Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a simple small business windows network with very basic internal security. We are a small college and want to provide access to the internet to your student body, but not to the internal network. We only have one outgoing broadband connection. Currently we achieve this by configuring the routers (currently 3) that all student PCs and Wireless network connect to so that they only have access to the outgoing broadband and no internal access.

This works fine, but is a little bit cumbersome and means in certain areas of the college even if you are staff you can only get access externally.

I have heard about packetfence which would allow us to set up rules for every device that connects to the network, removing the need for different subnets. However I have very little (virtually none) experience with linux, and even less with a machine with two network cards in it.

What I would like to be able to do is.

  • Put CentOS or other on an old PC and add a second network card.
  • Install PacketFence.
  • Make a simple config change to all the routers we have (maybe 10 - 15);
  • Start doling out access rights to devices on the network.

Is this possible? Am I being ridiculously simplistic?

If its possible, does someone know of a really good simple tutorial to do all the setup?

If not is there an alternative (I would consider a reasonable cost solution, but not huge cost).


Further Detail Requested.

I dont have a network diagram, and I'm not a network engineer, but I'll try my best.

  • We have lots of computers, routers and switches connected together all on Subnet
  • 1 Single outbound internet router on this subnet (254)
  • 3 routers connected to this main network but only providing access to their clients to the outbound router (254) they provide dhcp to their clients wired and wireless (mainly wireless) on

I don't mind putting another machine into the network specifically to run packetfence, or buying a couple of new routers if needed.

share|improve this question
Can you add a little more detail about how your network is set up? A diagram would help. – Per von Zweigbergk Dec 4 '11 at 21:02
There's still not enough information to answer your question correctly. These "routers", do they do NAT, or are you using some kind of static routing? How do these "routers" prevent access to the internal network? Are there multiple subnets all numbered 192.168.123.xx, or is it just one subnet, and if so, what provided DHCP and gatewaying for that subnet? What kind of switches do you have, do they support VLANs and 802.1x? – Per von Zweigbergk Dec 4 '11 at 21:33

You should use Untangle (practicaly no linux experience is needed). And use OpenVPN module to access to the internal network(from all over the world). You can use it for free.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.