The Active Portal a set of services that run on the gateway machine that sits between the wireless access point. The access point may be external, such as an Apple Airport Base Station, or internal, such as a Linux Box with 802.11 card. Each Active Portal may serve one or many wireless access points. The Active Portal provides network identification, user acceptance of an AUP, reverse intrusion detection, traffic shaping, and logging functions.
Optional parts are a caching DNS server, and web proxy caching.
Use the method outlined in Squid for transparent port 80 interception. Snort or other IDS monitors all outbound Wireless Traffic for Abuse. Abuse includes spam, hacking, and DoS attacks. Sends notification to UFT to disallow IP address after abuse. All client web requests after abuse is detected are redirected to web page notifying why access has been turned off and who to contact.