Filtering Obligations for Guest Wifi?

[Miscbrah]

Morning all - just a quick one (hopefully!)

 

Is there anything published regarding our obligations to filtering the public wifi specifically in schools? Also if so/if not, how strictly do you filter your public wifi?

 

Rummaging the gov.uk site as I type but not found anything specific to public wifi, so I'm thinking filtering in line with curriculum internet might be the way...

 

Thanks all.

[fiza]

Guests get the same filtering as students here

[Cat_Jam148]

Guests get the same filtering as students here

Same here. A couple of exceptions for Zoom and the like, but generally as locked down as pupils.

Edited January 8, 2025 by Cat_Jam148

[Chris_Cook]

Same as above. I want to do something with our Cover/Supply teacher logins and youtube access though, as YT is the most frequent issue.

 

The risk of a student getting a general guest login seems quite high, so it seems logical that its restricted. Sometimes they will be used legitimately with under 18s and visiting students etc.

[FN-GM]

The risk of a student getting a general guest login

Having a general guest login is a problem that should be addressed.

[kennysarmy]

Guest save level of filtering as pupils but we can allow social networking if required.

Guest password changed weekly.

[NegativeKillDeath]

Guest PC logins we have 2, one with staff internet filtering and one with student filtering, normally locked, and password changed when its not in use. Guest wifi is staff level filtering and access is granted as requested with 1 use log ins for the captive portal.

[Rob_D]

Our Guest Wifi has broadly the same filtering as staff. Wifi logins are set up by us or reception for the duration of a visitors visit.

But for us guest wifi is mostly used by outside lets or training orgs, with a few accounts for peripatetic music teachers and councilors.

[tom_newton]

Guest wifi is a challenge - both from authentication (guest wifi with a single password will leak like a hedgehog's raincoat), and from filtering - without MiTM (you arent going to get certs on guest devices) you will be stymied by ECH either now, or very soon. A simple DNS filter might work, but there's every chance your guest device is using DoH.

 

I would suggest that you whould avoid guest wifi where possible, and if it has to exist, then be very clear to safeguarding folks about what you can and can't expect from your filter.

 

- - - Updated - - -

 

Guest wifi is a challenge - both from authentication (guest wifi with a single password will leak like a hedgehog's raincoat), and from filtering - without MiTM (you arent going to get certs on guest devices) you will be stymied by ECH either now, or very soon. A simple DNS filter might work, but there's every chance your guest device is using DoH.

 

I would suggest that you should avoid guest wifi where possible, and if it has to exist, then be very clear to safeguarding folks about what you can and can't expect from your filter.

[Disease]

Guests get the same filtering as students here

 

Same here, default baseline is filtered as if pupil.

[mbedford]

Guest wifi is a challenge - both from authentication (guest wifi with a single password will leak like a hedgehog's raincoat), and from filtering - without MiTM (you arent going to get certs on guest devices) you will be stymied by ECH either now, or very soon. A simple DNS filter might work, but there's every chance your guest device is using DoH.

 

I would suggest that you whould avoid guest wifi where possible, and if it has to exist, then be very clear to safeguarding folks about what you can and can't expect from your filter.

 

- - - Updated - - -

 

Guest wifi is a challenge - both from authentication (guest wifi with a single password will leak like a hedgehog's raincoat), and from filtering - without MiTM (you arent going to get certs on guest devices) you will be stymied by ECH either now, or very soon. A simple DNS filter might work, but there's every chance your guest device is using DoH.

 

I would suggest that you should avoid guest wifi where possible, and if it has to exist, then be very clear to safeguarding folks about what you can and can't expect from your filter.

 

I don't think you need to do HTTPS inspection to effectively filter your guest WiFi. What we do is use our student web filtering rules, default block any sites that have not yet been categorized by our filtering solution, and enforce safe search on the main search engines via DNS. The downside is that we cant get Search Engine queries as they are HTTPS protected, but the combination of safe search and URL blocking appears to be enough, I don't know what people using the Guest Wifi are using as long as they cant get to it.

 

Other simpler options could be enforcement of safesearch via dns and\or push your unknown DNS queries to a filtered service (https://blog.cloudflare.com/introducing-1-1-1-1-for-families/), there are others available, but this one seems adequate.

Edited January 8, 2025 by mbedford

[psydii]

Filtered as per students here, but without MITM. WPA passphrase rotated weekly.

 

If the guest is going to be here for more than a week, we encourage their host to get them cleared through HR and into the MIS, from where they get an account - and we get more specific control and oversight of what they can and can't see. Typically we issue a school device to them if they are spending significant time in the building.

 

Sometimes they need more access than the default student access (for example to social media), we require them to register with HR for this.

 

With DoH and ECH becoming more prevalent, we probably need to revisit allowing any BYoD onto the wifi.

Edited January 8, 2025 by psydii

[tom_newton]

Bear in mind "no-MiTM" means "susceptible to ECH"

[psydii]

As an aside, this game seems pointless to me. All governments will mandate rules for ISPs and they will block the ECH and DoH endpoints outside of their jurisdiction, forcing cloudflare, google et al to host where said governments can mandate the retention and access to the logs. Meanwhile smaller institutions who don't have the clout to get the Cloudflare/Google logs, but still have legal requirements to control what is accessed by staff/users on their networks are forced to close of access to BYOD and close off modern protocols, further breaking the inovation and enhancements that they should be enabling.

 

(did squid ever make it to even http 1.1 support?)

Edited January 8, 2025 by psydii

[tom_newton]

Very true. The internet is closing to the "little guys". We are fighting this on many fronts.

Yes, Squid does support http 1.1, and it is still in use in our stack as well as securly's.

[Tefters]

Guest WiFi here done through Unifi on a time based token with basic porn / gambling filtering.

 

We do not offer any staff WiFi access as they all have school provided equipment except for trainees who we occasionally grant access to for short periods.

[PaddyNewman]

Obligation vs my general view is very different.

 

I'd be making sure guests were unique, each person who turns up uses a 1 time user that expires in 6 hours, but you record what guest got that name and it's logged in the filter with student filtering.

 

If they get blocked they'll just use 4G. Wireless is a privilege not a right and you accept the terms when you join.

 

I'm not a fan of guest networks though, I'm not a fan of people in general, but a user on 'my' internet is being known from start to finish, if they don't want that, mobile data it is. Same happens at my house, no exceptions.

 

I've seen guests doing some obscure stuff and some downright scary. I want names when the police potentially come knocking.

Edited January 8, 2025 by PaddyNewman