Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at setting up some kind of visitor wireless access for our company however our internet connections all run through a external proxy.

After many wasted hours explaining to visitors how to enter the proxy settings before they can connect to the web I feel it is time to look at a solution which is a bit more simple from the end user point of view.

My initial idea was that I could just buy a WAP which allows me to select the proxy server but in reality this seems to be quite a rare or expensive option (I have had previous experience using a ZyAIR G-4100 for something similar but this was quite unreliable)

From a bit of research the most popular answer seems to be to setting up a transparent proxy using a Ubuntu box running Squid between the modem and the switch.

Does this sound like the most sensible idea or am I overcomplicating things?

Edit Forgot to mention that my other problem is that i am locked out of the router too so am unable to play about with creating separate subnets that bypass the proxy.

share|improve this question
Do you visitors need to use a proxy (yours or a new Squid) or do you care? Do they need to access company LAN resources (printers, etc.)? – gravyface Aug 11 '10 at 13:58
The users do currently need to put in proxy settings in order to connect out. This is an externally managed proxy which I have no control over. – Chuffzilla Aug 11 '10 at 14:06

I'm entirely sure I understand your layout, but if you just want to give your visitors Internet access (and don't care if they use a proxy at all), why not just add another leg to your edge firewall/router (assuming it can do that) and bridge the wi-fi router onto that leg and route/filter accordingly?

                 Edge firewall/router: drop src dst
[ eth0 LAN: | eth1 Guest:, running DHCP for this network]
    |                         |      
    |                         |      
    |                         |      
 {your LAN}               [wi-fi bridged router (plugged into switch ports, not WAN;DHCP     
share|improve this answer
This would normally be something I would go for but I am also locked out of the router (Cisco 1841) our internet connection is provided by an external company who annoyingly do not understand my issue and are also not prepared to give me access to the router so I am essentially treating this as a black box. – Chuffzilla Aug 11 '10 at 14:20
ok, you should edit your question and add this to it; you'll get more responses. – gravyface Aug 11 '10 at 15:13
many thanks, have done – Chuffzilla Aug 12 '10 at 12:41

You might take a look at SmoothWall, Endian and other similar "threat management" systems which are basically full fledged nix'based firewalls with integrated transparent proxies (mainly web & email).

share|improve this answer

If you don't care if visitors go through the proxy, all you have to do is add an exception to the rule that blocks port 80 traffic. Create a VLAN for the guest network, and allow traffic from that IP range to use port 80 on the inside interface of your firewall. (or outside if you blocked it there)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.