[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Wifi Config - LAN only access

Posted on 2014-02-25
5
Medium Priority
?
322 Views
Last Modified: 2014-02-26
Hi all,

a school we support wants to restrict wifi access to LAN only for Students but unrestricted access for staff.
We are coming late to this project. The school has a flat network with Aerohive APs. Two SSIDs running back to one router.
The correct thing to do would be to vLAN it but we have been asked for a quick fix.

Any thoughts?
0
Comment
Question by:Streamie
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 26

Expert Comment

by:Fred Marshall
ID: 39887138
A first thought is to assign the students IP addresses out of the same block and staff to get IP addresses out of a different block.  You can generally do the latter with IP addresses assigned to MAC addresses - that are outside the general purpose DHCP range.

Then block internet access to all the general purpose addresses in the facility firewall / router ...
0
 

Author Comment

by:Streamie
ID: 39887247
Intersting thought, thanks!
I'll play around with that theory and let you know how it goes.....
0
 
LVL 47

Accepted Solution

by:
Craig Beck earned 1500 total points
ID: 39888700
Don't give the Default Gateway to clients from DHCP.  Manually assign a default gateway on staff machines.
0
 
LVL 26

Expert Comment

by:Fred Marshall
ID: 39889144
craigbeck's suggestion sounds like a very good one!  It sure meets the simplicity test.

I've not tried it but it suggests (in general) that there be two gateway entries:
- an internet gateway entry for the staff
- no LAN gateway entry [blank] for students.

Packets arriving at the internet gateway from the staff will be forwarded to the intended destination.
Packets destined for the LAN from anyone will go directly out on the wire without having a gateway as the next hop.  So, the gateway will ignore the student packets altogether because it is not the next hop.  

This won't necessarily stop the students from entering the internet gateway address.... unless they don't have the necessary privileges to make such changes.
Like this:
1) Get an address via DHCP and note the lease time.
2) Manually enter the same address and add the gateway address and DNS address.
This won't cause an IP conflict for a time because of the lease.
0
 

Author Closing Comment

by:Streamie
ID: 39889738
Simple but effective! It's the simple things that can sometimes be overlooked.
0

Featured Post

Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question