browolf Posted February 2, 2009 Posted February 2, 2009 setting up a debian proxy for students personal laptops on a vlan. 2 nic job 1 > vlan, the other > router was figuring i'd do squid dhcp dns some kind of firewall thing maybe automatic config script for browser settings. just setting up dhcp and thinking if i dont allocate addresses I can just have reservations as an additional layer of security but maybe there's better ways? mac filter on firewall software perhaps what do you think?
powdarrmonkey Posted February 2, 2009 Posted February 2, 2009 setting up a debian proxy for students personal laptops on a vlan. 2 nic job 1 > vlan, the other > router was figuring i'd do squid dhcp dns some kind of firewall thing maybe automatic config script for browser settings. Sounds fine. just setting up dhcp and thinking if i dont allocate addresses I can just have reservations as an additional layer of security but maybe there's better ways? Nah-ah. Not having a reservation doesn't stop somebody using a static IP in the right subnet; this is just obscurity. mac filter on firewall software perhaps Perhaps. But if your access points and switches support it, you would be better with RADIUS in MAC-login mode. Then only approved machines can even connect to the APs.
browolf Posted February 2, 2009 Author Posted February 2, 2009 Sounds fine. Nah-ah. Not having a reservation doesn't stop somebody using a static IP in the right subnet; this is just obscurity. Perhaps. But if your access points and switches support it, you would be better with RADIUS in MAC-login mode. Then only approved machines can even connect to the APs. the wireless ap controller switches already have mac filters and a 26 char security key and maybe other stuff. my boss and the original equipment seller are dealing with that. i was figuring security + obscurity hehe
powdarrmonkey Posted February 2, 2009 Posted February 2, 2009 In that case, it's extra administrative overhead that you don't need.
browolf Posted February 2, 2009 Author Posted February 2, 2009 fair enough I'll just have it allocating addresses. cheers.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now