Wireless Networks -- Security

Sully

Hey all,

I have setup a wireless network at home not just for our own use but for others to login and share the internet. We operate a guesthouse so we get many people coming over and wanting access to the net, so we offered them the wireless option. The WEP Key given to people to login is 27 characters (to long perhaps?) which they gotta type in. The reason why I added the WEP Key is to stop others from getting unauthorised access from the outside and trying to bypass security and get access to our files (and also to stop them using our internet connection so they get it for free!). Now, even with the WEP Key I cant share files between two PCs without others on the network having access.

Is there any tool which sets up which PCs on the network can see shared files? XP Pro had some feature to do this I believe, but I dont want to purchase it just for the sake of this one feature.

Is the key to long? Should it be shortened? If so, how short?

Could we get away with the key being removed anyway? Im a bit iffy on doing this tho..

Finaly, one guest was trying to login to the network today and strangely enough when he entered the WEP Key and Windows was connecting, nothing happened. It was like as if the key was accepted and he was connected. But Windows Network Icon reported him not being connected and the status box showed the network name, listed as being "Not Connected" but with an option to "Disconect" at the bottom left. Needles to say, Windows was liying saying he wasnt connected. He was, and could browse the web, check emails etc fine. He was Windows XP Pro and was using Norton AV (claimed he disabled it and it said the same thing). Why is this?

Hope someone can shed some light. Cheers

irlrobins

Moving to wireless forum

Foxwood

Sully04 wrote:

Hey all,

I have setup a wireless network at home not just for our own use but for others to login and share the internet. We operate a guesthouse so we get many people coming over and wanting access to the net, so we offered them the wireless option. The WEP Key given to people to login is 27 characters (to long perhaps?) which they gotta type in. The reason why I added the WEP Key is to stop others from getting unauthorised access from the outside and trying to bypass security and get access to our files (and also to stop them using our internet connection so they get it for free!). Now, even with the WEP Key I cant share files between two PCs without others on the network having access.

Is there any tool which sets up which PCs on the network can see shared files? XP Pro had some feature to do this I believe, but I dont want to purchase it just for the sake of this one feature.

By a second router. Plug this router into the existing router (you may need to change the subnet it is using). Then plug your own PCs into this second router. It will protect them from any connection coming from your guests computers.

It'll only cost you €50, and it'll be well worth it.

Is the key to long? Should it be shortened? If so, how short? Could we get away with the key being removed anyway? Im a bit iffy on doing this tho..

Yeah, it's too long. I'd recommend against using WEP anyway - interoperability isn't the best, and entering long keys can be a real pain in some clients. WPA is generaly more interoperable, easier to use, and works with everything except the oldest of hardware. Kep a spare USB key that supports WPA for anyone who has a Laptop that doesn't (and get a deposit).

Actually, you might want to look into FONero - http://www.fonero.com/. It's sounds like a solution in a box for what you're trying to do.

Finaly, one guest was trying to login to the network today and strangely enough when he entered the WEP Key and Windows was connecting, nothing happened. It was like as if the key was accepted and he was connected. But Windows Network Icon reported him not being connected and the status box showed the network name, listed as being "Not Connected" but with an option to "Disconect" at the bottom left. Needles to say, Windows was liying saying he wasnt connected. He was, and could browse the web, check emails etc fine. He was Windows XP Pro and was using Norton AV (claimed he disabled it and it said the same thing). Why is this?

Who knows. Unless your guests are paying for access to the network, I'd suggest that you don't get involved in technical support. If it works, it works. If it doesn't, just shrug your shoulders and say "sorry". If your guest makes any changes on your suggestion, and then encounters a problem next week, guess who is going to get the blame......

I'd also suggest that, if your ISP has a bandwidth monitor tool, that you should get in the habit of checking it.

Sully

The two PCs are in different buildings and are a good bit away from the WiFi Access Point & Router. So I cant "wire" the two PCs into it.. Is there no software solution to this?

Ill take a look at WPA as against to WEP but what do you mean have a USB ready -- what can that do?

Ill also take a look at FON.

Cheers

Foxwood

Sully04 wrote:

The two PCs are in different buildings and are a good bit away from the WiFi Access Point & Router. So I cant "wire" the two PCs into it..

So use a 2nd wireless router. Put it on a different channel to minimize interference.

Is there no software solution to this?

A softare solution (if it existed) would cost you more in time and effort than just sticking an extra router in place - especially if you can get a Fonero for €15 including shipping.

Ill take a look at WPA as against to WEP but what do you mean have a USB ready -- what can that do?

Someone with a crappy, 7 year old laptop that doesn't support WPA can borrow the USB wifi adapter if they desperately want to get online. It will support WPA, but it will be up to your guest to decide if they want to install new drivers.

rogue-entity

Ideally you would keep guests away from your "private" network, so putting your PCs on one network and having a seperate network for your guests to use would be a good idea, and you will need two routers to do this.

FON will supply you a router for (I think) a fiver and all you do is plug it into a spare port on your network and anyone connecting to it will see a login page. You can sell access or give it away for free.

If you have a spare PC (or you have a PC you can leave on the whole time) you can setup an optional proxy server and porn filter on it so you can log the activity of your guests (should they be taking advantage of your generosity).

So, if you go buy a spare router (PC World, Waterford sells the excellent Linksys WRT54G) here is how you connect the lot up:
Internet > Your existing router > Your new router.
You set your normal router to, say Channel 1 and give it a good strong WPA encryption and then connect your PCs to that network. Turn off SSID broadcasting and enable MAC Filtering* to deter casual sniffers too.
You set your new router to channel 6 or 11 (so they wont interfere), give it a good WPA password two, but leave SSID broadcast turned on so your guests can find the network easily.

Foxwood

rogue-entity wrote:

So, if you go buy a spare router (PC World, Waterford sells the excellent Linksys WRT54G) here is how you connect the lot up:
Internet > Your existing router > Your new router.
You set your normal router to, say Channel 1 and give it a good strong WPA encryption and then connect your PCs to that network. Turn off SSID broadcasting and enable MAC Filtering* to deter casual sniffers too.
You set your new router to channel 6 or 11 (so they wont interfere), give it a good WPA password two, but leave SSID broadcast turned on so your guests can find the network easily.

The "guest" router should not be plugged into a LAN port on router that your on PCs are plugged into. The router that the guests use should be the outside router, so that the NAT firewall on the router that you use for your own PCs is protecting you from your guests.