• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

"Cafe" Wifi service

L

LoStMaTt

2[H]4U
Joined
Feb 26, 2003
Messages
3,180
I know this has been asked many times in this section of the [H] but I thought I would ask and be more specific.

I work for a restaurant chain and a couple of our locations wants to implement a WiFi system for the patrons.

I would like to have something similar to some internet cafe's and hotels where there is a TOA redirect you must "agree" to and also have some content filtering.

I always see suggestions of running RADIUS but I have no clue how to set something like that up.

Also, in each of the stores we already have internet which is used on the manager's station. We have a VPN set up (FVS114's with an FVX538 at the CO for endpoint).


I have experience with DD-WRT software but have never attempted to use their HotSpot utilities (can't figure out how to set them up).

So....with all of that taken into consideration what would you guys recommend?

I was thinking I could just set up a IPCOP box w/ Dansguardian or some other UTM but I would rather not have to set up another PC somewhere in the back to have to run 24/7 and have to be maintained when it breaks.

If there is some kind of appliance I could just plugin and be done with it that would be ideal.
 
Keep your two data networks seperate, thats all the advice i wish to give.

I suggest you contact your chains IT or MIS department to inquire about this.
 
k1pp3r said:
Keep your two data networks seperate, thats all the advice i wish to give.

I suggest you contact your chains IT or MIS department to inquire about this.
Click to expand...

I am the IT and MIS for this chain.

Heh.
 
You really have just two options (with some modification to them of course) in my mind...

To begin with you can either just throw up a DD-WRT WAP at each of the locations, QoS/Bandwidth limit the traffic so it doesn't hose your VPN and let it run. Of course you'll want a separate VLAN. This has the advantage of something you already know how to do however you get no login page and no content filtering, etc.

Otherwise you'll need to get a system that allows for some sort of authentication (ie RADIUS) with a system to manage that at each location in addition to a device which does your content filtering. This accomplishes what you want to do however at greater cost and time as you're not familiar with this.

How important is it to have the TOA and/or the content filtering? That will answer which way you can go.

There is a third option (but probably too expensive) which would be to get a vendor-based solution, I know Cisco does stuff like this with an appliance and some APs but it's not really cheap either.
 
I could throw up something without a TOA and content filtering but I have to protect the company from sue crazy people that would sue over seeing something offensive on someone's laptop.

I would use OpenDNS on the seperate Wireless but I already use that service to filter the internet for the manager's station (which basically has 99% of the internet blocked)....
 
M0n0Wall has the feature in it and runs on next to nothing. You just need a box with 3 nics in it. One to hook to your dsl/cable modem, one nic for internal traffice, one nic for a seperate wireless traffic arrea connected to an access point.

http://www.logicsupply.com/products/perimeter_b

I've used these before but I ordered the parts directly from them and built them myself. Throw in the 3 nic addon for it and it has 4 internal nics. I want to say when I built the last few I put a gig of ram in them(for future use) and used teh 512 usb flash disk(things use to come with a 256).

Nice thing about the case it is in is that you can screw it to a wall or something to keep it out of the way. Only moving parts are some fans.

I've never really seen shops really filter content but something like open dns could cover that for you.
 
swatbat said:
M0n0Wall has the feature in it and runs on next to nothing. You just need a box with 3 nics in it. One to hook to your dsl/cable modem, one nic for internal traffice, one nic for a seperate wireless traffic arrea connected to an access point.

http://www.logicsupply.com/products/perimeter_b

I've used these before but I ordered the parts directly from them and built them myself. Throw in the 3 nic addon for it and it has 4 internal nics. I want to say when I built the last few I put a gig of ram in them(for future use) and used teh 512 usb flash disk(things use to come with a 256).

Nice thing about the case it is in is that you can screw it to a wall or something to keep it out of the way.
Click to expand...

Same thing i was going to say but using pfsense
 
robertp221 said:
Same thing i was going to say but using pfsense
Click to expand...

pfsense should work fine on the little box I specd. Thing will take a 2.5 inch notebook drive if needbe as well.

They had a few capitive portal distros from single board computers but I haven't really seen much of them as of late.
 
to be honest i didn't read the whole thread, but if this is a small cafe, just pick up a router flash with tomato, get a 2nd ip from your isp, and run it off that.

if your talking a small place no real reason to have a radius server to make people olog in with user name and pass.
 
Yea I mean I don't honestly believe I will ever have more than 2-3 people using the wireless at once. I am already familiar with the linux distros that can "solve" my problem, except for I was trying to stay away from having to run a seperate computer to get it done.

I'd rather just have a router I can plug in, double nat it and be done with it.
 
LoStMaTt said:
Yea I mean I don't honestly believe I will ever have more than 2-3 people using the wireless at once. I am already familiar with the linux distros that can "solve" my problem, except for I was trying to stay away from having to run a seperate computer to get it done.

I'd rather just have a router I can plug in, double nat it and be done with it.
Click to expand...

...and again I ask: What is your budget per site?
 
LoStMaTt said:
Yea I mean I don't honestly believe I will ever have more than 2-3 people using the wireless at once. I am already familiar with the linux distros that can "solve" my problem, except for I was trying to stay away from having to run a seperate computer to get it done.

I'd rather just have a router I can plug in, double nat it and be done with it.
Click to expand...

Look at what I linked you. It is a very small box that is pretty much plug in and configure as they do everything.

A budget would help as well. Really you could do what I linked above with a sbc but the option I gave you doesn't cost much more and gives your more options for the future.
 
Cheapest solution, flash main router with DD-WRT, setup Vlan on one of the port. Add another wirless router/access point on that vlan and be done.

2-3 wifi users DOES NOT require captive portal, monowall, or 500 buck routers.
 
DD-WRT....check out the hotspot plugins it supports...ChileSpot and Sputnik. Captive portal features, content/rules, billing options, multi site management, etc.
 
why the need for hotspot stuff tho?

i have done this for a few of our clients, we just use one of the extra IP for the cable biz package, open network and let them have fun.

paying for wireless in a cafe = gayz.

they are already paying probably 6 bucks for a cofee let em look at some imagebeaver =)
 
marley1 said:
why the need for hotspot stuff tho?

i have done this for a few of our clients, we just use one of the extra IP for the cable biz package, open network and let them have fun.
Click to expand...

He didn't state if he wanted to charge or not. So this gives him the option of it if he wishes. He stated Captive portal, and content filtering...so he desires some sort of hotspot management software.

I'd also want something that had strong QoS features...so some kiddie doesn't walk in with his laptop and bury the network torrenting warez and free music/movies all day/all night.
 
marley1 said:
why the need for hotspot stuff tho?
Click to expand...

I put in a hotspot for a Family Entertainment Center 2 years ago. They do not charge for Internet usage, but they do want the users to sign off on terms of use before going online, and they wanted to make sure no one was downloading porn or torrenting on the service. The last thing they needed was some pervert looking at smut with little kids running around. Seems like a pretty good reason to me.

marley1, if you put a completely open system in a client of yours, don't be surprised if the IDSA comes knocking at their door when their IP comes up as a torrent abuser.
 
whats wrong with downloading a little porn or music will drinking coffee =)?

no one will come knocking at their door, its not like a user is going to sit in the construction or law office with their laptop and torrent away. they would have to park on the grass to even get hte signal.

way to serious!
 
Depending on the area, you'd be surprised how quickly an open hotspot becomes frequented by wardrivers. Esp if it's in a downtown-ish area.

For me it's not so much the knocking on doors from the RIAA, it's the fact that the leaching freeloading torrent brats crush the bandwidth and render the internet connection virtually useless for anyone else. Esp if he's going budget and using a home grade router with DD-WRT. And if he's VLAN'ing and sharing the same connection with the office internet...the office production work suffers. Dunno what his point of sales is, credit card auths, terminal servers, etc etc..but you don't want to kill that. Even if a totally separate router and internet connection...one would want it performing acceptably for normal customers.
 
The last few I did I went through and blocked pretty much every port other then some basics like http, https, vpn, various chat clients etc. Blocked everything then just opened select ports. Also blocked webconfig from the openwireless.

I don't like the idea of having a wide open connection and the OP said he wanted some more control over this. Spending a few hundred bucks to get a single board computer setup or something like I posted is a good idea.

I can't really comment on DD-WRT but for small loads that might be an option. I was under the impression that it would only work as an endpoint and needed a back in server/service to work correctly. As I said I haven't really looked into it so I can't comment.

One of are setups needed VPN but I used the same box.
 
yeah it really depends on location. im located in "the hamptons" so everything is small biz. places that want this dont are usually cheap and its not a huge load where these cheaper solutions can work.

sure it may not be idea for a city environment for a town like i am in are easy.

but anyway im bored and just typing away =)
 
DD-WRT is its own system, to replace the firmware complete that say Linksys has on their routers.
 
marley1 said:
yeah it really depends on location. im located in "the hamptons" so everything is small biz. places that want this dont are usually cheap and its not a huge load where these cheaper solutions can work.

sure it may not be idea for a city environment for a town like i am in are easy.

but anyway im bored and just typing away =)
Click to expand...

Have you looked at PC Engines?

alix2d3 board is like 131 bucks. Gives you a 500mhz cpu, 256 ram, 3 nics. Enclosure is like 10 bucks. AC adapter is less then 10 bucks. After that you need a compact flash card and a wireless access point. Under 300 bucks easy for a full setup that acts as a primary router and captive portal. I've used their older wrap boards in the past. In the grand sceme of things that is pretty cheap to get a capitive portal setup. Doesn't really do content filtering but open dns could handle that.

The one from logic supply is around 300 bucks. Need an access point. Same thing though overall a pretty cheap setup.

With either solution one could get an internal wireless card and save some cash but I don't usually do it this way. I put an access point out in a main area and the capitive portal gets thrown in the back somewhere with the dsl or cable modem. In a lot of cases it sits on the wall next to the managers computer and next to the server that handles the video poker(for places that have it)
 
marley1 said:
whats wrong with downloading a little porn or music will drinking coffee =)?

no one will come knocking at their door, its not like a user is going to sit in the construction or law office with their laptop and torrent away. they would have to park on the grass to even get hte signal.

way to serious!
Click to expand...

Way too serious? Wow. What an irresponsible comment to be made by someone who supposedly installs this stuff. How old are you? 12? YeOldeStonecat is quite correct. An open hotspot is just asking to be abused by someone clever enough to exploit it such as a wardriver.

Go back and re-read what the OP said. He wants to do a double-NAT behind his existing Netgear ProSafe router, which has an open VPN tunnel to his HQ. That in itself is a really stupid thing to do. If he were to create an open wireless hotspot sitting behind his existing equipment and someone with some knowledge gets access to that non-isolated unfiltered network, there is no telling what kind of damage could be done to the corporate network.

Marley1, there are plenty of ways to grant secured hotspot access that are inexpensive. I looked at an appliance a while back that was just under $500. I can't tell if you are kidding or not, but if you are really installing open unsecured hot spots for your clients, you are just asking for trouble.
 
Another thought for something to look at. Endian will do both content filtering and captive portal although I haven't messed with it. I think YeOldeStonecat has used it in the past though and would know more then me.

This would pretty much be a full pc install but it should be pretty much setup and forget other then updates from time to time.

They do make some hardware routers too but they are expensive. You could build something for a lot less.
 
i am actually 13. but i didn't bother reading the entire thread, way to much work on my own to read forums all day.

i wouldn't ever setup a onopen wireless, but some clients insist it, and i dont knwo how long you have been in business but the customer is alway right. lots of time they dont care if it will have problems in the long run, they want it done now and cheap. i am not going to turn away clients, i do what they ask me to, i give them my suggestsion if they dont want to approve it im not gonna cry i just do what they want.

if i was to do this, i wouldn't be using captive portal, i would get a 2nd ip from the isp, have a dedicate machine or router doing it and blocking as much as possible without affecting normal day users. i could care less at what the user does, i just satisfy what the client wants.

same reason clients still complain about the p2p networks in their office, when i suggest a full domain server the year before. but instead of putting hte money upfront they get random bills each month for little issues that would have been avoided =)

but this 12 year old has to get over to a clients and deploy bes in 30 minutes before they want to go drinking =)
 
"marley1 2[H]4U, 8.2 Years
i am actually 13."

Huh! So you joined the hard forum when you was 4?
 
yeah man i got into computers when i was a little kid. h4x0r the planet manG!
 
So it looks like the best thing for me to do is just pull in another cable modem and hook up the wireless on a completely seperate line.

From there I will set up a box with one of the many linux distros and have an access point attached to it.

Just wasn't looking forward to the extra $40 a month cable internet bill. Hopefully the wifi will draw in enough customers to make up for the monthly cost.
 
if this is a business you should have some sort of business cable dsl service, generally you can get multiple IPs through that. maybe thats a better option?
 
marley1 said:
if this is a business you should have some sort of business cable dsl service, generally you can get multiple IPs through that. maybe thats a better option?
Click to expand...

Yea but how would that work?

Do you connect your cable modem to a switch and then make sure each router has a static WAN IP assigned?

Cable modem > switch > router w/ IP #1 > switch > LAN 1

Cable modem > switch > router w/ IP #2 > switch > LAN 2

Edit:

If I double NAT and have LAN1 setup with 192.168.x.x/0

and have LAN2 set up with 172.16.x.x/0 won't that keep anyone from LAN1 messing with LAN2 and vise versa?

I wouldn't have to get a 2nd IP or purchase an additional switch.
 
pretty much you get a cable modem then you get a supplied router from your ISP (our ISP uses a Cisco), that thing has 4 ports on it, I run a cat5 from one of those lan ports to my device (router, computer, dvr, whatever). I program in one of the Static IP.

So what i do around here, is i use 1 ip for the local network. That goes into the firewall so the entire internal network is on a single static ip. Then if the client wants a hotspot that his clients can use to check email, i get a Buffalo Router, throw it on a 2nd ip and leave it open for them to do there emailing.

I am not a big fan of double natting, but you can deff try it out. Problem with that is they can still slow down your internal network. on my end if i beat on one of the IP that the ISP gives me the others dont get affected.

I know that because i live right about my office, i ran a line down and use one of hte 5 IP for my apartment, and i torrent everything =)

call your isp ask what it would cost to increase to a business plan and get a second IP, may be cheaper. then you can put any kind of router/access point you want on it. Can do a simple Linksys with Tomato and block/QOS everything you want. May want to block everything but HTTP and HTTPS. Could even use a simple DynDNS service to block some adult content or something of such.
 
You must log in or register to reply here.
Back
Top