2

I used to work for a company that did wireless hotspots, and this is the challenge that was given to me one day. I don't believe there is a secure solution to it, but it still bugs me for some reason.

We wanted to ship a wireless hotspot device (an ALIX board running monowall) to a location where we don't know anything about the network, so we have no idea what IP addressing they are using, and be able to have a non technical user just plug it into their existing router and Just Work.

All the networks would be simple small office modem/NAT routers, so the hotspot can use DHCP on it's WAN side to connect to the internet. I pointed out that anyone on the hotspot could also access the office computers, since it considers that to just be another part of the internet. The hotspot is free and open wireless access for anyone in range - a lovely target for an attacker.

Try as I might, I couldn't find any way to solve it that I considered to be secure enough. In the end, I refused to set them up this way, and we had to go out and reconfigure things so our router connected before the office machines and could isolate the office network and the wireless clients. But the problem still bugs me from time to time.

So my question is, is there anyway to securely setup the network in the diagram below if you only have control of the hotspot device, and don't know anything about the rest of the network in advance?

For the purposes of this question, I'm not concerned with what people on the wireless can do to each other, or what they can do on the internet. The only concern is protecting the office PCs from people connected to the hotspot.

Network diagram

Improve this question
4
  • Why don't you just put a firewall between the office PCs and the NAT? Or (sarcasm) do a iwconfig ath0 txpower 0 on the hotspot?
    – user11869
    Aug 22, 2012 at 13:45
  • Because the goal was to be able to ship a preconfigured device to the location and have someone just plug it in. In the end, that's basically what we did, since I wouldn't help them set it up this way without finding a way to secure it.
    – Grant
    Aug 22, 2012 at 13:48
  • I think we need more information about your security requirements. An open network is going to be insecure. You could potentially create some type of wifi device which connects only to a remote VPN on the WAN side and is isolated by the network, if your goals is to protect eavsdropping, then you need WPA, etc. Please clarify what aspects or all aspects of security you are looking for here.
    – Eric G
    Aug 22, 2012 at 13:49
  • Updated the question to include that. Attacks between wireless clients isn't a concern here. All I'm concerned with is protecting the office PCs from wireless clients. The best solution is to put the hotspot router directly off the modem, and connect the office PCs to my equipment so I can firewall them properly. Which is what I did in the end. I'm just wondering if there was a way to make this idea work, so no changes would need to be made to the existing network. I suspect the answer is no. But I also know there are people smarter than me out there!
    – Grant
    Aug 22, 2012 at 13:58

3 Answers 3

Reset to default
1

The only solution I can think of is to run two isolated networks: one for the wired ports, one for clients on the wifi AP. This allows wifi clients to talk to wifi clients and the internet, and office PCs to talk to office PCs and the internet, but no interplay between the two. In terms of addressing, you'd probably need to put them on separate subnets, e.g. 10.0.1/24 and 10.0.2/24.

Improve this answer
2
  • Indeed, that's what we did. But it requires reconfiguring their network, which can be a hassle.
    – Grant
    Aug 22, 2012 at 14:06
  • If their existing network runs off a hub, you could just connect the internet-facing side of the hub to the AP instead, so the reconfiguration would be minimal. i.e. office PCs connect to hub, hub connects to AP, AP connects to the internet. There's not really a way to drop the device into the network without making any changes at all.
    – Polynomial
    Aug 22, 2012 at 14:28
2

I know this question is a bit old, and already has an accepted answer. But I thought I could add to it for those who find it still.

I'm possibly missing something here since I'm not quite a network expert, but since you are running m0n0wall, you have access to some pretty advanced firewall and routing features. As a sidenote, pfSense is a fork of m0n0wall that has gotten a lot more attention lately and might be easier to use.

Assuming you have full control of the devices, and they have very configurable routing, you should be able to block off all the not-publicly-routable ip addresses. This would make it so anyone connecting on the hotspot could be routed to Internet addresses, but not to anything internal since the internal IPs will (with rare, usually poorly planned, exceptions) be in the non-routable address space.

The ranges set aside for such internal networks (that you would block the hotspot from routing to) are as follows:

IANA-reserved private IPv4 network ranges

10.0.0.0    10.255.255.255  
172.16.0.0  172.31.255.255  
192.168.0.0 192.168.255.255

Furthermore, you should be able to setup multiple Wireless access points from this single device so that you would be providing the added service of a secure INTERNALLY routable connection as well. The public hotspot would be blocked from internal addresses, but anyone connecting to the other secure signal would not be blocked. This is great with so many business users relying on wifi connections to avoid the inconvenience of connecting wires to everything.

When I think more about it, I'm pretty sure many consumer grade wireless routers have guest network features built in that do exactly this when you plug in the WAN on their WAN port and the rest of the network on the LAN ports. But if you are adding custom features, something like pfSense is the way to go.

Improve this answer
1

The only solution I can see (and this is not as secure as a separate network) is to configure the router to force any data off your AP port to the internet, disallowing interplay. This may still be by-passable with a spoofed hardware address. The risk could be lessened somewhat with access to the firmware.

Deployment could be simplified by:

a) Shipping out new routers with the correct configuration
b) (Depending on how much access to firmware you have) Roll out an update to your routers

Maybe not the best solutions, but better then nothing.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .