4

I am looking for a way to grant access to a secured WiFi network, based on certain external information?

For example, some server on the internet could store MAC addresses that ought to be granted access, in addition to MAC addresses stored in router itself.

Or, access to WiFi network is password protected, but it will be granted if password supplied by newly connected device matches one of the passwords contained in a dynamic list.

The idea behind this question is the following: I have WiFi with flat rate plan. I should not resell it, but I can share it with friends and family, when they pay me a visit.

Now, I would be willing to allow access to an unknown "visitor" which happens to be within the range, provided he does the same with his WiFi. If there are enough like-minded individuals within an area, I could get access to free internet at many more spots.

However, this should work automatically, should not incur any costs on new participant, and should end its participation X days after he ceases to provide free internet to others.

Are there any security concerns? I am aware that this is still somewhat a general question, and pointing me into the right direction how this could be achieved would be great help!

Thanks!

3

You can use WPA-Enterprise with a RADIUS Server for authentication. If you want to implement these exotic methods you mentioned, look for existing RADIUS policies that fit your needs or write your own. http://freeradius.org/features/policy.html

  • This sounds like right way to go. Would it grant access to all those authenticated by RADIUS Server in addition to those authenticated locally? – Dex May 26 '14 at 13:45
1

There are numerous methods to achieve what you are talking about. You do NOT want to use MAC address, these can be spoofed. You either want to assign a certificate or some other credential, and ensure you control the enrollment process.

Using Network Access Control mechanisms, you can restrict access to authorized users, those with certain system settings, etc.

Your question is a little high level, so you may want to put in some more specifics or the use scenario. A good place to start would be by looking into 802.1x and Network Access Control and/or Network Admission Control

  • You are right, MAC addresses should not be used. I read the articles you cited, and they are very informative. – Dex May 26 '14 at 13:46
1

You might want to take a look at the term Wireless_community_network which expresses a similar intend like your question. One of the most known is Freifunk which is a big non-commercial organisation with about 20,000 access points. A commercial version which requires the user to also share his wifi or to pay is the commercial organisation FON but the legal status is questionable since most ISPs do not allow commercial reselling.

I am not affiliated or anything else with any of theese organisations and never used them but only put them in as example for further research and cannot say anything of their fitness for any particular purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.