christian/church-translate
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 11 Wiki Activity

Document opening Waters Guest WiFi at North Attleboro to translate

Browse Source 
The guest network blocks private ranges twice: a zone default on the
gateway, and the guest hotspot's Post-Authorization Restrictions, which
the access points enforce on their own. With only a firewall allow, a
phone on Waters Guest worked for about two minutes and then timed out.

docs/examples/waters-church-na/ gains the three scripts used to fix it:
zone-allow-policy.py (allow Hotspot -> 10.1.1.4 on 80/443),
guest-restrictions.py (drop 10.0.0.0/8 from the restriction list via
the legacy guest_access setting, since system policies cannot be edited
through the Integration API) and wifi-broadcast-devices.py (put the
Waters Guest SSID on the Auditorium, Main Lobby and Offices APs). The
runbook gets a section on all three, and PUBLIC-ACCESS.md points at it
from the troubleshooting notes.

Confirmed on site: translate.watersmedia.org loads on Waters Guest and
stays up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
michael
2026-10-15 16:15:46 -04:00
co-authored by Claude Opus 5.5
parent 81da657094
commit 825a25b626
5 changed files with 484 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PUBLIC-ACCESS.md
+12 -4
View File
@@ -153,7 +153,15 @@ curl -si -N -H 'Connection: Upgrade' -H 'Upgrade: websocket' \
Then open the page on a phone: for the LAN-only setup on the guest WiFi, for a
published one **with WiFi turned off**. That is the real test. If the page loads
but captions never appear, the WebSocket headers are missing. If phones on
guest WiFi cannot connect at all, look at client isolation on that network
before anything else. `/operator` returning 404 through the proxy is by design;
staff use `http://10.1.7.39:3100/operator` on the LAN.
but captions never appear, the WebSocket headers are missing. `/operator`
returning 404 through the proxy is by design; staff use
`http://10.1.7.39:3100/operator` on the LAN.
**Guest WiFi on UniFi.** Guest networks block every private range by default,
so the proxy is unreachable from them until two things change: a firewall
policy that allows the guest zone to reach the proxy on 80/443, and the
proxy's range removed from the guest hotspot's *Post-Authorization
Restrictions*. The second one is easy to miss: the access points enforce that
list themselves, so with only the firewall policy a phone works for a minute or
two and then times out. North Attleboro's fix, with scripts, is in
[`examples/waters-church-na/`](examples/waters-church-na/README.md) section 3.