effortless guest wifi

[browolf]

One of our SMT goes to mcdonalds and gets on free wireless without having to mess around with wpads or proxy urls and wants to know why we can't have such an effortless system here.

 

Obviously McD have some kind of transparent proxying going on.

 

Currently our setup is wpad/pac.

 

We tried transparent proxy before wpad but ssl didn't work and getting round that seemed to involve dodgy Man-in-the-middle decrypting packets.

 

So I'm wondering what commercial solutions exist for transparent proxies?

[john]

We used a Smoothwall UTM that did that just fine with Ruckus managed wireless. We had a guest portal to hold things secure from the students so that was a passkey but that was all we had once through that it just worked and was fine.

[FN-GM]

What switches and proxy server do you have? You could look at Cisco WCCP.

[browolf]

What switches and proxy server do you have? You could look at Cisco WCCP.

 

3com switches with a debian proxy.

[browolf]

I gave up on smoothwall express. It didn't work and I had no idea why and no idea how to find out.

 

I went back to our self built wpad proxy and figured out how to make transparency work, ssl too.

 

although seems there's a problem with app store...

[Guest Guest]

Try endian firewall. It's a turnkey dans guardian based firewall/proxy.

[edutech4schools]

turn off all the school security and bingo SMT have what they need. Probably not such a good idea working on student data from McD's.

[RTFM]

We did it in Smoothwall, we now do it with Lightspeed

[caffrey]

We do it here too, 2 vlans, one is guest - goes to a smoothwall with transparent authentication, the guest ssid is just open, basic filtering on the smoothwall - not ideal but it works.

[RTFM]

We did it in Smoothwall, we now do it with Lightspeed

 

I have just thought, no we don't. We do it with Ruckus. Not sure where my brain was when i posted the above. Ruckus deals with our guest pass generation and login page for users. Lightspeed just deals with the filtering on the SSID / VLAN.

 

Heads a shed.

[cpjitservices]

All you need is pfsense, its also got Proxying like Dansguardian and squid and it has captive portal. Have used it in cafe's and the likes myself! Piece of cake to configure and easy to manage as it looks just like a normal router interface. Edited May 15, 2013 by cpjitservices

[chazzy2501]

I was thinking of setting up an un-routable Vlan and sticking a domestic adsl broadband router onto it. That way I'm not using my £6000 BB connection so people can view youtube videos. I could still use opendns if filtering was an issue.

[jinnantonnixx]

I've used this:

PacketFence: Open Source NAC (Network Access Control)

[Duke5A]

I gave up on smoothwall express. It didn't work and I had no idea why and no idea how to find out.

 

I went back to our self built wpad proxy and figured out how to make transparency work, ssl too.

 

although seems there's a problem with app store...

 

Do you use an upstream cache peer for filtering? I was building a Squid proxy for this very purpose and found out there is a bug in Squid that when using SSL bumping with a cache peer it will actually send SSL traffic to the cache peer unencrypted. After reading that I gave up on the project as it was a deal breaker. I don't know if it has been fixed yet.