Wifi Config - LAN only access

Hi all,

a school we support wants to restrict wifi access to LAN only for Students but unrestricted access for staff.
We are coming late to this project. The school has a flat network with Aerohive APs. Two SSIDs running back to one router.
The correct thing to do would be to vLAN it but we have been asked for a quick fix.

Any thoughts?
StreamieAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Craig BeckConnect With a Mentor Commented:
Don't give the Default Gateway to clients from DHCP.  Manually assign a default gateway on staff machines.
0
 
Fred MarshallPrincipalCommented:
A first thought is to assign the students IP addresses out of the same block and staff to get IP addresses out of a different block.  You can generally do the latter with IP addresses assigned to MAC addresses - that are outside the general purpose DHCP range.

Then block internet access to all the general purpose addresses in the facility firewall / router ...
0
 
StreamieAuthor Commented:
Intersting thought, thanks!
I'll play around with that theory and let you know how it goes.....
0
 
Fred MarshallPrincipalCommented:
craigbeck's suggestion sounds like a very good one!  It sure meets the simplicity test.

I've not tried it but it suggests (in general) that there be two gateway entries:
- an internet gateway entry for the staff
- no LAN gateway entry [blank] for students.

Packets arriving at the internet gateway from the staff will be forwarded to the intended destination.
Packets destined for the LAN from anyone will go directly out on the wire without having a gateway as the next hop.  So, the gateway will ignore the student packets altogether because it is not the next hop.  

This won't necessarily stop the students from entering the internet gateway address.... unless they don't have the necessary privileges to make such changes.
Like this:
1) Get an address via DHCP and note the lease time.
2) Manually enter the same address and add the gateway address and DNS address.
This won't cause an IP conflict for a time because of the lease.
0
 
StreamieAuthor Commented:
Simple but effective! It's the simple things that can sometimes be overlooked.
0
All Courses

From novice to tech pro — start learning today.