mcnab
join:2003-09-17
Beverly Hills, CA | Restricting Wireless users from accessing LAN workgroups Hi everyone,
I have a Buffalo WHR-HP-G54 running Tomato Firmware.
I have 4 computers setup on my internal (Wired) network, and they access data off a "mapped network drive" that I setup.
I want to offer Wifi access to customers, but currently if I connect any computer to the wireless (secured or unsecured) they have access to the same network drive / workgroup computers as if they were wired.
I've read there are "guest zones" available on some wireless firmware so that you can setup different zones and restrict my customers from only using the wireless (and not accessing my internal network).
Should I be doing this router / wireless side? or should I be configuring something differently on my small internal network? |
|
 SoonerAlOld enough to know betterPremium,MVM
join:2002-07-23
Norman, OK
kudos:5 | 
Router with guest WLAN functionality | 
Dual router scheme |
1. Purchase a router, or install third-party firmware on an existing router, that offers a seperate guest wireless LAN function. I have a ZyXEL NBG334W that has this feature. See the first screen shot as an example.
2. Purchase a second wireless router and connect it to your existing network but in front of the router for your protected network. See the second screen shot as an example. The private network would have a different subnet than the guest network, ie. private 192.168.2.X and guest 192.168.1.X for example or whatever you choose.
--
"When all else fails read the instructions..."
MS-MVP Windows Expert - Consumer |
|
| reply to mcnab
Second SoonerAl's suggestions, it all depends on your needs, your technical skill level and
your budget. Either option will fit your needs, and generally shouldn't involve a big outlay
of cash for equipment.
Best of luck!
Regards |
|
| reply to mcnab
I offer a third option as the more secure and lower potential for problems...
Take the output of the cable modem into a switch...
out of that switch to "company" router
out of that switch to "guest" router
...each router should get their own static IP.
This way:
- the two networks can't talk
- you don't have the double NAT issues associated with one router going through another router
- company users who are visiting or accidentally connect to the guest wireless could still VPN into the company network
- when law enforcement comes asking about suspicious traffic you can easily distinguish from within your company vs. guest wireless |
|
|
|
