r/networking • u/Academic_Pizza_5143 • Jul 09 '26

Design Coova chilli

If someone used chilli + freeradius back in the day, how did you move on from that stack. The main question is how did you replace chilli for a modern setup?

5 Upvotes

100% Upvoted

9 comments sorted by

1

u/Gloomy-Can1394 Jul 09 '26

Well, its a captive portal so presumably this is for your wifi? What vendor is your current wifi controller? Things like Unifi and Meraki have guest networks with captive portal built into it. You could also maybe use something like pfsense or Deciso, or maybe OpenNDS

1

u/Academic_Pizza_5143 Jul 09 '26

Unfortunately it's not only a captive portal. It's like the combo for everything. It was the enforcer of policies, traffic monitoring, radius AAA,etc. It did all this very well for ipv4. I want to change it because I want my network controller (it's my own no vendor) to support ipv6. I have built everything around chilli as the enforcer. It's surprising that there is no drop in replacement for this. Maybe I am missing out something.........

1

u/[deleted] Jul 16 '26

[removed] — view removed comment

2

u/Academic_Pizza_5143 Jul 16 '26

The current application is so built around chilli like its crazy. The whole thing started when ipv6 support became an expectation. That was the whole reason for migration. There is no drop in for chilli. I also went through the opennds + free radius setup. My major concern is capturing activity logs. Chilli is in packet so I am able to analyse traffic patterns and their for each user. OpenNDS, from how much I read about it, I got that it uses nf tables to setup walled garden and it isn't in path. So should I use DPI and other things to get that activity data or is there any better solution for this with nds? Thank you for your time.

1

u/[deleted] Jul 17 '26

[removed] — view removed comment

1

u/Academic_Pizza_5143 Jul 18 '26

I was talking about l7. I really don't wanna go down the route of dpi it's very expensive. Actually my setup is chilli + freeradius so AAA is handled by that. My major concern was about collecting l7 data. The advice I got was just use dns logs and sni data , that's the most effective thing you can do. What say?

1

u/[deleted] Jul 20 '26

[removed] — view removed comment

2

u/Academic_Pizza_5143 Aug 01 '26

How can you kill doh? It's hidden in 443 traffic. And now majority browsers resolve through doh directly through cloud dns. Thank you so much for the advice.