HotSpot Software

Seems like dd-wrt (w/chillispot, for example), Apache, and FreeRADIUS are one way to get started. Did you google "dd-wrt hotspot setup"?

Yes I saw ChilliSpot but didnt like the way it operated. I need the AP in router NAT mode, its in AP mode and connected to a LAN port. Its way up on the roof and dont fancy climbing up to move the ports and run another cable to the LAN side to manage it.

I was looking at WiFiDog too, but that project doesnt seem to have got off the ground.

I have a Windows box already on 24/7 with IIS on it, this could be used if required.

No recommendations. You supply any details such as number of users, approximate load, authorization method, authentication, open/closed, billing, reports, traffic monitoring, abuse detection, bozo ejection, etc. There's no such thing as universal hot spot software. It may not be hot spot software that's best. You supplied some of what you have to work with. In order to offer something specific, one needs to know what you're attempting to accomplish.

It is on the NAT side of the wireless router. You don't need to do anything on the WAN side. Keep your existing router. Setup the DD-WRT router with ChilliSpot as if it were an access point. Nothing connected to the WAN(internet) port. Disabled DHCP. Static IP address outside the NAT range, such as 192.168.1.2 with a DHCP range of 192.168.1.100-150.

Running the hotspot from the AP has the advantage of NOT requiring a server running 24x7. At 15 cents per kw-hr, an 80 watt server will burn: 80w * 24hr/day * 365days/yr * $0.15/hw-hr * 0.001 kw/watt = $100/year The typical AP draws about 8 watts and will therefore cost only $10/year to operate.

Instead of a full featured hot spot (with billing, reports, etc), you could use your unspecified version of Windoze for a RADIUS server. Instead of WPA-PSK encryption, use WPA-RADIUS. That way, you can assign individual logins and passwords to every user. It's also safer in that there is no single common shared WPA encryption key. Each user gets a unique, one time, key delivered by the access point.

and search Google for "windows wireless radius server".