I'm working on my 1st shorewall setup.
It's running on a 2 ethernet interface box, with a VPN connection too.
Reading the copious docs I got all that working \o/
Now I want to add a USB WiFi interface that will be used for only one purpose
-- as an AccessPoint for guests to access the EXTERNAL internet only.
I want to just allow them to login in (using hostapd) and get to the 'net.
Hostapd + dhcp gives them a 10.128.128.##/24 address on login. Nothing else in
my LAN will ever use that segment.
I want them to completely bypass all my internal LAN infrastructure -- no
broadcast, no FW rules, etc. All firewall-ing, dns, etc. I want them to worry
about on their own -- and using external resources )e.g., NOT using my LAN dns).
I'd like to make sure that providing that access is a lightweight on my
shorewall as possible.
So I _think_ I need to set this up as a DMZ.
So far, just based on reading & examples, I added this to my shorewall config
hosts
wifi0 WIFI0_IF:10.128.128.0/24
zones
wifi0 ipv4
params
GUEST_WIFI0_IF=wlan0
interfaces
wifi0 WIFI0_IF
optional,physical=$GUEST_WIFI0_IF,dhcp,tcpflags,nosmurfs,logmartians=1,routefilter=1,sourceroute=0
Does that look about right? I'm not sure if that's "overdone or underdone" :-/
The examples I found all seem to integrate the wifi INTO the lan -- I'm trying
to make sure it AVOIDS the lan, and is just a "fast/lean pipe" to the net. The
"leave my LAN alone" part is what I'm most concerned about from a security
perspective. Not putting unneccessary load on my firewall would be nice too.
If the above is right, is there a MACRO that makes it simple for
rules
? Or is there a simple rule(s) that should do it?
Thanks,
DT
------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned
dictionary content that is easy and intuitive to access. Sign up for an
account today to start using our lexical data to power your apps and
projects. Get started today and enter our developer competition.
http://sdm.link/oxford
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
