2

How do I design a secure public wireless network. I want to offer guest network. But how do I make it secure without making my customer get authenticated with password or username.

I have read about hotspot and the use of double NAT, but i am not clear about those things. Can someone guide me how do I create a secure public network.

Thanks.

closed as too broad by Neil Smithline, Steffen Ullrich, Graham Hill, Matthew, WhiteWinterWolf Jan 6 '16 at 10:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This question is very broad. Each you think you want to make something "secure", ask yourself "secure against what?". Here, security may cover a lot of different things: limit access to your actual guests and not allow unknown neighbors, prevent guest from accessing your internal network, prevent any malicious activity from your guest which could put you in trouble toward your ISP and the authorities, ensure that guests' communication are isolated from each other, etc.. – WhiteWinterWolf Jan 6 '16 at 10:42
1

NAT, whether single or double, doesn't have anything to do with security.

Security is ultimately the end user's job. You could just throw up some unsecured AP's, and provide a warning that anybody using those AP's needs to do their own due diligence to make sure they're only communicating with valid servers over valid HTTPS connections, or using a trustworthy VPN.

You really can't make the network itself secure without requiring your users to authenticate somehow. At the very least, basic WiFi security requires the use of WPA2 "Personal" and a shared key. You have to provide the key to every user. You could just hand it out on business cards or tear-off tabs on a bulletin board or put it on a sign on the wall. Even if you try to keep it semi-private, your users are going to share it. But at least individual devices will have a uniquely encrypted connection to the Access Point and won't be able to sniff each other. On the other hand, somebody could set up a rogue AP using the same key, your users would connect to that rogue AP, and the bad guy would be able to sniff all their traffic.

As far as the users themselves being secure on your network, that's really ultimately up to them. They need to only use websites and apps that utilize the HTTPS protocol, or use a VPN. More than that, far too many apps don't use HTTPS appropriately, completely bypassing the necessary checks to verify that the SSL/TLS certificates from servers are valid. Programmers too often have trouble getting the verification checks to work, so they give up and throw a switch that makes the protocol "just work," but at the expense of bypassing the verification checks. When they do that, the packets are encrypted, but they could be encrypted by a rogue key, possibly via DNS poisoning pointing the user at a bad server, with a bad guy picking up the whole conversation in the clear.

So you can't really guarantee secure communications for your public WiFi users. That's their job.

Not the answer you're looking for? Browse other questions tagged or ask your own question.