http://www.dslreports.com/forum/r20709319 en Fri, 09 Jan 2009 08:49:52 EDT Fri, 09 Jan 2009 08:49:52 EDT http://www.dslreports.com/forum/remark,20827800 MicroWISP : Go for it, yes use two subnets. IPCOP or pfSense will be your best bet for routers.
--
"Man who say it cannot be done should not interrupt man doing it."]]> http://www.dslreports.com/forum/remark,20827800 Mon, 21 Jul 2008 20:49:41 EDT http://www.dslreports.com/forum/remark,20810104 genewitch : Yay for ipcop. Yeah, red=dsl blue=wifiAP green=POS you're set. ignore the orange network. it will only laugh at you.]]> http://www.dslreports.com/forum/remark,20810104 Fri, 18 Jul 2008 02:36:01 EDT http://www.dslreports.com/forum/remark,20763994 dervari : A Netscreen 5GT running in "Home/Work" mode would be ideal. The "Home" network is completely isolated from the "Work" network. You'd have 2 100bT ports on each side that you can daisy chain a switch off of.]]> http://www.dslreports.com/forum/remark,20763994 Wed, 09 Jul 2008 12:04:22 EDT http://www.dslreports.com/forum/remark,20760616 baysoor : check out IPCOP. »www.ipcop.org/ You can install it on any old pc and few network cards. ($10 a pop at fry's near you). Hang your wireless access point/router to external network. You will have a safe firewall for your network and separate network for your customers. You can even limit their bandwidth usage. I have installed it on old AMD K6-300 with 128 MB of RAM and it is working fine. (not much customer load though, most of it is internal use in a small office). You can go fancy with firewall, add other safety features, there is a boatload of plugins.]]> http://www.dslreports.com/forum/remark,20760616 Tue, 08 Jul 2008 18:56:06 EDT http://www.dslreports.com/forum/remark,20751309 masterdave23 : check out »www.pcicomplianceguide.org/ to see if its allowed by compliance by vista or master card

»https://www.pcisecuritystandards.org/pdf···v1-1.pdf

****per Visa's stance your business will fail PCI compliance status." "With fines up to $500,000 (USD) for each incident of non-compliance with PCI guidelines, it is in the best interest of all businesses subject to PCI compliance to heed the PCI and PABP guidelines." ]]> http://www.dslreports.com/forum/remark,20751309 Sun, 06 Jul 2008 23:39:35 EDT http://www.dslreports.com/forum/remark,20709319 FzyR : Thanks everyone! I'll pass this info along and see what we can do.
--
They have the internet on computers now?]]> http://www.dslreports.com/forum/remark,20709319 Fri, 27 Jun 2008 17:44:09 EDT http://www.dslreports.com/forum/remark,20692818 YqE41k24 : That setup isn't a secure network. The second setup (with [wired router] and [unsecure wireless router] sharing the same switch) does not have two independent networks. The [wired router] network is basically a client to the [unsecure wireless router] network, and a peer of the restaurant guests.

I would not worry about credit card data being seen over the network. It should be secured at each end via encryption. And the switch will not broadcast network traffic over both the wired network and wireless. Packets destined for the wireless router won't be seen by the wired router, for example.

However, people could jam the system. They could: play with MAC addresses (e.g. making their wireless network adapter have the same hardware MAC as the wired router, for instance); manually assign IP addresses to their machines which could conflict with your wired router; hog all of your DSL bandwidth; or hack your modem.

Your modem is probably also acting as a firewall and logged into your DSL provider. That means that the point of sale equipment would be behind two firewalls ([wired router] and [dsl modem]). This double-NAT can introduce problems.

Anav has the right advice. Use a device such as the ZyWall 2 Plus which is made for situations like this. Or really get two independent networks by setting up a separate DSL account.]]> http://www.dslreports.com/forum/remark,20692818 Tue, 24 Jun 2008 17:11:45 EDT http://www.dslreports.com/forum/remark,20665071 jpg366 : Just watch out for the times when a router resets to factory defaults (on its own, or with help from the power company). If both are initially set to non-default IP addresses, then you have a much lower chance of everything ending up in the same subnet.

I recently ran across a LinksysV5 running DD-WRT that somehow got reset and was running, quite well, totally unsecured. Fixed it easily enough, but it did not give me a warm feeling about home-quality equipment.]]> http://www.dslreports.com/forum/remark,20665071 Wed, 18 Jun 2008 22:55:53 EDT http://www.dslreports.com/forum/remark,20643583 cleckjr : FzyR

As long as the two routers, "wired router" and "unsecured wireless router", are defined as different subnets. It seems secure enough to me. The "wired router" should have its firewall enabled.

For example, you could define the "wired router" to be a 192.168.1.X address space; the "unsecured wireless router" 192.168.2.X address space.

Unless someone physically hooks into the switch; the dsl modem; or the "wired router," I don't see how they would be able to snoop the traffic on the wired POS network (192.168.1.x). But then again, that is not my forte.

I've used a similar setup to allow my kids wifi gaming access, for Nintendo DS, on a separate subnet. In my scenario, I have two wireless routers, one secured and one unsecured. I use the secured. They play on the unsecured.

cleckjr]]> http://www.dslreports.com/forum/remark,20643583 Sat, 14 Jun 2008 17:07:34 EDT http://www.dslreports.com/forum/remark,20642777 Anav : The best solution would be to get a separate internet account.

Alternatively, they could use something like the zywall 2 plus zyxel router that has separate firewalled dhcp serving zones, so that the guests could not access any of the private information and would only have access to the net. This is a wired unit and one would use two separate APs or wifi routers acting solely as AP/switches attached to the different zones.

THe zywall 2WG has its own wifi and thus only one other wifi router needs procurement.

In the meantime advise your client to cease providing public wifi until security measures are in place.

--
Ain't nuthin but the blues! "Albert Collins".
Leave your troubles at the door! "Pepe Peregil" De Sevilla. Just Don't Wifi without WPA, "Yul Brenner"

LlamaWorks Equipment]]> http://www.dslreports.com/forum/remark,20642777 Sat, 14 Jun 2008 13:30:53 EDT http://www.dslreports.com/forum/remark,20642710 FzyR : Friends of mine run a restaurant where they offer free unsecured wifi to its customers. They are concerned about having their wired point of sales machines being hooked up to this same network (credit card data etc).

The current set-up which I'm worried about:
[dsl modem] -- [wireless router] -- (wired)[POS Equipment] -- (wireless) GuestsWould this setup be safe:
[dsl modem]  -- [switch]  -- [wired router] -- (wired) POS Equipment  -- [unsecure wireless router] -- (wireless) Restaurant GuestsMy suggestion is to split the initial connection with a switch and add another wired-only router where only the pos equipment is hooked to. This would create essentially 2 independent networks... would this work?

any feedback or suggestions would be appreciated :)

--
They have the internet on computers now?
]]> http://www.dslreports.com/forum/remark,20642710 Sat, 14 Jun 2008 13:10:09 EDT