docs: port hotspot retention, setup command, DHCP ranges and geoblocking docs

Backport content from upstream commits that landed on main and the
nethsecurity-8.8 branch after this repo's Sphinx-to-Docusaurus migration
diverged, so the new docs stay in sync with upstream additions.

Assisted-by: Claude Code:claude-sonnet-5

Author: gsanchietti

docs/administrator-manual/about/release_notes.md

@@ -23,6 +23,8 @@ Image version: `8.8.0-beta1` (based on OpenWrt 25.12.4)
 - Added Avahi (mDNS) package to the NethSecurity reposistory.
 - Added the firewall `DON\'T TRACK` action.
 - Several features previously limited to subscription-based versions are now available in the Community edition.
+- Added Geoblocking feature to Threat Shield IP, allowing users to block traffic from specific countries or regions.
+- Added support for multiple DHCP ranges directly in the UI, allowing for more flexible IP address allocation.
 
 **Improvements**
 

docs/administrator-manual/installation/install.mdx

@@ -73,6 +73,8 @@ You can use the downloaded image as a virtual machine disk:
 
 If you wish to save the logs locally, it is recommended to attach an additional virtual hard drive to the virtual machine and select it as the destination for logs in the `Storage` page under the `System` section.
 
+If you are deploying a remote virtual machine on a cloud provider, you can also complete the network configuration over the virtual monitor with the [`setup` command](./remote_access.md#setup-command-section) as a quick start. This is often the fastest way to configure the keyboard layout and network interfaces before opening the web user interface.
+
 :::
 
 ### Install on Proxmox

docs/administrator-manual/installation/remote_access.md

@@ -180,30 +180,39 @@ From a Linux machine, use the following command: :
 ssh root@192.168.1.1
 ```
 
-## VGA console and keyboard layout
+## Using the setup command {#setup-command-section}
 
-If the machine has a VGA/DVI/HDMI video port, connect a monitor to it. Then, you will be able to log in to the console using the default credentials above.
+If the machine has a VGA/DVI/HDMI video port, connect a monitor to it. You can then use the `setup` command from the console to perform the first configuration steps.
 
-Please note that the system is configured with the US keyboard layout.
+Use `setup` when the web user interface is not yet reachable, or when you are working from VGA, serial console, or SSH on a new firewall.
 
-To temporarily change the current keyboard layout to Italian, log in to the system and then execute the following command: :
+Run the tool as `root`:
 
 ``` bash
-loadkmap < /usr/share/keymaps/it.map.bin
+setup
 ```
 
-The keyboard layout configuration can be saved by writing the keymap code inside `/etc/keymap`. Example for `it` (Italian) keymap: :
+The interactive menu lets you:
 
-``` bash
-echo 'it' > /etc/keymap
-grep -q /etc/keymap /etc/sysupgrade.conf || echo /etc/keymap >> /etc/sysupgrade.conf
-```
+- configure the keyboard layout
+- configure the LAN and WAN interfaces
 
-To obtain the list of available keymaps, execute the following command: :
+### Keyboard layout
 
-``` bash
-ls -1 /usr/share/keymaps/ | cut -d'.' -f1
-```
+The system starts with the US keyboard layout. In the `setup` menu, choose the `keymap` item to switch between the available layouts. The tool currently supports `us` and `it` keymaps.
+
+The selected keymap is applied immediately and saved automatically, so it remains active after reboot. It's also preserved inside the backup to be restored in case of system recovery or upgrade.
+
+### Network settings
+
+The `setup` tool allows you to configure the following network settings:
+
+- LAN interface: DHCP or static IP address with netmask in CIDR notation
+- WAN interface: DHCP or static IP address with netmask in CIDR notation and gateway
+
+After making changes, the network configuration must be applied with the `Apply network changes` button in the network section.
+
+If you are using a non-US keyboard layout, you can change it in the setup tool before entering the network configuration. This is important because the network configuration requires typing IP addresses and other information that may be affected by the keyboard layout.
 
 ## Serial console
 

docs/administrator-manual/network/dns_dhcp.md

@@ -36,6 +36,8 @@ Available fields:
   - `Range IP end` : last IP address of DHCP range
   - `Lease time` : lease time (default 1 hour)
 
+  Each DHCP server can serve more than one address range: under `IP ranges` you can specify multiple distinct IP ranges for the same interface, each one defined by its own `Range IP start` and `Range IP end`. Click **Add IP range** to define an additional range, or use the trash icon next to a range to remove it. At least one range must be specified, while the others are optional. Each range must belong to the interface network class, and the `Range IP end` must be higher than the `Range IP start`. Ranges are allowed to overlap.
+
 **DHCP Advanced settings**
 
 `Force DHCP server start`

docs/administrator-manual/network/hotspot.md

@@ -120,3 +120,79 @@ uci delete dedalo.config.dns2
 ```
 
 Then repeat the steps 2 and 3 in the previous section to apply the changes.
+
+## Data retention for Hotspot service with NethSpot cloud portal
+
+:::note
+
+NethSpot cloud portal users only
+
+This section applies only to NethSecurity firewalls with a valid subscription that are specifically using the NethSpot cloud portal, available at <https://my.nethspot.com/>. If the Hotspot service is used without the NethSpot cloud portal, the information in this section does not apply.
+
+:::
+
+NethSpot stores hotspot-related data on cloud infrastructure located in a European data center in the Netherlands. The retained data includes connection logs, guest login data, voucher information, email-based access data, and SMS-based access data.
+
+### Connection logs
+
+Connection logs are retained for **6 months**.
+
+These logs include information related to guest sessions, such as:
+
+- connection and disconnection date and time
+- guest user
+- guest device
+- device MAC address
+- NethSecurity unit MAC address
+
+Connection logs are the first data to be deleted. When the retention period expires, the related guest sessions are deleted, including the `device_mac` of the guest device and the `unit_mac` of the connected NethSecurity appliance.
+
+:::note
+
+NethSpot does not collect or store the browsing activity of Hotspot users. Visited websites, URLs, DNS queries, or other navigation details are neither collected nor retained by the NethSpot cloud portal. The retained information is limited to session data required to identify the guest access session.
+
+:::
+
+### Guest login data and vouchers
+
+Guest login data is retained for the whole validity period of the guest account and for the following **24 months**. This additional retention period allows expired guest accounts to be reactivated, for example by extending their validity from the portal, without having to recreate them. It also helps preserve the association between the guest identity and the previously issued voucher, so that operators can review or extend an existing access record when needed.
+
+This includes data related to platform users, vouchers, email login, and SMS login. When vouchers are used, all the information entered in the voucher is retained, including the data used to identify the guest.
+
+For voucher-based access, retained data may include:
+
+- guest first name and last name, if entered in the voucher
+- guest email address, if entered in the voucher
+- voucher data
+- MAC address of the device used by the guest
+
+The guest name is required when creating a voucher because it is used to identify the association between the guest and the voucher.
+
+### Voucher validity and account expiration
+
+Vouchers can be created in two ways:
+
+- with a fixed expiration date
+- with a duration, counted from the first activation
+
+Before the first use, a voucher is inactive. When the voucher is used for the first time, it is associated with the guest using it. From that moment, the voucher and the guest account refer to the same access identity.
+
+Administrative hotspot users are not related to guest vouchers.
+
+The additional 24-month retention period starts from the voucher expiration date.
+
+For example, if a voucher expires on **June 30, 2026** and the guest starts using it before that date, the guest account associated with that voucher expires on **June 30, 2026**. The 24-month retention period starts from that date.
+
+This retention period allows the account to be reactivated later, for example by extending its validity from the portal, without deleting the guest data too early.
+
+### Contract or service termination
+
+If the contract or service is terminated, guest data is deleted according to the same retention periods described above.
+
+### Marketing consent
+
+NethSpot can be configured to ask WiFi guests for marketing consent through the captive portal. The marketing consent is collected exclusively for the organization using the hotspot, it is **not used by Nethesis** for its own marketing purposes.
+
+The guest panel clearly shows which guests have given marketing consent: this allows exporting only the contacts that have explicitly provided consent.
+
+Nethesis does not use collected guest contacts for marketing activities and does not sell or transfer this data to third parties.

docs/administrator-manual/security/threat_shield_ip.md

@@ -85,6 +85,38 @@ To access and customize the blocklist, navigate to the `Local blocklist` tab in
 
 When adding addresses to the local blocklist, ensure you enter them correctly to avoid accidentally blocking legitimate traffic. It\'s also a good practice to include a descriptive comment for each entry to help with future management and auditing of your blocklist.
 
+## Geoblocking {#geoblocking-section}
+
+The `Geoblocking` tab allows you to block network traffic based on the geographic origin of the IP addresses, relying on country-based IP feeds. This is useful to keep out traffic coming from countries you never expect to interact with.
+
+The feature is disabled by default. To enable it, open the `Geoblocking` tab and turn on the `Geo IP Blocking` switch. Threat Shield IP must be enabled for geoblocking to work.
+
+Countries are organized into regions (Africa, Americas, Asia, Europe, Oceania and Others), each shown as a card reporting the number of currently blocked countries. Selecting a region displays the list of its countries, where you can:
+
+- block or allow individual countries using their checkbox;
+- use the **Block all** and **Allow all** buttons to act on the whole region at once;
+- filter the list by country name or by status (blocked / not blocked).
+
+Click **Save** to apply the configuration.
+
+:::warning
+
+Avoid blocking the regions where your own users are located, otherwise legitimate traffic may be dropped.
+
+:::
+
+### Blocking direction
+
+By default, geoblocking only blocks **incoming** connections, i.e. traffic initiated from the selected countries towards your firewall and networks. Outgoing connections (traffic initiated by your local clients towards hosts in the selected countries) are still allowed.
+
+If you also want to block **outgoing** connections to the selected countries, add the `country` feed to the `ban_blockforwardlan` property, which applies the feed to the LAN-forward chain. From the command line:
+
+```bash
+uci add_list banip.global.ban_blockforwardlan='country'
+uci commit banip
+/etc/init.d/banip restart
+```
+
 ## Block brute force attacks {#brute_force-section}
 
 When Threat Shield IP is enabled, the system automatically starts checking for brute force attack attempts on firewall services. By default, the monitored services include SSH access and the login to NethSecurity UI. The system detects login attempts and automatically blocks IPs that have failed to enter the correct credentials.