3

I need some advice about encrypt all traffic on a small private network running wi-fi and LAN traffic on 192.168.0.x network. The network would comprise of client laptops connecting to the wi-fi router (192.168.0.254) via ethernet connection or wireless. The main purpose of the server is for the client laptops to talk to two servers on different IP's (192.168.0.200 and 192.168.0.201) on ports 80 and 433.

My main concern is having packet sniffers and what not getting access to the data.

The only ways I see at the moment is to have VPN running on the network or use IPSec policy's to do this.

Any other ways guys?

2
  • Force everything onto HTTPS.
    – womble
    Mar 20, 2012 at 9:53
  • 1
    If you meant port 443 in your question then that will already be encrypted. As womble said, the only thing you should do on port 80 is send an HTTP 301 response directing the user at the SSL version of the same resource. If you actually meant port 433, please do let us know as that one is not used for an encrypted protocol.
    – Ladadadada
    Mar 20, 2012 at 10:02

4 Answers 4

3

The only ways I see at the moment is to have VPN running on the network or use IPSec policy's to do this.

IPSEC is the network layer encryption designed specifically to cover this case (among others).

If you do not want to mess with it because of the complexity and cannot use HTTPS throughout for some reason, you might consider relying on your network equipment's isolation features. WPA2-enterprise encrypts client-to-AP traffic and is not susceptible to man-in-the-middle attacks due to a secret shared among all users as WPA-PSK would be. Managed switches allow either for locking down the MAC forwarding database or using authenticated connections (802.1x) with a MAC address lockdown so MAC spoofing attacks allowing authenticated users to sniff on other user's data would be mitigated. This would not protect your users from a direct tap on layer 1 though (e.g. a hub or a wiretap device installed somewhere between the switch port and the user's laptop ethernet jack).

2

VPN connections would be a good option. The problem with Tim Coker's answer will be that anything that uses UDP won't be encrypted. So DNS requests would still be visible. VPN/IPsec does not have that problem.

Also, if you use RADIUS , your users will be authenticated on the network. The only sniffers would be the people you allow on the network yourself and still very limited.

If udp isn't a concern than just force everything onto HTTPS.

1

If your only concern is protecting the web traffic, it's a much simpler set up to not use standard http (port 80) and force everything through https (port 443) via a redirect on the web server.

1

I've done something similar to secure syslog messages, using IPSec in transport mode. The IP header remains the same, but the packet payload is encrypted.

I used racoon with pre-shared keys to do it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .