Guest Wi-Fi question

[Jawloms]

Hi all,

 

For our filtering we direct all staff traffic through port 8084, and all student traffic through port 8083. If I set up a guest Wi-Fi I want to direct all traffic on that through port 8083. I know I can setup a proxy.pac or a wpad file so that things auto-detect, but there's nothing stopping someone from manually specifying the port number, which could of course result in kids using Facebook when we don't want them to. Can I simply block port 8084 on my guest Wi-Fi somehow? The Wi-Fi network is a managed NetGear.

 

Thank you

 

Stuart

[FN-GM]

What WIFI do you have?

It may also be possible to block it on the switches if they are managed.

[Blue_Cookeh]

Hi all,

 

For our filtering we direct all staff traffic through port 8084, and all student traffic through port 8083. If I set up a guest Wi-Fi I want to direct all traffic on that through port 8083. I know I can setup a proxy.pac or a wpad file so that things auto-detect, but there's nothing stopping someone from manually specifying the port number, which could of course result in kids using Facebook when we don't want them to. Can I simply block port 8084 on my guest Wi-Fi somehow? The Wi-Fi network is a managed NetGear.

 

Thank you

 

Stuart

 

Where does your proxy server sit? If you have a firewall between your guest WLAN and the Internet/proxy servers just block the ports for staff proxy and 80/443 to stop direct access, this is what we do since we don't route guest WLAN on our switches.

[bladedanny]

On our Ruckus guest WiFi we block everything but ports 443, 80 and 3128. This just allows web traffic and proxy port.

[Jawloms]

PROXY and filtering is all off-site and done by the LA. The wireless controller is a Netgear WC7520, and the switches are all managed HP with a 5412zl at the core. Edited November 11, 2015 by Jawloms

[FN-GM]

Does the Guest WIFI have its own VLAN? You could use an Access Control List on your HP Switches to drop traffic on the ports you don't want to allow.

[CyberNerd]

I think you need to VLAN and firewall the network in a way that prevents those in the student network from accessing the staff network.

[Jawloms]

Does the Guest WIFI have its own VLAN? You could use an Access Control List on your HP Switches to drop traffic on the ports you don't want to allow.

 

The guest Wi-Fi doesn't exist yet, so it certainly can have a VLAN when I create it. This definitely sounds the route to go.

[FN-GM]

The guest Wi-Fi doesn't exist yet, so it certainly can have a VLAN when I create it. This definitely sounds the route to go.

 

Not sure how HP works, but it will be probably be similar to Cisco. Create an ACL with this:

 

Deny IP any any eq 3128

Permit any any

 

 

Then apply that ACL to the Guest WIFI VLAN as in / ingress and anything on port 3128 will be dropped. All other traffic will still be allowed.