0

I look after the network for a small educational establishment, and we wish to make wireless internet access available for teaching staff but not for students. We do, however, want to allow the students wireless access to our internal network so that they can download lecture notes, etc.

I have two wireless routers (both Netgear routers - a WGR614v9 and a WPN824) set up with different wireless keys: the students have the key for the first router and the teaching staff have the key for the second. Internet access itself comes from a third (non-wireless) Netgear router/modem which is connected to the ADSL line.

I've tried various DHCP configurations: having DHCP enabled only on the second router, only on the first, and enabled on both. In general, all computers (student or teacher) end up using the same router as their DHCP server, regardless of which wireless key/router they're using to connect. Right now they're always getting their details assigned by the teachers' router. When I set up port blocking on the students' router (to block HTTP/HTTPS/POP3/SMTP/IMAP/etc. ports) it doesn't seem to make any difference - the student computers still seem to be able to connect to the internet quite happily via the second router (the one that they have as their 'default gateway' because it's the DHCP server).

Does anybody know how I can set this up so that people who connect to our network via the first router won't have internet access but people who connect to our network via the second router will?

Improve this question

3 Answers 3

Reset to default
1

You are right to not want to run multiple DHCP servers on the same network, that can end up giving very random results.

Right now it sounds like you have both wireless routers plugged into your main router by their internal ports, using them basically as access points instead of routers (just getting the wireless users connected into the main network and letting the main router do the real thinking).

If the wireless router the students are on allows you to setup your port blocking rules to specific addresses, you may be able to on that one set it to block all communication, then allow specific rules to your internal servers. Then connect that router to your main network by the Internet/WAN port on the router and enable DHCP on it. That will make it so that the students are segmented on their own network and can only access your main network routing through the wireless router, which has the rules setup on it.

So, you would have:
Internet Connection <-> Main Router WAN Port
Main Router Internal Port <-> Teacher Wireless Router Internal Port
Main Router Internal Port <-> Student Wireless Router WAN Port

Anyone connected to the main router or the teacher wireless will be in one network and have normal access. Anyone connected to the student wireless will be in another network behind the student wireless router and be subjected to the rules setup on that router.

Otherwise, you'd want to look into setting up a DMZ to separate the students from everyone else, then setup your specific rules they are allowed to do. Your current equipment may not support this, your main wired router would be the one to look at.

Improve this answer
3
  • Can you clarify: when you say "by the Internet/WAN port on the router", which router's WAN port are you referring to? The students' AP/Router or the main router? This sounds promising but I don't quite follow how I'd do what you're suggesting!
    – andygeers
    Oct 26, 2009 at 14:53
  • This seems to have done the trick - by connecting the student router to the network using it's Internet/WAN port, I can set it up as an entirely separate network, but which somehow can still talk to the main one, and then the port filtering applies to them but to not the teachers. All I've got to figure out now is a minor DNS issue that's meaning the server the lecture notes are on isn't showing up by its proper name, but that should be easy enough
    – andygeers
    Oct 26, 2009 at 15:29
  • Glad to hear, as mentioned by echobeach2, this usually isn't the recommended way of going because if the students were using the internet they would be going through a double NAT. I suggested this because you only wanted them to be accessing services on the main network.
    – ManiacZX
    Oct 26, 2009 at 15:35
1

Your assumption is (or damned well should be) incorrect -- if the APs aren't totally worthless, they should only serve DHCP for devices associated to themselves (and you can only associate to an AP you know the key for).

Basically, treat each AP as a separate wired network, and the configuration should kinda just fall out in the wash.

Improve this answer
4
  • Does it matter that they're routers rather than strictly "Access Points"? To be fair, I am testing this with a hard wire rather than doing it wirelessly, but my computer connected to router 1 is still using router 2 as its DHCP server
    – andygeers
    Oct 26, 2009 at 14:04
  • Depends on how the wired ports are hooked up. If they're on the same ethernet segment as the wireless, the test should be accurate, but if they're actually part of the "WAN" segment, then all bets are off.
    – womble ♦
    Oct 26, 2009 at 14:10
  • Hmm... I've now tested it wirelessly and get the same result: it always uses Router 2 as the DHCP server even when connecting to Router 1's wireless.
    – andygeers
    Oct 26, 2009 at 14:44
  • That really sounds like you don't have routers, you've got wireless bridges, or else "router" 1 has a DHCP relay running.
    – womble ♦
    Oct 26, 2009 at 15:10
0

I think that any combination here will lead to spagetti, and double NAT which will not work for some things, although I guess web browsing will be ok. How about checking out DD-WRT instead?

Improve this answer
1
  • Normally I agree on your double NAT statement, however he only wants the students to access services inside the main network. So it won't be a double NAT at that point.
    – ManiacZX
    Oct 26, 2009 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .