Is it possible to add a WiFi HotSpot to an already established LAN, keep the two separate, and not modify the primary router?

Question

I have a set up where my Cisco ASA is sitting in one facility, providing access to the Internet for two buildings. The two buildings are geographically separated by a Wireless Bridge spanning about 10 miles. All computers and equipment inside the LAN are on the same subnet (its pretty small) and we have WiFi AP's in both locations providing Wired and Wireless access to the LAN.

Given all the BYOD (Ipods, and SmartPhones etc...) coming into the office as well as Visiting reps etc... we would like to also provide a non-secure, device independent (the devices cannot see or communicate with each other), and LAN independent (the devices cannot see or use anything on the LAN) HotSpot that anyone could use for their Devices that gives them access to the Internet ONLY without needing a password. I get that this could be possible at the facility with my Cisco if I messed with it and created VLANs etc... but then I would need to get it across my Bridge as well and don't think that would be possible without serious reconfiguration of everything. Would really like some kind of magic drop in solution that can kind of piggy back on my LAN without really needing to do very many if any changes to the current set up.

Answer 1

Most routers already support a 'guest' wifi network that is isolated both from the main network and also isolated connected clients from each other.

Certainly a higher end router designed for commercial use will have this ability.

You could 'double NAT' by installing a second wifi router with its upstream port connected to your company network in the location where your guests need wifi access. Configured correctly that provides a high degree of isolation between guests and your company network.

Answer 2

Yes, you can add a hotspot access point to an established LAN without any changes to the existing network.

You can probably get away with just an access control list and manual routes on the wireless access points. All you really need to do is set up rules so packets can only make it through you gateway and out to the internet. Yes vlans are the most secure option but there are ways to not use them if your hardware does not support them or you don't have the expertise to set them up. Also it sounds like your network is small enough that you don't really need vlans. You can set this up in a fairly plug and play manner if that is what you want.

Some general points when setting up the AP's

• Use a different subnet than the rest of your network for the public wireless. It doesn't really matter because it will most likely be NAT'd anyways but it will make things less confusing.

• The AP itself can communicate with the gateway on the same subnet. Make sure it can only communicate with the gateway with an ACL on the Ethernet interface.

• turn on client isolation on the AP's so wireless clients can't communicate with each other.

• use ACL's to control traffic between your public and private networks. Block everything not going strait out to the internet. Also block anything not coming strait from the internet on the LAN side.

• use manual routes to send traffic directly to the internet gateway. Depending on the layout of your network of course.

Answer 3

You might be able to try setting up the wireless access point to use a VPN within the office and route all connections over the VPN. This should produce a similar result to setting up a VLAN but might be easier to configure. Not exactly a traditional use of VPN, (keeping in, instead of out) but I think it would do what you need. I would, however, think that VLAN would be the better way to go about it.

Answer 4

Going with VLAN's would be best practice in my opinion. I don't know the specifics of your network but with only one subnet, adding VLAN's and setting up a few ports on your switch (provided you have a managed switch that supports VLAN) to use that VLAN, it is not an invasive procedure. The only other way i can think of without the details of your network, is adding a subnet on your router, directly routing that traffic to ie a second wan port. The VPN would also be a valid option, but you would have an access point that is capable of handling a VPN.

Answer 5

Thanks everyone for your inputs! Here is what I ended up doing, please let me know if any of you notice anything off or out of the ordinary:

Please let me know if you guys notice anything that is just plain wrong or out of the ordinary:

Got a WRT54GL V1.1 and reset it to its default settings (30-30-30). Following are the steps I took to get mine going with DD-WRT.

This WRT54GL has 5 ports on the rear once called Internet and four others numbered 1, 2, 3, & 4. Connect the Internet Port to a cable that is connected to your existing LAN, and connect a cable from your Desktop/Laptop to port 1 of the WRT54GL. Power everything up and let the Desktop/Laptop get its IP Address from the WRT54GL.

Web Browse to 192.168.1.1 from the Desktop/Laptop.

You should be prompted to set your username and password - do so now.

Log into the router.

Click Setup TAB Wan Connection Type Change to Static IP (Set this to an available Address on your LAN) 192.168.2.56 255.255.255.0 192.168.2.253 208.67.222.222 208.67.220.220 STP Disable Click Save then Apply

Optional Settings Router Name: openWIFI Host Name: openWIFI Domain Name: “your domain name” rest default Click Save then Apply

Network Setup Local Address: 10.0.0.1 (this subnet should be different than yours) Subnet Mask: 255.255.255.0 Gateway: 0.0.0.0 Local DNS: 0.0.0.0 Click Save then Apply

Unplug your computer from the Router (network cable) and wait for a few seconds, then plug it back in. This will allow for your computer to change to the subnet you just configured above so you can continue with the setup.

Open your Web Browser back up and browse to the address you just set, for this document it would be 10.0.0.1.

Log back in.

SetUp TAB Network Address Server Settings DHCP DHCP Type: DHCP Server DHCP Server: Enable Start: 10.0.0.100 Max: 20 (I keep this low as I can) Rest Defaults Click Save then Apply

WireLess TAB Wireless SSID: openWIFI rest Default Click Save then Apply

Advanced Settings (Under Wireless TAB) AP Isolation: Enable rest default Click Save then Apply

Services TAB SSHd Enable rest Default Click Save then Apply

Administration TAB Management Enable SSH Management rest Default Click Save then Apply Click Reboot Router

Right now, you should have an operational openWIFI access point, but it is NOT secure by any means. Anyone with any networking sense could get into your private LAN as well as the Internet. So we need to lock it down some.

Log back into the Web Interface Administration TAB Commands Place the following in the commands window (this is the meat and potato):

iptables -I FORWARD -d 192.168.2.0/24 -j DROP iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr) iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr) iptables -I FORWARD -p tcp -s 10.0.0.0/24 -m connlimit --connlimit-above 50 -j DROP iptables -I FORWARD -p ! tcp -s 10.0.0.0/24 -m connlimit --connlimit-above 25 -j DROP

What these do (or so I read from the awesome fellows at http://cavewall.jaguardesignstudio.com) where I found these commands are as follows:

Line 1 - Blocks access from the router to the private Subnet Line 2 & 3 - Blocks the users on the openWIFI from modifying the DNS Settings Line 4 & 5 - Prevent the users on openWIFI from hogging the bandwidth.

Click Save Firewall Administration TAB Click Reboot Router

Should be pretty locked down and ready to deploy, but I also like to disable the web Interface from the openWIFI side. This will also test out the ssh setup.

Close the web browser and if your on Windows get putty to ssh to the ip address of the router. (Since you should still be connected with the cable, you're still on the openWIFI side of the router - so with either putty or console - execute the following commands):

ssh [email protected] Log in should give you a prompt

root@openWIFI:~# nvram set httpd_enable=0 root@openWIFI:~# nvram set http_enable=0 root@openWIFI:~# nvram commit root@openWIFI:~# reboot

If you need to turn the web interface back on, just ssh to it again and set everything to 1 and reboot again.

And that should be it. We should now have a simple WiFi Hotspot in the facility that does not allow access to our private LAN, but will use the existing established LAN.