Guest Network

[MatthewL]

What ports would a user need open to access basic services on a network? Say you have a guest network for external people and you brought a device in for internet same as you do in a Cafe what do you need to work?

 

TCP 80 and 443 for internet traffic, along with 53 for DNS and 123 for a time server. I suppose you can specify which DNS they use i.e. Google.

 

Email would be ports 25, 587, 465, 143 and 993 would cover all the key services and then any other ports would be VPN to enable connect back, RDP and then maybe UDP 500 and 4500 (VPN ports also) for WiFi calling.

 

Most things work over 80 or 443 just wondered if there is anything else, as just doing a piece of work at the moment.

[FN-GM]

I wouldn't open up 25. If they have an SMTP server on the device they can spam people and get your IP black listed.

 

We allow:

 

TCP/80

TCP/443

UDP/53

UDP/123

 

We also allow all ports to the LA IP Range. They keep messing around with the VPN etc so we kept playing catch-up.

[Opendium_Steve]

I'd usually recommend guest networks be as permissive as possible (within reason). Our standard setup would be something like:

 

- Block TCP port 25 (to prevent compromised devices sending spam)

- Transparent proxy on TCP ports 80 and 443 (HTTP/HTTPS) so you can do basic filtering (IWF and CTIRU lists, light filtering for things like porn) and logging

- Passive HTTPS inspection only, no decryption (means you don't need to faff with certificates on devices).

- TCP and UDP port 53 (DNS) redirected to the local DNS server.

- UDP port 123 (NTP) redirected to the local NTP server.

- Everything else to the internet allowed out.

- Block pretty much any traffic from a visitor to the LAN that wouldn't be allowed in from the internet.

 

The DNS and NTP redirection is not really important for guest networks, but we tend to do that by default for an entire school network since it helps squash VPNs that tunnel out of the student BYOD networks on DNS and NTP ports. Just blocking DNS/NTP rather than redirecting it to a local server tends to be problematic because far too many devices ignore your DHCP settings and use external servers for DNS and NTP.

 

At the end of the day, there isn't really a need to do a lot of blocking of visitor traffic, other than to protect the school's internal systems. Good idea to have some logs though, just in case.

[MatthewL]

In this instance it isn't in a school, just wifi separated off the normal LAN for things like phones and other dirty devices. There will only ever be a handful of devices and key will be needed.

[FN-GM]

I would also isolate each client from each other. Stops people from accessing each others devices.

[MatthewL]

That I am just on with, trying to find a way if its possible with pfSense of Unifi, unless you know?