Seperating Network Traffic

[Mr.Ben]

Right, here's the scenario

 

The school will have (at the end of the month) a public Cafe opening - with expected wirelss access to the internet.

 

I have a managed wireless network which I can create VLAN's on (And have done this, one for the School, one for the Coffee Shop), but I want some way of securing traffic so that the only thing that public laptops can see and interact with is our Internet Gateway.

 

Anyone got any suggestions - I also need a way to distribute proxy setting to public laptops (via a script i assume?)

 

Cheers, Ben

[TwoZeroAlpha]

If it's public I expect people aren't going to be happy with something tinkering with their proxy settings, I can imagine the cry now

 

"I went to the school cafe, browsed the web and now I can't get online at home... must be a virus"

 

How about a dedicated DHCP server for the cafe with the setting gateway pointing to your desired proxy?

[ssiruuk2]

Create a new SSID in a new vlan.

 

Depending on your topology either on your l3 switch or firewall create an ACL to only permit the following and deny all other traffic:

 

permit dhcp, to your dhcp server (or firewall if that serves out your requests for this), permit dns to the relevant ip and allow tcp port 80 along with whatever other online services you need them to have (443 for ssl etc) - all this permitted to the ip of your proxy or default gateway only - drop / deny all other traffic.

 

I'd go with transparent proxy (i.e don't specify one) for ease to be honest.

 

Thats how I've done it and works well for me.