Intergrating Wifi into a wired network

[joshjacklin]

Hello and good morning, a few months ago I made a post asking about intergrating wireless into our sixth form common room and I was a bit vague in what I was asking and I thought I would give a comprehensive explanation and hope someone can help me please.

 

Basically recently I was asked if we could intergrate wireless into our sixth form common room, untill then our school has literally been all wired.

 

The aim of this is to enable the sixth formers to come in with there laptops and we will provide them with the wireless key. They must go through the proxy server to have filtered internet, and access to only 3 shared folders and there home area.

 

This room consists of 6 workstations which all use Windows XP and get DHCP addresses from the (server 2008 r2) and a HP Laserjet 2600 printer which uses a static IP, all of the network points in this room connect up to a Gigabit Netgear 24 port switch model number JGS524 for your information.

 

We are planning on connecting a Netgear ProSafe Wireless-N access points model number WNAP210.

 

Personally I must say I have not ever configured a group policy and will need a little bit of an explanation what to do.

 

I have a few questions on this if someone could answer this for me that would be brilliant please.

 

How does it work for the clients, because as far as im aware literally usually if we want a client to use the proxy (smoothwall) we have to go to the internet settings and go to the proxy settings and put in the address so that they can access the internet, so how do we have it so they are filtered via smoothwall without having to change any browser settings?

 

Usually the Client machines that we own are locked down, how do we set it so that when the students connect to our network with Macbooks, Windows 7 Machines, Windows Vista Machines and such only can have access to the areas we want?

 

If you could help I would be immensly greatful!

 

So as a summary we want filtered internet access and access to only 3 shared network drives and there documents.

 

Thank you very much!

 

Josh.

[IrritableTech]

To start you off... You'll need to look at wpad or proxy.pac files to help your users automatically configure their proxy settings. Most browsers support wpad.

 

I would suggest you probably want to VLAN the network and use access control to ensure that the laptops / phones / netbooks etc. can only access the ip addresses you want them to.

 

Assuming your pupils have their own log ons to your network, and suitable folder permissions are set, they should be able to browse to their shares and not be able to access anything else.

 

You wont be able to configure a Group Policy for them, they wont be fully connected to your domain.

[joshjacklin]

Cool thank you, how would I configure the vlan?

[K.C.Leblanc]

Cool thank you, how would I configure the vlan?

 

What switches are you using?

[Dos_Box]

The bumf on the Netgear site state the WNAP210 supports up to 30 users. How many do you anticipate using it at once (including mobile devices)? If it is around, or more than this, then I would suggest a more enterprise orientated access point that will be able to handle the concurrent connections better.

[Brpilot99]

How about proxypal for them to set the proxy settings?

[joshjacklin]

Cool thank you

-K.C.Leblanc- The switch we are using in this perticular room is a Gigabit Netgear 24 port switch model number JGS524

 

-Dos_Box- As we are an independant school and we never have no where near the maximum number, but if we ever did have to consider a large amount then yeah I agree we would need to go to something a bit more substantial.

 

-Brpilot99- proxypal looks amazing but, I wouldnt want to give the kids the option of turning off and on the proxy server because they could just go unfiltered at any given time.

 

Thank you all for your input, so literally what do I do lol ive got the general concept of where I need to be going do I need to configure the router other than the fact that I need to set a form of encryption with a passcode and set the router with a static IP, do I need to do anything to my proxy server?

 

And what do I need to configure for the vlan? literally I know these seem simplistic questions but I have only ever configured a small wireless netgear router at home, and you have to start off somewhere.

[K.C.Leblanc]

Cool thank you

-K.C.Leblanc- The switch we are using in this perticular room is a Gigabit Netgear 24 port switch model number JGS524

 

Since it's an unmanaged switch it won't do vlans.

[Brpilot99]

"I wouldnt want to give the kids the option of turning off and on the proxy server because they could just go unfiltered at any given time"

 

If the only route to the outside world goes via your smoothwall box then if they turn of the proxy setting then the internet should simply not work atall ..

[CyberNerd]

turning off the proxy in the browser would only allow direct internet connection if your firewall is misconfigured.

[clareq]

"I wouldnt want to give the kids the option of turning off and on the proxy server because they could just go unfiltered at any given time"

 

If turning of the proxy allows unfiltered Internet, what's stopping them from connecting a network cable to their laptop and surfing to their heart's content now?

[joshjacklin]

yes, that is true as we have admin users of which do not go through the proxy as present so literally it renders our plan pretty much useless as if we turned around and forced all users to go through the proxy management would over rule us as soon as someone complains, unless there is a way of configuring smoothwall to allow internet via mac address of the machine, so if one of the sixth form gave a student the key for the wireless, they couldnt use it unless we had added there mac address to smoothwall or even the router, ok putting the internet filtering to the side for a second, how do I have it so the users can only access there home areas?

[K.C.Leblanc]

yes, that is true as we have admin users of which do not go through the proxy as present so literally it renders our plan pretty much useless as if we turned around and forced all users to go through the proxy management would over rule us as soon as someone complains, unless there is a way of configuring smoothwall to allow internet via mac address of the machine, so if one of the sixth form gave a student the key for the wireless, they couldnt use it unless we had added there mac address to smoothwall or even the router, ok putting the internet filtering to the side for a second, how do I have it so the users can only access there home areas?

 

You could either use web folders (which will be easier if you apply some firewalling) or the can just map their work area to a drive letter like you'd do. The only different it they'd have to provide credentials.

 

You say you have a smoothwall, my only experience of smoothwall is express so I'm not 100 % sure your setup will support this. But smoothwall lets you route traffic between different networks (or subnets). You could create a separate subnet for your wireless, and then connect it to the smoothwall. You can then use transparent proxying to prevent users connecting straight to the internet. Hopefully Tom from smoothwall will see this thread and be able to give a better explanation. This should also keep the wireless network contained and give your network a degree of protection.