Guest wireless network

[Kineas]

I'm looking at creating a guest wireless network that allows guests to connect their devices, as well as staff members phones etc to get access to the internet but restricted from everything else. We currently have 4x Netgear WNDAP360's in standalone mode. I've initially created another profile with a guest SSID and password set. I've noticed there's an option for "Wireless Client Security Separation" which Netgear's website explains is:

 

If enabled, the associated wireless clients will not be able to communicate with each other. This feature is used for hotspots and other public access situations. The default is disabled.

 

Enabling this does indeed stop wireless clients communicating with each other, however they are still able to access network resources. I've noticed however that with this enabled, the wireless clients get an IP of 172.16.16.*, rather than getting a 192.168.*.* address from DHCP. I assume the point does some routing so that the 2 separate networks talk to each other? I did notice this feature is explained differently for a different model of access point from Netgear:

 

Wireless client security separation is a security mechanism that isolates wireless clients from each other on the wireless network, and from wired clients on the wired network. This is a useful feature for guest networks or wireless hotspots, where wireless clients can access the Internet but not the rest of the network.

 

So I'm to presume it doesn't work the way I want it to on my model. Is there anyway I can utilise the 172 addresses to prevent them accessing resources? Or would this also prevent internet access? My points do support VLAN's, and I'm able to set a different VLAN in the guest profile, I'm just not sure what I need to do on the switches for this.

[ADMaster]

I would do the following.

 

Setup your guest ssid to use a different vlan.

Configure the vlan interface on the router with ip helper and an ACL

The ip helper allows the vlan to pass dhcp across vlans to your dhcp server.

The ACL should do the following;

allow dhcp between guest vlan and dhcp server
allow dns between guest and dns
allow for any internally hosted services such as website
deny to all internal address
allow to any on common ports, web, imap, google/apple stores whatever you want to allow
allow established
deny all others

fwbuilder is a good tool to create an ACL. Here is a trimmed down version of mine. I allow more access to staff devices then student or unknown devices but that all would not fit in a screenshot.

[Kineas]

Thanks for your response. I've just tried blocking the 172 IP range on a server with Windows firewall, as doing this on each of our servers would suit our needs. However, I'm still able to ping and browse shared files on the server. Any ideas about this?

[ADMaster]

I'm not sure how your netgear works, I'd guess it is doing some sort of NATing, so does the server think the traffic is coming from the netgear IP?

Enable firewall logging of successful connections on a server and see if it points you in the right direction.

[AlanD]

Sorry - but I think I'd need some kind of network plan and knowledge of your IP scheme for servers and DHCP, DNS setup.

We use VLANs so all our switches have a "BYOD" wireless network trunked to all the wireless access points. If you want to keep your BYOD wireless traffic off the domain (and you do) I can't see any way to avoid using VLANs - unless you cable the wireless access points separately (as you only have 4). Then we create an SSID profile on the wireless access points so that those joining this SSID get their wireless traffic directed to the VLAN. The VLAN feeds in to smoothwall where we set up rules to control what is allowed for these users. The SSID uses smoothwall's inbuilt radius facility and DHCP. DNS requests forwarded to our domain DNS - except for a few that are handles separately by smoothwall. But of course it can be any router other than smoothwall - although ideally one in which you have either more than one physical "outlet" or an outlet that supports VLANs.