Wifi : Allow internet but block acess to local network?

[Eusebe_]

Hello guys,

I come here because I'm a bit blocked to answer a question.
I'm in internship in an entreprise, and I need to deploy Wifi with some access point.

The main goal is to have 3 AP in three different parts of the entreprise. So every employee can connect everywhere with the same password (and later, deploy to other office not located here).

But, we want to allow too some clients who are coming into the office for a short period, to access to internet but not to see the different computers in the local network nor to access them by IP or something.

I have at my disposal for testing phases 2 Netgear WN2000RPTv3 and 1 Linksys WAP610N, but they seems not supporting the thing we want with the ideas we got.

So I search a lot but the solution I found are not user friendly, we need to modify the client computer so he only have internet but not LAN access, but it's not what we want.

Here what I'm thinking, tell me if I'm doing it wrong or if you know how to do that, thanks by advance

-Give the client a username into the domain but block everything else? But to me he cannot get to his file or something, don't know...

-Take one of the AP for the client only, but how block local network? In my settings of the AP if I don't use my gateway internet don't work, but with it we can access to everything.

-Setup a guest network (I don't know this type of network I never use it before, but maybe this should solve my problem), but the AP we have can't provide this.

Finally we want to set a daily random generate password so we can give it to the client, but first I need to fix this "local network" thing...

So, do you know a way to block the LAN network but the WAN? They are on Windows Server 2008 R2.

Thanks by advance if you could bring some clues to me!
Eusebe

P.S: This is an old AD on the WS2008 and an old user management, but we are gonna do a cleanup and allow only the employee to access these files, and not everyone who access the network...

 

[bill001g]

You now are at why enterprise equipment costs more money. They have features like those you require. Small business and home users have no need for those features and to cut cost the consumer equipment is cheaper.

You can not protect the lan from users on wireless when it is the same network. Once they get on the wireless they have access to the lan, you can of course restrict access to the servers but that is a bandaid. You need to have a totally separate guest network.

The way this is commonly done is to use vlans to get the guest and business lans separate. The AP would assign the guest users to 1 vlan and the employees to the other. You still need switches that support vlans to keep this stuff seperate as well as a router than can take multiple networks and restrict the traffic to only go to the internet.

You will not find any of this type of equipment at the home electronics stores. If you know what you are looking for you can of course buy from amazon etc. Mostly your problem is understanding the design which requires networking knowledge. You can look at ubiquiti as one example of equipment that is between the high end enterprise stuff cisco sells and consumer grade equipment.

Since you have a domain server I would not use common passwords for your employees these get shared with unauthorized people too often. I would use enterprise mode in the AP and have them use their domain ids and unique passwords. You can even load certificates to employer owned equipment to keep unauthorized devices off even from employees.

Guest users are a pain and employees will use the guest user network if they plan to do bad things especially when they know they have to use their own id get access via the business network. There are expensive systems to do this but what is generally done when there are not a huge number is to add guests to the domain server with no access to the domain itself and still force them into the guest vlan. You then have unique tracking information for everyone using the internet. It is really bad when you can not trust employees/guests to resist the urge to download illegal content while they are at work.

 

[Eusebe_]

Thanks a lot for your answer!
I will look at Ubiquiti equipment but for now I think I'm gonna rework the AD so the access files are not public anymore, but only accessible if you are in the domain.
And yeah, add some guest account with a lot blocked.
You seems experimented with pirate customer, it's my very first experience in entreprise so I don't know yet how customers are, we will see ^^

 

[bill001g]

Thanks a lot for your answer!
I will look at Ubiquiti equipment but for now I think I'm gonna rework the AD so the access files are not public anymore, but only accessible if you are in the domain.
And yeah, add some guest account with a lot blocked.
You seems experimented with pirate customer, it's my very first experience in entreprise so I don't know yet how customers are, we will see ^^

Customers...ya sure. You see how many employees get themselves fired for downloading illegal content. The FBI even came looking for someone who was posting child porn though the guest network.

 

[Eusebe_]

Well, for "customer" I mean "employee" too ofc