RaspAP/raspap-webgui
Raspap Webgui
This project is a wireless hotspot management interface for Debian devices. It provides a web-based controller for managing wireless access points, wireless repeaters, VPN gateways, and DNS ad-blocking filters.
The system includes a captive portal framework to intercept network traffic via customizable splash pages and a VPN controller that supports WireGuard and OpenVPN with kill-switch functionality. It further differentiates itself with a DNS ad-blocking filter using curated blacklists and the ability to operate in multiple network modes, including bridged access point and wireless repeater.
The capability surface extends to network monitoring and diagnostics, including real-time bandwidth tracking and packet capture. It covers network access control through MAC filtering and role-based authentication, as well as general network management for DHCP, mobile data configuration, and dynamic DNS.
The application stack is delivered via a containerized deployment model and supports bootstrapping through environment variables.
Features
- Hotspot Configuration - Provides a web interface for configuring wireless access points, routed and bridged modes, and network hardware.
- Wireless Networking Tools - Provides a comprehensive web interface for configuring wireless SSIDs, passphrases, and radio modes.
- Captive Portal Implementations - Implements a functional captive portal that redirects unauthenticated network traffic to a custom splash page.
- Wireless Repeaters - Allows the device to function as a wireless repeater to extend the reach of an existing network.
- Multi-Protocol VPN Gateways - Establishes and routes traffic through WireGuard and OpenVPN tunnels with integrated kill-switch support.
- Wireless Network Mode Toggles - Provides a toggle to switch the device between bridged access point, wireless repeater, and micro-AP modes.
- DNS Sinkhole Ad Blockers - Provides network-wide ad and tracker blocking by intercepting DNS queries.
- Firewall-Enforced Routing - Uses kernel-level firewall rules to route wireless client traffic through VPN tunnels or bridge interfaces.
- Network Interface Management - Provides comprehensive management of physical network interfaces to serve as data connectivity sources.
- Hotspot VPN Routing - Directs all traffic from wireless clients through a secure VPN tunnel.
- WireGuard Management - Provides a dedicated web interface for configuring WireGuard VPN tunnels and peer keypairs.
- VPN Tunnels - Allows users to establish secure tunnels by uploading configuration files or defining cryptographic keys.
- Wireless Access Point Management - Supports modern wireless encryption standards including WPA3-Personal and Protected Management Frames.
- Manual DNS Blocklist Entries - Allows adding manual IP and hostname entries to block individual sites via DNS.
- MAC Address Access Control - Controls network entry using allowlists or blocklists based on hardware MAC addresses.
- Plugin Development Frameworks - Provides a development framework for creating and integrating modular extensions to system capabilities.
- Custom Logic Extensions - Supports integrating custom plugins to extend the system with new navigation items and server-side logic.
- Containerized Application Deployments - Deploys the application stack in an isolated container environment to ensure portability and dependency separation.
- Containerized Application Runtimes - Runs the entire management stack within an isolated container for portable deployment and dependency separation.
- Wireless Setup Access Points - Enables rapid deployment of wireless access points using validated default configurations for initial setup.
- Captive Portal Visual Customizations - Enables full branding and visual customization of captive portal splash pages via HTML and CSS editing.
- Cellular Data Configurations - Configures SIM PINs and Access Point Names (APNs) to establish mobile data connectivity.
- VPN - Provides a web interface to connect, disconnect, and select server locations for various VPN providers.
- Connection Profiles - Provides the ability to store and switch between multiple VPN profiles and credentials.
- Exit Node Traffic Routing - Configures the device as a VPN exit node to route traffic for other network members.
- Network Diagnostics - Tests connectivity and performance using tools like ping and traceroute to identify network failures.
- Network Routing and Traffic Management - Directs data packets between wireless local area networks to manage internal traffic flow.
- Packet Capture Implementations - Records real-time network packets and provides tools to list, download, and delete capture files.
- Peer-to-Peer Tunneling - Establishes encrypted peer-to-peer connections between devices to create a private network.
- Wireless Bridges - Supports bridged mode to connect wireless clients directly to an upstream router, eliminating double-NAT.
- VPN Kill Switches - Implements a kill switch that blocks all outbound traffic if the VPN connection is lost to prevent IP leaks.
- Concurrent Client-AP Modes - Enables the device to operate simultaneously as a wireless access point and a client station for traffic bridging.
- Client Isolation - Implements wireless client isolation to prevent connected devices from communicating directly with each other.
- Wireless-to-Ethernet Bridging - Shares an internet connection from a wireless LAN interface with clients connected via Ethernet.
- RAM-Based Filesystems - Redirects logs and temporary data to memory to minimize physical disk wear on embedded devices.
- Device Connectivity Restrictions - Implements a whitelist of static clients to prevent unauthorized devices from joining the wireless network.
- Curated Blocklist Collections - Manages the updating and aggregation of curated domain blocklists from open-source sources.
- Network Access Control - Provides network-level access control to filter traffic and manage service access for unauthenticated portal users.
- User Role Authentication - Manages user authentication and assigns roles such as admin or user to restrict access to system settings.
- Plugin-Based Extensibility - Features a modular architecture allowing the addition of new navigation items and server-side logic via plugins.
- Client Connection Tracking - Tracks authenticated users by IP and MAC address, monitoring connection duration and data usage.
- Real-Time Bandwidth Monitors - Tracks real-time data throughput on network interfaces to visualize current bandwidth usage.
- Peer Status Monitoring - Displays a summary of authorized VPN devices, including their IP addresses and connection states.
- Firewall Rule Configurations - Administers system-level firewall rules to control inbound and outbound network traffic.
- Network Traffic Analysis - Captures and inspects packets via Wireshark to troubleshoot connectivity issues and monitor data flow.
