0

We use Linux for a router and firewall setup and some of our employee makes hotspot from OS X. Is there a way to block this traffic, or control it?

The problem is, that the IP addresses what this hotspot give to his clients are hidden in the network, so I can not just block this subnets.

0

I don't think this is trivial to use iptables for this task since the origin mac address and IP for connections behind the hotspot are the hotspot itself. But you could use NAT detection techniques like described for sflow. One way these techniques work is to detect unusual and varying TTL of the packets, i.e. packets originating from devices behind the hotspot have a different TTL then packets originating from the hotspots host itself.

But since this method can have false positives I'd recommend to just watch the traffic and determine potential hotspot users and only if you are sure then you could punish these users since they obviously violate your policy of network use. If users notice that you can detect such policy violation and that violations will be punished they will hopefully stop to even try to setup a hotspot.

1

I think you're falling into the trap of looking for a technical solution to a managerial problem. This is a case of users circumventing security. Try talking to them; why would they want that hotspot? Does the official Wi-Fi network have shortcomings that they're trying to work around?

As long as this is not addressed they will find ways to work around what you're trying to fix.

Why? Because this is not really something you can fix with a firewall. These only look at the physical and logical addresses, which aren't much use here.

If you don't know who is doing it, you could try foxhunting them with airodump-ng, or see if your Wi-Fi solution supports rogue AP detection.

  • 1
    Thanks! Our WiFi is not always on, it was made mostly for guest, or meetings. Not all people understand the potential risk of a hotspot, so I run on a wall... But yes, I need to insist more on that. – jb_alvarado Oct 20 '16 at 7:59
  • I think the main use of Wi-Fi is smartphones, the rest could use the cable. If you were to block the hotspot your employees would have this choice; not be connected on their mobile phones or use their data bundles for everything. Is this really a choice you want them to have to make? – J.A.K. Oct 20 '16 at 8:05
  • So; why turn off the Wi-Fi? Not to be rude, but i kind of understand employees expecting a piece of infrastructure the starbucks next door provides for free. It wil be A LOT less effort to configure a secure wireless network than messing with IPtables – J.A.K. Oct 20 '16 at 8:06
  • Yes I understand this, and our WiFi in general is secure. Not all employees like to have wireless on the hole time, so it is a wonder to whom you want to do it right. – jb_alvarado Oct 20 '16 at 8:18
  • Depending on your company's industry and role, you may be able to reference a security standard (ie PCI-DSS, HIPAA, etc) and explain to them that what they're doing could have significant repercussions and consequences for the company and them if they continue. Also, depending on their position within the company (ie probably not the owner/CEO) you may be able to temporarily disable network access for the computer hosting the rogue hotspot until they contact you and disable the hotspot. – Matt Butler Oct 20 '16 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.