0

I need to setup a guest wireless network at the office for visitors to connect to. What are your recommendations in terms of how to secure it without putting too much of a support burden on myself?

I'd prefer to keep it an open access point, so I don't have to support users who can't figure out how to input the password correctly. However, if I don't, should I use WPA or WPA2? Will I have compatibility issues at all if I use WPA2?

What is the best way to isolate the users from the network itself. I guess the most foolproof way is to just put that access points(s) on its own DSL connection. What are my other options?

How do most of you secure your guest wireless networks?

4 Answers 4

4

The recommended way for doing this is to use a DMZ configuration. You can maintain an open wireless connection to allow guests to easily connect to it. However, there are a few things that you will want to control.

  1. Place your wifi connection in the dmz zone and treat its connections as potentially hostile. This means configuring your firewall to block incoming connections to your local network and allowing only certain connections through to the internet (e.g. http/https).
  2. Place the wifi devices on a different subnet and network range than your local network. This will force the computers to route packets through your firewall device. Ensure that the wireless network is physically disconnected from the local network.

  3. (Optional) Implement some sort of radius authentication, maybe using chilispot or something similar. This will allow you some sort of authentication. You can use this to better control the use of your wifi. Guests may be given a username/password login for use during their stay.

Hope this gives you some ideas.

5
  • I agree with this for the most part, but I don't think that it needs to be physically disconnected. Especially if the users are on wireless, VLANs (at least as implemented on Cisco hardware) should be more than adequate. Put the AP in its own VLAN, with just your router/firewall also on the VLAN. Make sure the AP is in a different (non-routable) subnet from the rest of yur network. Setup the router/firewall to allow traffic between the AP and the Internet (probably you should lock it down to HTTP/HTTPS and whatever else is needed), but block everything else, especially your internal network. Oct 22, 2009 at 13:49
  • Another item for this list: If you host your email behind at the same address as your DMZ, make sure that you block SMTP traffic on your wireless network, or you will get added to all of the RBL lists in short order if a wireless client is infected with a virus or part of a botnet that is sending SPAM. Ask me how I know... :-) Oct 22, 2009 at 14:24
  • That is "behind your firewall" Oct 22, 2009 at 14:24
  • Jason, Are VLANs secure enough though? sans.org/resources/idfaq/vlan.php
    – Brett G
    Oct 22, 2009 at 15:19
  • Scott, been there before. We block SMTP traffic out our firewall by default and only allow the exchange servers to use SMTP.
    – Brett G
    Oct 22, 2009 at 15:20
1

Generally, you can just set up an AP and hook it up to your internet connection.

Things to consider:

  • Make really, really sure the AP is not in any way connected to your internal network (unless you really know what you are doing). You don't want to expose your LAN to any passersby.
  • If you use encryption, you reduce your attack surface because it makes it somewhat less likely for random people to use your AP. This is not really a security measure (any key you use will be fairly public), but prevents annoyances like bandwith hogging by strangers.
  • You should do a basic check for legal issues: Does your ISP allow this kind of sharing (some forbid it in their contracts)? Are you legally liable for computer crimes commited via the AP (not in most jurisdictions, but that may vary).

I'd prefer to keep it an open access point, so I don't have to support users who can't figure out how to input the password correctly. However, if I don't, should I use WPA or WPA2? Will I have compatibility issues at all if I use WPA2?

As pointed out, encryption avoids some annoyances, but I don't think it's really critical. If you do use it, WPA2 would probably be ok. WPA has been required for the Wi-Fi Alliance's certification since 2003, and WPA2 since 2006, so recent devices should do WPA2.

What is the best way to isolate the users from the network itself. I guess the most foolproof way is to just put that access points(s) on its own DSL connection. What are my other options?

No need for a separate DSL connection, really. You should at any rate have some kind of router/firewall between your DSL connection and your LAN. Just hook the AP directly to your DSL, bypassing the firewall. Or put it into your DMZ (if you have one), or even better, into its own DMZ.

1

sybreon has a good answer, bumped...

I originally setup our office wireless using chillispot auth'ing against freeradius using an old how-to that allowed you to create tokens that would time out. It worked reasonably well and wasn't too much of a hassle to administer. The OP doesn't give a good indication of budget or capability, but our current solution, using Cisco WLC and ACS allows a couple of really cool features:

  1. auth against our AD
  2. NAC-like VLAN allocation based on both user and machine group
  3. separate lobby admin account that you can hand off to the help desk so they can create temporary accounts with a set lifetime
0

You can set up MAC address filtering and add the visitors MAC when they are coming and removing the end of the day, this is if you don't want to have encryption. You can also setup a screen where the user must state his email address before he is able to go further.

If you have to setup wpa then use wpa2+aes due to the fact wpa+tkip is vulnerable. http://www.wi-fiplanet.com/news/article.php/3784251

See an interesting article in this topic: http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html

4
  • 1
    MAC filtering is both less secure and more hassle to set up than using encryption (every computer needs to be registered, vs. just handing out the key), so what's the point?
    – sleske
    Oct 22, 2009 at 9:32
  • Also not that the vulnerability of WPA+TKIP is (as of now) mostly theoretical. It is of course a warning sign.
    – sleske
    Oct 22, 2009 at 9:32
  • I didn't say that mac filtering is the best solution, but oneof the possible solutions to limit access.
    – Istvan
    Oct 22, 2009 at 10:30
  • It is so easy to sniff and spoof a mac address on an unencrypted network though....
    – Brett G
    Oct 23, 2009 at 7:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .