Wired LAN + Wireless Hot spot

[Bob S.]

Should be easy enough to fail miserably on doing this configuration
considering all the "Whoa is me" posts I've read here on this subject.

Well, the small business owner I help out with his network has 8 WinXP Home
boxes on a LinkSys switch and cable router with an additional 8 port LinkSys
switch connected in for growth. We just did a fork-lift upgrade on his
entire system and the network is working fine. Now he wants me to add a
wireless connection so customers sitting in the lounge can use their laptops
to connect to the internet. His business is on the outskirts of town so we
don't expect a lot of wireless traffic and the area of coverage is only
about a 30' diameter circle we need to cover.

Now with XP Home, I know we don't have all the security controls like on XP
Pro, but this should be "do-able". I have the network configured using
manually assigned TCP/IP addressing to each workstation. And although I
haven't tried it yet, the LinkSys documentation states I can have DHCP also
at the same time so guests could use the internet.

That's all well and good and although I don't know how to do that yet, I'll
figure it out. What I need some help on is, can I configure a wireless
connection so that his workstations are "reasonably" secure from any
wireless guests? Short of adding another cable modem dedicated to wireless,
I should be able to configure a port on the LinkSys cable router/switch that
only allows specific ports for the internet, email and ftp - and exclude
everything else. That port would be connected to the wireless transceiver.

Would that lock them out from gaining access to his network?

This is not Fort Knox we're trying to protect but yes - we do not want a
guest or any other wireless drive-by gaining access to his network.

Where do I start looking for what I need to do ?

Thank you,

Bob S.

 

[Richard G. Harper]

If I were in your shoes, I'd get an authentic router (not the el-cheap-o
wireless router but a real router - think Cisco et.al.) and set up two
networks. On one side of the router would be one private IP address range
for your internal network clients, on the other side of the router you would
put the wireless access point on an entirely different IP address range.

The router would take the incoming ISP internet feed and allow both sides
access to it, but not allow access from the internal side to the external
side and vice-versa.

In theory you can take the el-cheap-o wireless router and configure it in
this manner but in reality you would have only casual security separating
the two sides of the network. Any determined hacker who found a
vulnerability in the wireless router would own both sides of the network.

You may also want to consider a firewall between the internal and external
networks. There are several nifty and free Linux firewalls that will run on
the most decrepit computer on your network (think original Pentium or
Pentium II processor) and provide nearly perfect isolation between the two
networks.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm