Changing SSID to go through smoothwall

[Sheridan]

I've inherited a system at a new school and one thing I've noticed is they have a 'guest' wifi (Meraki) using PSK - works fine, but it also allows ALL traffic as it bypasses the smoothwall entirely

 

What seems to have been put in place is the 'normal' SSID is used by all school owned wireless devices (all Windows) so the WPAD discovery automatically drops them onto the smoothwall as a proxy, but these devices on the guest wifi don't have this control - so if the 'automatic proxy' is disabled (or even exists for android/IOS devices/screens etc) then they hit the default static route on the core switch, which passes them straight out of the main firewall, which is a concern as it means no filtering is in place

 

So I've spent a while thinking about this, and changing the default static route to be the smoothwall seems to be the best option, and then added a transparent proxy etc - this also means I'll have put add firewall rules to the smoothie for phone systems, fire alarm etc which currently use the default static route to exit in the same way as the guest ssid

 

Am I overthinking this, or is there a better way to do this? I've previously only ever had a smoothwall as the only UTM so it was dead simple - it handled all outbound traffic therefore it was the default route on the core but this is making me think I've missed something!?

[Davit2005]

Can you jus put the gateway for the vlan of the guest SSID on the smoothwall then jus map the vlan at layer 2 to the Smoothwall?

 

Admittedly don't know much about Smoothwalls. But this might also be a security benefit as the traffic could be controlled with security/access policies and have minimum need to touch your internal network.

Edited May 31, 2024 by Davit2005

[tom_newton]

I'd be inclined to separate out the guest traffic and just point that at the Smoothie - you might be there for a while untangling fire alarms, and if it aint broke..

[Sheridan]

Cheers, trying to untangle the guest ssid is the tricky part, as the vlan routing is bit complicated here!