|
||||||||||
This sounds like a wonderfull idea! Makes it more 'plug and play' :-) no really, it sounds more userfriendly, and that's what m0n0wall is all about (I think) Joachim -----Original Message----- From: Magne Andreassen [mailto:magne dot andreassen at bluezone dot no] Sent: maandag 29 september 2003 3:52 To: 'mono' Subject: [m0n0wall] Securing that wi-fi network... Hi, Need to share some thoughts on wireless networking with m0n0wall. ;) Please comment(pros or cons) on this. WEP is, as we all know, pretty bogus. And i cant understand why people feel secure when using it. Of course it is more secure than running without, but if someone wants to, they can easy hack it. So what, you say? Well, if you are a bit paranoid like me, you like to have a little control over who is accessing your network, and since pretty much anyone can connect to your wireless network(if not properly configured), one should take his/her precausions. I would like to have some kind of encryption other/in addition to WEP for my wireless clients. I also want users connecting to my wireless network to authenticate themselves. Either to the bulit in PPTP service in m0n0wall, or since im running Win2000 Active Directory, to my windoze wannabe RADIUS service. I like the VPN feature of m0n0wall, and use it to connect via internet. So why not use it for wireless? One thing tough; DHCP is generally a bad idea on wireless networks, but i really want this since changing ip adress config on my windows 2k laptop is boring when roaming between school, work and home. I am aware that dhcp works on wireless interface in brigde mode(with LAN). Problem is that no filter rules apply in brigde mode. So what i am thinking: -DHCP on wireless interface. (not possible in m0n0wall(...yet)) -Enable PPTP server in m0n0wall. -Add some firewall rules on wireless interface: GRE Wireless net * * * - for VPN TCP Wireless net * * 1723 - for VPN UDP * 68 wi-ip 67 - DHCP UDP * 68 255.255.255.255 67 - DHCP UDP wi-ip 67 * 68 - DHCP And you are good to go! works like a charm :) Your wireless clients will now get a leased ip-address, but cannot connect to internet or your LAN, untill they authenticate to the PPTP service in m0n0wall. In windows, a simple setup of a new network vpn connection does the trick! Only thing needed to be done on m0n0wall, is adding DHCP for optional interfaces and maby include the above firewall rules into the filter.inc file. (or one could add these manually as i did). Does this sound like fun or not? Same effect can ofcourse be achieved with static ip-adresses, but i hate changing those ip adresses all the time! :) I will, if not anyone else is already looking into it, write the code for the dhcp on optional interfaces as soon as i get the time, and post a note to the list... Magne --------------------------------------------------------------------- To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch ----------------------------------------------- MISSION STATEMENT ----------------------------------------------- Oce enables its customers to manage their documents efficiently and effectively by offering innovative print and document management products and services for professional environments. ----------------------------------------------- DISCLAIMER ----------------------------------------------- This e-mail message and any attachment are intended for the sole use of the recipient(s) named above and may contain information which is confidential and/or protected by intellectual property rights. Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. If you have received this e-mail in error, please notify the sender either by telephone (0032-2-729.48.11) or by e-mail and delete the material from any computer. Oce-Belgium/Oce-Interservices is nor responsible for the correct and complete transfer of the contents of the sent e-mail, neither for the receipt on due time. This e-mail message does not bring about a contractual obligation for Oce-Belgium/Oce-Interservices. Thank you for your cooperation. For further information about Oce-Belgium/Oce-Interservices please see our website at www.oce.be ----------------------------------------------- |