically applied directly to Sputnik-powered devices. The
device's location and venue information is passed to AnchorFree, enabling them to
provide relevant local advertising (where available). However, you can apply advertising
systems to an authentication system, making it easier to update multiple
Sputnik-powered devices. In this case location and venue information is not passed to
AnchorFree for each Sputnik-powered device.
To apply AnchorFree advertising to a SputnikNet authentication system, first enable

advertising for at least one Sputnik-powered device. This will generate the network
policies required to use the AnchorFree service. You can then disable the advertising
system for the Sputnik-powered device. For instructions on how to do this, see the online
documentation chapter titled "Enabling AnchorFree Advertising for Sputnik-Powered
Devices".
When you have done this, click on the Sputnik-powered device's name ("router") to view
the AnchorFree network policies.

View AnchorFree network policies.
Click on "Policy and Authentication Overrides" under the "Edit Settings" page of the
Sputnik-powered device you applied AnchorFree advertising to. You will see two new
network policies:
- AFGL10000491 (or some other number) - this policy proxies web traffic through
AnchorFree for ad insertion
- Sputnik DNAT SCC - ensures that web traffic intended for SputnikNet (e.g. the captive
portal) does not route proxy through AnchorFree - this policy is not needed if AnchorFree
is used at the authentication system level
NOTE: these policies will not be selected if you disabled AnchorFree advertising on the
Click on the "AFGL" policy to view its settings.
AnchorFree (AFGL) policy.

As noted, the AnchorFree destination NAT policy routes traffic through AnchorFree
servers for ad insertion. Do not edit.
Click the back button on your browser, then click on the "Sputnik DNAT SCC" policy to
view its settings.

Sputnik DNAT SCC policy.
The Sputnik DNAT SCC policy is not needed when applying AnchorFree advertising to
an authentication system. You can delete it here, or just leave it unchecked in the "Policy
and Authentication Overrides" page.

Make sure both AnchorFree policies are not applied to the Sputnik-powered device.
Return to the "Policy and Authentication Overrides" page. If the checkboxes next to the
"AFGL" and "Sputnik DNAT SCC" policies are checked, uncheck them, then click "Save
Overrides".

Navigate to the authentication system overview.
Click on "Authentication" from the "CONFIG" menu.

Select an authentication system.
Click on the name of the authentication system you want to apply AnchorFree
advertising to, or create a new one. The guest authentication system is frequently used
in conjunction with advertising.

Click on "[Edit]" to modify the "all" group's policy settings.

Add the "AFGL" network policy to the authentication system.
Click the checkbox next to the "AFGL" network policy to select it. Click on "Update
Policies" to save your settings.
Review network policies.

The AnchorFree network policy applies to "all" users of the selected authentication
system.

Apply the authentication system to captive portals.
Click on "Captive Portals" from the "CONFIG" menu. Select a captive portal from the list
or create a new one. Click on "Walled Garden and Authentication" under "Captive Portal
Properties". Click the checkbox next to the name of the authentication system configured
previously.
Click "Update" to save your settings.

Apply the captive portals to Sputnik-powered devices.
Click on "Routers" from the "CONFIG" menu. Click on the name of the Sputnik-powered
device ("router") that you want to use the captive portal configured previously. Select the
name of the captive portal from the "Portal" pop-up menu.
Click "Save Settings" to apply your changes.

Network policy chain.
The "AFGL" network policy (initially created by AnchorFree) is a DNAT policy that routes
all web traffic through AnchorFree for ad insertion. In the example above, it is applied to
the "all" group of the "Gourmet Select Free" authentication system, which is applied to
the "Gourmet Selections" captive portal, which is applied to the Sputnik-powered device
named "Gourmet Store 65".
Add the authentication system to additional Sputnik-powered devices to use them with
AnchorFree advertising.

Combining Free Ad-Supported Access with Paid Access
How to give the user a choice between free, advertising-supported Wi-Fi using AnchorFree, and paid Wi-Fi using your choice of a paid authentication system.

Free, advertising-supported Wi-Fi access is sometimes offered with paid access. To set up this kind of model in SputnikNet, first
apply AnchorFree advertising to a guest authentication system. Then apply the guest authentication system together with a paid
authentication system to captive portals.

Enable AnchorFree Advertising
To apply AnchorFree advertising to a SputnikNet authentication system, first enable
advertising for at least one Sputnik-powered device. This will generate the network
policies required to use the AnchorFree service. You can then disable the advertising
system for the Sputnik-powered device. For instructions on how to do this, see the online
documentation chapter titled "Enabling AnchorFree Advertising for Sputnik-Powered
Devices".
When you have done this, click on the Sputnik-powered device's name ("router") to view
its network policies.

Make sure both AnchorFree policies are not applied to the Sputnik-powered device.
Click on "Policy and Authentication Overrides" under the "Edit Settings" page of the
Sputnik-powered device you applied AnchorFree advertising to. You will see two new
network policies:
- AFGL10000491 (or some other number) - this policy proxies web traffic through
AnchorFree for ad insertion
- Sputnik DNAT SCC - ensures that web traffic intended for SputnikNet (e.g. the captive
portal) does not route proxy through AnchorFree - this policy is not needed if AnchorFree
is used at the authentication system level
NOTE: these policies will not be checked if you disabled AnchorFree advertising on the
Sputnik-powered device. If the checkboxes next to the "AFGL" and "Sputnik DNAT SCC"
policies are checked, uncheck them, then click "Save Overrides".

Navigate to the authentication system overview.
Click on "Authentication" under the "CONFIG" menu.

Select a guest authentication system, or create a new one.
Click on the name of an existing guest authentication system, or click "Add New
Authentication System" to add a new one.
Edit the authentication systems group policies.

Click "Group Policies" from the "Authentication System" page, then click "[Edit]" across
from the "all" group.

Add the AnchorFree network policy to the authentication system.
Click the checkbox next to the AnchorFree ("AFGL") network policy. Click "Update
Policies" to do just that.
Select a captive portal.

Click "Captive Portals" from the "CONFIG" menu. Click on the name of a captive portal
you want to apply the AnchorFree-enabled guest authentication system to.

Add the AnchorFree-enabled guest authentication system to the captive portal.
Click on the checkbox next to the AnchorFree-enabled guest authentication system, and
click "Update".

Add a paid authentication system to the captive portal.
Click on the checkbox next to a paid authentication system, and click "Update". When
there are more than one authentication systems applied to a captive portal they display
to the user in order applied. In this example, the free advertising-supported
authentication system will appear first, as the default choice.

User experience: choosing free Wi-Fi with advertising.
The user can choose free, advertising-supported Wi-Fi by clicking "Log In".

User experience: choosing paid Wi-Fi.
If the user does not want to see ads, they can choose "Paid Wi-Fi", enter their account
information, or sign up for a new account.

SputnikNet Network Policies

Overview of Network Policies
How to apply network policies to authentication systems, captive portals, and Sputnik-powered devices to create walled gardens, block unwanted sites, apply content
filtering, and enable port forwarding.
Four basic network policies.

SputnikNet provides four basic network policies:
- Allow/Accept: enable traffic to defined network destinations, often used for walled gardens
- Deny/Reject: disable traffic to defined network destinations, used to block unwanted sites
- Destination NAT: re-routes specified network traffic to a different network destination, used for content filtering
- Port Forward: (sometimes referred to as tunneling) forwards a network port from one network node to another, often used to
allow an external user to reach a port on a private IP address (inside a LAN) from the outside, for example to access a
web-based control panel on a device on a private network

Creating walled gardens with allow/accept rules.
Walled garden policies (based on allow rules) are an example of policies that applied to
captive portals, which are then applied to Sputnik-powered devices. Walled garden
policies take effect before a user authenticates.
Blocking private nets with deny/reject rules.

Block private network policies (based on deny rules) are an example of policies that are
applied to authentication systems, which are then applied to captive portals, and then to
Sputnik-powered devices. Block private network policies take effect after a user
authenticates.

Content filtering with destination NAT rules.
Content filtering policies (based on destination NAT rules) are an example of policies
that are applied to authentication systems, which are then applied to captive portals, and
then to Sputnik-powered devices. Content filtering policies take effect after a user
authenticates.
Accessing a private network device from outside via port forwarding rules.
To access a webcam's built-in control panel from outside of the private network it is on,
for example, apply port forwarding policies to an authentication system; then apply the
authentication system directly to the local Sputnik-powered device that the webcam
connects through as an override.

Here's another way to look at how network policies ultimately apply to authenticated
users:
- One or more policies are applied to user groups.

- Groups are part of authentication systems, which by default have an "all" group. The
user authentication system alone can have multiple groups.
- Authentication systems are applied to captive portals.
- Captive portals are applied to Sputnik-powered devices.
- A user connects to a Sputnik-powered device through a captive portal using an
authentication system that assigns them to one or more groups with defined network
policies. (Yes, it reminds us of the "House that Jack Built".)
The authentication system and captive portal "links" can be skipped, as noted above. But
generally, this chain of relationships applies in SputnikNet.

Policy order.
In general it is a good idea to limit the number of network policies; things can quickly
become unmanageably complex. The above example is for illustrative purposes only.
Also, except in cases like walled gardens and port forwarding, we recommend that you
apply policies at the highest level of abstraction - i.e. at the authentication system level.
Here is the order in which network policies are applied to a user.
- Device override policies (inherited from a Sputnik-powered device/router) are applied

before captive portal and before authentication
- Captive portal walled garden rules apply before authentication
- Authentication rules apply after a user logs in
Generally, policies are applied in the order they are added to the device, captive portal,
or authentication system. To establish this sequence, click on the checkbox next to the
first policy, click "Update", then repeat for additional policies in order. The built-in "Block
Private Nets" policy is always applied last.
Authentication system policies are applied in this order:
- First, the "all" group policies

- Then network policies in order applied to the group, but
- "Block Private Nets" is always applied last.
In the special case of the user authentication system, policies are applied to users who
are members of multiple groups in this order:
- First, the "all" group policies in order applied to the group,

- Then additional groups and their network policies in order applied, but
- "Block Private Nets" is always applied last.

Applying Network Policies to an Authentication System
How to apply network policies to all users of an authentication system after they log in.

Every authentication system in SputnikNet can include network policies. To add network policies to an authentication system, click
on "Authentication" under the "CONFIG" menu.
Select group policies.

Select an existing authentication system or create a new one. Then click on "Group
Policies" from the "Authentication System" menu.

Every authentication system has at least one group, called "all", which every
authenticated user joins by default. User authentication systems are different: they can
include additional groups. For more information about multiple group policies see the
online documentation chapter titled "Applying Network Policies to Groups within a User
To apply authentication system-wide network policies, click on "[Edit]" across from "all" in
the group list.
Select the network policies that you want to apply to that authentication system.
Click the checkbox next to the name of the network policy(ies) you want to apply to all
authenticated users. Click "Update Policies" to save your settings. To view more
information or edit the settings of any network policy on the list, click on its name.
If applying more than one network policy, select them, one at a time, in the order you
want them applied, and click "Update" after each selection.

You will see a list of network policies in the order they will be applied to the all group.
Click on "[Edit]" to make any further changes to the all group, or on the name of a
network policy if you want to view more information or modify it.

Applying Network Policies to Groups within a User Authentication System
How to apply network policies to multiple user groups within the user authentication system.
Log into SputnikNet, then navigate to the user authentication system overview.
SputnikNet's user authentication system is unique in that it can include multiple groups, each with its own set of network policies.
Authenticated users can be assigned to specific groups, and inherit group-specific policies when they log in.
To set up groups and apply network polices to them, log into SputnikNet and click on "Users" from the Authentication menu.

Select a user authentication system.
Select an existing user authentication system by clicking on its name, or create a new
one by clicking on "Add New Authentication System".
Select groups.
Click on "Groups" from the "Authentication System" menu.

Add a new group.
Click on "Add New Group" to create the first group.
Edit group information.

Give the group a name and description, and click "Add Group" to save.

Add multiple groups.
Continue to add groups using the steps described above.
NOTE: if a user is a member of multiple groups, policies are applied in group order,
which is defined by when they are created. In other words, the first group to be created
will apply its network policies first.
Select group policies.

Select "Group Policies" from the "Authentication System" menu.
Edit a group's network policies.

Note that in addition to the groups we created, an "all" group is created by default. This
group contains all users and can be used for authentication system-wide network
policies.
Click on "[Edit]" under "Network Policies" for the "all" group. These are policies that apply
to all authenticated users.

Select the network policies that you want to apply to all groups.
Click on the checkbox next to the "Content filtering" policy. Then click "Update Policies".
All users who log in will be subject to content filtering.
Select the network policies that you want to apply to a specific group.
Repeat the process for other groups. Here, we apply the "Block Finance Server" policy
(presumably a deny/reject rule) to the Club Employees group.

Select the network policies that you want to apply to additional groups.
Continue to define policies for various groups. Here, we apply "Block Private Nets" and
"Guest Printer Access" to the Club Members group.
NOTE: if you want to control the order that policies apply, select them sequentially, one
by one, and click "Update Policies" after each new policy. In this case, we would want
"Guest Printer Access" to apply first in order to allow connections to the local printer
before the "Block Private Nets" rule restricts local network access. However, there is one
exception: the standard "Block Private Nets" rule defined in SputnikNet is always applied
last. Therefore, in this specific example, we would click both network policies and then
click "Update Policies" once.

You will see a list of network policies in the order they will be applied for each group.
Click on "[Edit]" to make any further changes to the group, or on the name of a network
policy if you want to view more information or modify it.
As noted, if a user is a member of more than one group, policies are applied to them first
in group order, then in network policy order. In this example, "Club Member" users would
have policies applied to them in the following order: 1. Content filtering (because they
are a member of "all"), 2. Guest Printer Access, 3. Block Private Nets.

Blocking Private Networks
How to use the built-in "Block Private Nets" policy as a security measure that prevents users from accessing private network resources, while freely browsing the
internet.
View default network policies.

Log into SputnikNet, then click on "Network Policies" from the "CONFIG" menu.

Select "Block Private Nets".
"Block Private Nets" is a default policy that is included in all authentication systems. Click
on its name to view detailed policy settings.
Review "Block Private Nets" policies.

As a default, "Block Private Nets" policy settings cannot be edited. The policy prevents
users from connecting to devices (such as computers, servers, printers) in any
non-routed local network, as shown, while enabling them to reach "outside" (internet)
addresses.

To apply "Block Private Nets" to an authentication system, click on "Authentication" from
the "CONFIG" menu, and then click on the authentication system's name.

Click on "Group Policies" from the "Authentication System" menu. Click on "[Edit]" for the
group you want to modify.

Select "Block Private Nets".
Click on the checkbox next to "Block Private Nets", then click "Update Policies" to apply
it to the group.
Review group policies.

"Block Private Nets" is now an active policy for clients in the "all" group. That is,
everyone who logs in using the authentication system will be blocked from using private
network resources.
To enable some users to access private network resources while blocking others, create
multiple groups (user authentication system only) and apply "Block Private Nets"
selectively. For more information about this, see the online documentation chapter titled
"Applying Network Policies to Groups within a User Authentication System".
Alternatively, create multiple authentication systems and apply "Block Private Nets"
selectively. For example, you could use device authentication for employees, while
applying "Block Private Nets" only to users who log in using a guest authentication
system.

"Block Private Nets" policies are included in authentication systems, which are applied to
captive portals, then to routers.
To do this, click on "Captive Portals" from the "CONFIG" menu, select a captive portal,
then click "Walled Garden and Authentication" from the "Captive Portal Properties"
menu. Click the checkbox next to the authentication system(s) you want to apply and
click "Update".
Apply captive portals to Sputnik-powered devices.

Click on "Routers" from the "CONFIG" menu, select a Sputnik-powered device ("router"),
and choose the captive portal from the "Portal" pop-up menu. Click "Save Settings".
Scroll down to the bottom of the "Edit Settings" page. Under "Network Policies" you will
see a list of policies that apply to users of that Sputnik-powered device (router).

In this example, users log into the Sputnik-powered device named "Convention Main"
through the "Platinum Sponsor" captive portal, which applies the "Convention Center
Guests" authentication system, which in turn inherits the "Block Private Nets" policy for
all authenticated users. Therefore, once users log in, they are blocked from using private
network resources but can browse the internet freely. (Of course, they were blocked
from all network resources before logging in.)

Walled Gardens with Allow/Accept Policies
How to create walled garden policies, which enable users to browse to specified websites before they log in.
Log into SputnikNet, then navigate to network policies overview.

To create a walled garden policy, click on "Network Policies" from the "CONFIG" menu.

Click on "Define New Network Policy" from the Network Policies menu.
Configure a walled garden policy.

Fill out the following fields to create a walled garden policy:
- Name: name your policy

- Action: select "Allow/Accept"
- Protocol: select "TCP"
- Match destination hostname: enter the domain name of the site you want to allow
access to before authentication
- Is Dynamic: check the box if the IP address of the site is subject to change, and select
an expiration interval
- Match Destination IP or Network/Netmask: as an alternative to a destination hostname,
you can provide the IP address
- TCP or UDP Port: enter "80" (for web traffic)
Click "Add Policy" to save your settings.

Review your walled garden policy.
Your new walled garden policy will appear in the network policy list.
Apply your walled garden policy to captive portals; apply your captive portals to a Sputnik-powered devices.
Select "Captive Portals" from the "CONFIG" menu, then click on the name of the captive
portal you want to edit. Click on "Walled Garden and Authentication" from the "Captive
Portal Properties" menu. Click the checkbox next to the name of the walled garden
policy you want to apply. Click "Update" to save your settings.
Click on "Routers" from the "CONFIG" menu, click on the name of the Sputnik-powered
device ("router") that you want to apply the captive portal to, then select the captive
portal from the "Portal" pop-up list. Click "Save Settings" to do just that.

Users can visit your walled garden before they authenticate.
Users can view your walled garden before they authenticate - for example your menu of
the day. This is also a way to insert dynamic content from another site, such as a
sponsor promotion, into the captive portal page.

In this example, users log into the Sputnik-powered device named "Gourmet Store E50"
through the "Gourmet Selections" captive portal, which applies the "Gourmet Selections
Walled Garden" policy to all authenticated users.

Content Filtering with Destination NAT Policies
How to create content filtering policies using destination NAT (network address translation), which proxy user traffic through an external "net nanny" server for safe
browsing.

To create a new content filtering/destination NAT policy, click on "Network Policies" from the "CONFIG" menu.

Configure a content filtering policy.

Fill out the following fields to create a content filtering policy:

- Action: select "Destination NAT"
- Protocol: select "Any"
- Match destination hostname: leave blank
- Is dynamic: leave blank
- Match Destination IP or Network/Netmask: leave blank
- TCP or UDP Port: enter 80 (for web traffic)
- Redirect to IP: enter the IP address of the proxy server that you will redirect traffic
through
- Redirect to Port: enter the port of the proxy server that you will redirect traffic through

Review your content filtering policy.
Your new content filtering policy will appear in the network policy list.

Click on "Authentication" from the "CONFIG" menu, then select the authentication
system you want to apply the policy to.

Edit the "all" group.
Click on "Group Policies" from the "Authentication System" menu. Click on "[Edit]" for the
group you want to apply the policy to. In this case, "all" will apply the policy to all
authenticated users.
Add the content filtering policy to the "all" group.

Click the checkbox next to the name of the content filtering policy just created, and click
"Update Policies" to save your changes.

Your content filtering policy will appear in the group policies list.

Click on "Captive Portals" from the "CONFIG" menu, then click on the name of the
captive portal you want to apply the authentication system to.
Click "Walled Garden and Authentication" from the "Captive Portal Properties" menu.
Click the checkbox next to the name of the authentication system containing the content
filtering policy.
Click "Update" to save settings.


In this example, users log into the Sputnik-powered device named "Gourmet Store 41"
through the "Gourmet Selections" captive portal, which uses the "Gourmet Select
Customers" authentication system, which in turn inherits the "Safe Browsing" policy for
all authenticated users. Once users log in, they are content filtered when they browse
the web.

Port Forwarding
How to create port forwarding policies that enable "outside" internet access to devices (e.g. security webcams, flat-screen display media controllers, local servers,
printers, etc.) on private Sputnik-powered local area networks (LANs).

For this example, we'll create two port forwarding policies in order to remotely manage two security webcams located on a private
Sputnik-powered local area network (LAN), enabling access to the devices' local web control panels over the internet.
To create the first port forwarding policy, click on "Network Policies" from the "CONFIG" menu.

Add a new port forwarding network policy.
Configure the port forwarding policy.

Here is an example policy to access the built-in web interface of a security camera. Fill
out the following fields to create the policy:

- Action: select "Port Forward"
If redirecting a single port (as in this example):

- TCP or UDP Port: enter "8080"
- Redirect to Port: enter "80"
If redirecting a port range, which will redirect the range from the Sputnik-powered device
to the same range on the client device:
- Starting Port: enter starting port number
- Ending Port: enter ending port number

Review the port forwarding policy.
The new port forwarding policy will appear in the network policy list.

Click on "Authentication" from the "CONFIG" menu, then select the authentication
system you want to apply the policy to, or create a new one. NOTE: for port forwarding,
you need to use a device authentication system, as the "client" will be a device on the
private Sputnik-powered network.

Add the webcam's MAC address to the first device authentication system.
Click on "Devices" from the "Authentication System" page. Enter the MAC address of the
first security webcam. The webcam will automatically authenticate via its MAC address
using the "Camera 1 - NE" authentication system, and be subject to network policies
applied to that authentication system. Next, we'll apply the port forwarding policy we set
up earlier to the "Camera 1 - NE" authentication system.
Edit the "all" group.

Click on "Group Policies" from the "Authentication System" menu, then click on "[Edit]".

Add the port forwarding policy to the device authentication system's "all" group.
Click the checkbox next to the name of the port forwarding policy just created, and click
"Update Policies" to save your changes.

Your port forwarding policy will appear in the "all" group policies list for the "Camera 1 -
NE" authentication system.

Add a second port forwarding network policy.
Configure the port forwarding policy.

Fill out the fields as before, with a new name, and a different TCP or UDP port. Here
we've entered port "8081" (vs. "8080" for the first port forwarding policy). It is important
that the port numbers are different, as each will be forwarded to port 80 on a different
device.

Review the port forwarding policy.
The new port forwarding policy will appear in the network policy list.
Apply the second port forwarding policy to a different device authentication system.
Follow the above instructions to apply the second port forwarding policy to a second
device authentication system. In this example, "Camera 2 - SW" would include the MAC
address of the second security webcam.

Review port forwarding policies.
Each port forwarding policy is now assigned to a device authentication system.
Select the Sputnik-powered device you want to apply the port forwarding policies to.
Click "Routers" from the "CONFIG" menu. Select the Sputnik-powered device (router)
that provides network access to the security webcams.

Apply the device authentication overrides to the Sputnik-powered device.
Click on "Policy and Authentication Overrides" from the "Edit Settings for Active Router"
page. Scroll down, and click the checkboxes next to the names of the device
authentication systems created previously. Click "Save Overrides" to apply settings.
Review the Sputnik-powered device's network policies.

Click "Edit Settings" from the "Edit Settings for Active Router" page. Scroll down, and
view the policies applied to the Sputnik-powered device.
In this example, the "Camera 1 - NE" device authentication system applies "Security
Camera 1" port forwarding policies; the "Camera 2 - SW" device authentication system
applies "Security Camera 2" port forwarding policies. Based on the policies, port 8080
will forward to port 80 (web traffic) on security camera 1; port 8081 will forward to port 80
on security camera 2. Thus you can access these devices' web-based control panels
from anywhere on the internet.

This diagram illustrates how port forwarding works for the first security webcam in the
example. The port forwarding policy "Security Camera 1" applies to "all" clients of the
"Camera 1 - NE" authentication system, which is applied directly to the local
Sputnik-powered device (router) called "Gourmet Store 41". Based on the port
forwarding policy, traffic going through port 8080 on the Sputnik-powered device will be
forwarded to port 80 on the security camera, enabling access to its web-based interface
from anywhere on the internet.

Port forwarding to devices in multiple locations.
A different scenario: if you have a single device, for example a flat-screen display media
controller, that is installed in many locations across your network, it is easy to apply
standard port forwarding policies to all of them.
First, create the port forwarding policy as described above, then apply it to a device
authentication system. Enter the MAC addresses of all of the media controller devices into
the device authentication system, and apply the authentication system to the
Sputnik-powered devices in the field. Whenever you add a new flat-screen display, simply
add its controller's MAC address into the device authentication system, and apply the
authentication system to the local Sputnik-powered device.

Blocking Specific Sites with Deny/Reject Policies
How to use deny/reject network policies to block access to specific, restricted sites.

For this example, we'll create a couple of deny/reject policies in order to block access to specific sites.
To create the network policy, click on "Network Policies" from the "CONFIG" menu.

Add a new deny/reject network policy.
Configure the deny/reject policy.

Here is an example policy to deny access to the website of a competitor across the
street:

- Action: select "Deny/Reject"
- Match destination hostname: enter the domain name of the site you want to reject
access to
- Is Dynamic: check the box if the IP address of the site is subject to change, and select
an expiration interval
- Match Destination IP or Network/Netmask: as an alternative to a destination hostname,
you can provide the IP address
- TCP or UDP Port: enter "80" (for web traffic)

Review the deny/reject policy.
The new deny/reject policy will appear in the network policy list.
Entering a deny/reject policy by IP address.

If you know the static IP address of the site you want to block, you can enter it in the
"Match Destination IP or Network/Netmask" field, as shown. In this case, leave the
"Match Destination Hostname" field blank.

Select an authentication system's group policies.
Click on "Authentication" from the "CONFIG" menu. Select the authentication system
you want to apply the policies to.
Select "Group Policies" from the "Authentication System" page. Click on "[Edit]" to
modify the authentication system's group policies.
Add the deny/reject policies to the authentication system.

Click the checkboxes next to the names of the deny/reject network policies created
above. (In this example there are existing "Block Private Nets" and "Safe Browsing"
policies.)
Click "Update Policies" to save your new settings.

Click on "Network Policies" from the "CONFIG" menu. You can see that they have been
applied to the "all" clients group of the previously selected authentication system.

Click on "Captive Portals" from the "CONFIG" menu, then click on the name of the
captive portal you want to apply the authentication system to.
Click "Walled Garden and Authentication" from the "Captive Portal Properties" menu.
Click the checkbox next to the name of the authentication system containing the content
filtering policy.
Click "Update" to save settings.


In this example, users log into the Sputnik-powered device named "Gourmet Store 65"
through the "Gourmet Selections" captive portal, which uses the "Gourmet Select
Customers" authentication system, which in turn inherits the "Block Mr. Cheese" policy
for all authenticated users.
User experience: attempting to browse to a blocked site.

If the user attempts to visit a blocked site their browser will display an error message.

SputnikNet Reports

Standard Reports
How to generate usage reports and charts by Sputnik-powered device, client, or session, and how to archive old data.
Navigate to the Client Summary report.

Click on "Client Summary" from the "REPORTS" menu.
Client summary report - session time.

The Client Summary report shows recent client sessions across your entire
Sputnik-powered network, rolled up by client login ID. If using a username-based
authentication system (such as user or PayPal authentication with automatic login
disabled), client logins will show the username. If using a device or guest authentication
system, client logins will show as MAC addresses.
You can quickly identify how many client sessions occurred on your Sputnik-powered
network, the longest, shortest, average and total session time. Data is sorted by logout
time, most recent first. NOTE: the Client Summary report only reports completed
sessions, and does not include active sessions. If you want to see active session
information, you can view the Client Sessions report.
Settings are:
- Granularity: enables you to view data by hour, day (default), week, or month

- Login search: enables you to filter the results by login ID; searches are case sensitive;
use the % symbol as a wild-card character
- Display limit: you can view 10 (default), 25, 50 or all records
- Include bandwidth: select if you want to see session bandwidth usage information
instead of session time information
Click "Execute" to refresh the display. Click "Next >" or "< Previous" to scroll through
results. Click on a "Client Login" to see session history for that client.
Client summary report - bandwidth use.

To view a summary of client bandwidth use, click the checkbox next to "Include
Bandwidth?" and then click "Execute".
You can quickly identify how much bandwidth was used across your Sputnik-powered
network, and view total bandwidth sent and received summarized by client login ID, by
whatever time interval you choose.
Click on a client login ID to view a session history for that client.

Session History report.
The Session History report shows individual active and inactive sessions for the client
login ID, listed in reverse chronological order based on logout time. If a session is active,
you can terminate it by clicking on its checkbox and clicking "Terminate Selected".
You can drill into other reports by clicking on:
- Authentication System (1): shows technical information about the authentication system
used (generally not needed except for debugging)
- Active Sessions on/Router (2): shows usage graphs for that Sputnik-powered device
("router")
- Client (3): shows detailed information and usage graphs for that specific client session
First, we'll click on the active client session record to drill into more detailed information.

Client Session report.
The Client Session report shows detailed session information and bandwidth plots. If a
session is active, you can terminate it or reset it by clicking on the "Terminate" or "Reset"
buttons, respectively. (Resetting a session updates its policies, and is rarely if ever needed.)
The first bandwidth plot shows traffic in the last hour, or if the session is less than an hour
long, all traffic since the session began. The second bandwidth plot can be set to display all
traffic (default), the last hour, 30 minutes, 15 minutes, or 5 minutes. Select the appropriate
time interval from the "Zoom" pop-up menu and click "Submit" to refresh the display.
You can drill into other reports by clicking on:
- Session on Router (1): shows usage graphs for that Sputnik-powered device ("router")
- Authenticated Client Login (2): returns to the Session History report (above)
We'll click on the name of the Sputnik-powered device (1) to get more information about its
usage.

Sputnik-powered device bandwidth and session graphs.
You can view average bandwidth and number of sessions for the selected
Sputnik-powered device on your network. To change the report interval, click on the
"Zoom to" popup menu and choose: all (default), last 5 minutes, 15 minutes, 30 minutes,
hour, day, 3 days, week, month, 90 days (shown), or year, then click "Submit" to refresh
the display.
Authentication System Overview report.

As noted, clicking on the Authentication System name in the Session History report
shows technical information about the authentication system that is generally not used. It
is included here for completeness.

Navigate to the Access Summary report.
Click on "Access Summary" under the "REPORTS" menu.
Access Summary report.

The Access Summary report is analogous to the Client Summary report, but instead of
rolling up by client login ID, the data is summarized by Sputnik-powered device
("AP/Router").
The Access Summary report shows the number of sessions, longest, shortest, average
and total session length on each Sputnik-powered device.
Settings are:
- Granularity: enables you to view data by hour, day (default), week, or month
- Router search: enables you to filter the results by the name of the Sputnik-powered
device: searches are case sensitive; use the % symbol as a wild-card character
- Display limit: you can view 10 (default), 25, 50 or all records
Click "Execute" to refresh the display. Click "Next >" or "< Previous" to scroll through
results. Click on the name of a Sputnik-powered device to see bandwidth and session
graphs for that device (see the prior step titled "Sputnik-powered device bandwidth and
session graphs").

Navigate to the Client Sessions report.
Click on "Client Sessions" from the "REPORTS" menu.
Client Sessions report.

The Client Sessions report shows recent individual client sessions across your entire
Sputnik-powered network, sorted by login time, most recent first. If using a
username-based authentication system (such as user or PayPal authentication with
automatic login disabled), client logins will show the username. If using a device or guest
authentication system, client logins will show as MAC addresses.
Under "Show Fields" you can toggle the display of:

- Session Detected: time at which the client session was first detected, possibly before
authentication
- Logout time: time when the logout occurred
- Logout reason: can be terminated by user, admin, or idle timeout
- Duration: length of the session
- MAC: the client's MAC address
- Usage: bandwidth sent and received
- Type: client operating system (if available)
- Display Name: client username
Additional settings are:
- Session State: can display all, active, completed sessions, or sessions pending

authentication
- Display limit: you can view 10 (default), 25, or 50 records
- Router search: enables you to filter the results by the name of the Sputnik-powered
device; searches are case sensitive; use the % symbol as a wild-card character
- Login search: enables you to filter the results by the client's login ID; searches are case
sensitive; use the % symbol as a wild-card character
Click "Search for Sessions" to refresh the display.
If a session is active, you can terminate it by clicking on its checkbox and clicking
"Terminate Selected".
Click "Next >" or "< Previous" to scroll through results.
Finally, you can view other reports, as follows:
- Click on a "Router" name (1) to see bandwidth and session graphs for that
Sputnik-powered device (see the prior step titled "Sputnik-powered device bandwidth
and session graphs")
- Click on a "Client" (2) or "Display Name" (3) field to see detailed session information
(see the prior step titled "Client Session report")

Navigate to Session Archive.
Click "Session Archive" from the "REPORTS" menu.

Session Archive.
The Session Archive keeps records of past client sessions as CSV (comma separated
values). These files can be opened in a spreadsheet application, such as Microsoft
Excel. To download a session archive for a specific date, click on the date.

Session archive file.
A CSV file containing that day's session data will download to your computer.
Review the session archive data.

Open the session archive file in a spreadsheet to review the data.

Modifying the session archive period.
You can change the session archive period, which is the amount of time SputnikNet
keeps session data before it is archived (archive files are kept as long as the Account is
active).
To do this, click on "Control Center" from the "CONFIG" menu, and scroll down the page
to "Session Archive Period". Options range from "do not archive session data" to one to
twelve months in one-month increments.
NOTE: to improve SputnikNet performance, we recommend a shorter archive time if you

have a very active network.

Ad Hoc Reports
How to set up and use ad hoc report queries.
Requesting an ad hoc report query.

Do you need to run a report that isn't included in standard SputnikNet reports? Sputnik
can add one ore more customized "ad hoc" reports to your SputnikNet Account.
Typically, this requires that you purchase a Professional Support Incident from our online
store.
To get started, click on "Ad Hoc" from the "REPORTS" menu, then click "Sputnik
Support".

Fill out a support request.
Complete the support request:
- Company name: your company

- Email address: your email address
- Subject: enter "new custom report" or something similar
- Your SputnikNet FQDN: enter the fully qualified domain name of your SputnikNet
Account, or just the Account name, as shown
- Support Issue: select "SputnikNet"
- Case Type: select "Add new ad hoc report request"
You can enter the SQL commands you want to use, or if you don't know them, describe
the report you want to generate. Please indicate whether you want to generate the report
from SputnikNet only, or whether you also want reports to be emailed to you periodically.
We will notify you if a Professional Support Incident is required. If so, purchase the
incident from our online store.
You will receive an email when the query has been added to your SputnikNet Account.
Select your ad hoc report.

To run your ad hoc report, select its name from the popup menu.

Run your ad hoc report.
The SQL commands required to run your report will appear in the "SQL" field.
Click "Execute" to run the report.
Viewing and exporting your report results.

Your report will run, and results will display in your browser. Select the "Display Limit"
popup menu to show 10 (default), 25, 50, or all records, then click "Execute" to refresh
the display.
To export the data to your computer, click the checkbox next to "Export?" and click
"Execute".

Export data file.
Data is exported as a CSV (comma-separated value) file, which can be opened by any spreadsheet application, such as Microsoft
Excel.

Troubleshooting

Sputnik Agent Error Messages
How to troubleshoot Sputnik Agent error messages.
The goal: "Running normally - Managed."

Log into the local DD-WRT web interface on the Sputnik-Powered device. By default,
login at http://192.168.180.1 with username root, password admin. Those values can be
changed (and for security purposes, its important to change the password).
Select "Status/Sputnik Agent".
"State" should show "Running normally - Managed". If it does, you're up and running. If
not, review the error messages below.

"Waiting for route availability".
Check WAN port connectivity. You're not connected to the Internet. The WAN IP
address, shown in the upper right hand side of the screen, will show 0:0:0:0.
"Unable to resolve Jabber server IP address".

Check DNS (domain name services) settings. If your device connects via DHCP, the
upstream DHCP server isn't providing valid DNS server IP addresses. If it connects via
static IP, configure valid DNS server IP addresses.

Modifying your device's DNS settings.
To access your device's DNS settings in the DD-WRT web interface, select "Setup/Basic
Setup" and look under "WAN Setup" at the top of the page.
"Auth. sent, awaiting reply"

Make sure your upstream firewall isn't blocking high-numbered ports. Port forwarding is
not required.

How to check to be sure your AP is able to communicate with SputnikNet.
The AP initially connects with SputnikNet over port 5222. This port must be open,
outbound, and almost always is. The AP and SputnikNet then choose a random,
high-numbered port for ongoing communications. These are sometimes blocked by
upstream firewalls.
To test that communications between an AP and SputnikNet are working, open a

terminal from a PC connected to the Internet through the AP or through the same WAN
connection that the AP is using.
At the prompt, type:
telnet wifi.sputnik.com 5222
You should see a response similar to:
Trying 206.223.158.30
Connected to wifi.sputnik.com
Escape character is '^]'.
If you do not see this, then you need to open high-numbered ports on the upstream
firewall.

Extend DHCP Lease Range to Enable More Client Connections
If your customers' browsers show a "page cannot be displayed message" when they connect to your hotspot, the reason may be that you are out of DHCP leases.
Here's how you can increase the number of DHCP leases available to your customers.
Standard DD-WRT DHCP lease settings

Log into the local DD-WRT web interface on the Sputnik-Powered device. By default, login at
http://192.168.180.1 with username root, password admin. Those values can be changed (and
for security purposes, its important to change the password); in this example, the network is at
10.0.1.1.
Select "Setup/Basic Setup".
DD-WRT is factory set to allow 50 DHCP leases with 24-hour expiration. This is not enough for
a typical hotspot.

Recommended DD-WRT DHCP lease settings
Change "Start IP Address" to 10, change "Maximum DHCP Users" to 240, and "Client Lease
Time" to 300 minutes (5 hours). These values are approximate.
NOTE: do not allow DHCP lease addresses outside the range of 2-254. (Here the start
address is 10, and 240 addresses are allowed. That means the highest possible value is 250,
which is in range.) If you do, you may need to reset the device to restore functionality.
Click "Save" to apply and save your new settings. For good measure, reboot the router after
saving settings to make sure they are applied.

Sputnik Docs

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sputnik Docs

Uploaded by

Copyright:

Available Formats

Sputnik Documentation

Complete Sputnik step-by-step documentation.

1.1 Sputnik Overview 9

2 Sputnik Agent Firmware

2.1 Using Sputnik-Powered DD-WRT Firmware 28

3.1 Sputnik 720: Quick Start Guide 66

4 Deploying Sputnik-Powered Devices

5.1 Getting Started with SputnikNet Express 145

6 SputnikNet: Getting Started

6.1 Creating a new SputnikNet Account 172

7 Subscribing Sputnik-Powered Devices to your SputnikNet Account

7.1 Adding Sputnik-Powered Device Subscriptions to your SputnikNet Account 201

8 Device Management with SputnikNet

9 Branding Networks with SputnikNet

9.1 Branding your Wi-Fi Network with Captive Portals 248

10 SputnikNet Authentication Basics

10.1 Creating a new Authentication System 294

11 Guest Authentication with SputnikNet

11.1 Guest vs. PrePaid Authentication 299

12 Prepaid Authentication with Time and Bandwidth Limits

12.1 Creating and Managing Prepaid Cards in SputnikNet 354

13 Billing for Wi-Fi Access with Time and Bandwidth Limits

13.1 Charging for Access: Authentication System Options 399

14 Authenticating Users with SputnikNet

14.1 Users, Groups, and Network Policies 484

15 Authenticating Devices with SputnikNet

15.1 Authenticating Devices without Web Browsers 502

16 RADIUS Authentication with SputnikNet

16.1 Setting up RADIUS Authentication 515

17 Advertising with SputnikNet (Beta)

17.1 Enabling Advertising for your SputnikNet Account 526

18 SputnikNet Network Policies

18.1 Overview of Network Policies 556

19.1 Standard Reports 607

20.1 Sputnik Agent Error Messages 624

Sputnik Documentation - 8 © 2008 Sputnik, Inc.

What is Sputnik? Wi-Fi as a web service.

Sputnik Documentation - 9 © 2008 Sputnik, Inc.

Sputnik Documentation - 10 © 2008 Sputnik, Inc.

Sputnik Documentation - 11 © 2008 Sputnik, Inc.

Sputnik Documentation - 12 © 2008 Sputnik, Inc.

Sputnik Documentation - 13 © 2008 Sputnik, Inc.

Sputnik Documentation - 14 © 2008 Sputnik, Inc.

Sputnik Documentation - 15 © 2008 Sputnik, Inc.

Sign up for a SputnikNet Account.

Sputnik Documentation - 16 © 2008 Sputnik, Inc.

Sputnik Documentation - 17 © 2008 Sputnik, Inc.

Sputnik Documentation - 18 © 2008 Sputnik, Inc.

Sputnik Documentation - 19 © 2008 Sputnik, Inc.

Sputnik Documentation - 20 © 2008 Sputnik, Inc.

Sputnik Documentation - 21 © 2008 Sputnik, Inc.

Sputnik Documentation - 22 © 2008 Sputnik, Inc.

SputnikNet account levels.

- SputnikNet Express, our free service for single-venue, basic hotspots

Sputnik Agent Subscriptions.

There are three levels of Sputnik Agent subscriptions:

- Sputnik Agent NMS - is free, and only enables device-management features in

Sputnik Documentation - 23 © 2008 Sputnik, Inc.

- Sputnik Agent Pro - is for "carrier-class" access points/routers, capable of

Sputnik Documentation - 24 © 2008 Sputnik, Inc.

Sputnik Documentation - 25 © 2008 Sputnik, Inc.

This example shows a total of:

- 2 devices running Sputnik Agent Standard

The total annual subscription fee would therefore be $898.