iptables and wifi access point

iptables and wifi access point

[Jason]

Hi all, this is my first time writing here.  Here goes.

I'm setting up an accesspoint with a redhat9 box and a prism 2 netgear
wifi card.  The box has the wifi adapter and two wired nic adapters.
The wifi is for the access point and all the clients that will connect
to it, one nic is for the dsl, and the other is for wired machines on
the network.

I wanted to use iptables and cbq {i think} for routing/firewalling and
bandwidth limiting and shaping.  If anyone has done this before and
maybe has sample config files, or if you know any good docs to read
please point me in the right direction.

I want to make the network as secure as possible and as accessable as
possible.  Sorry for asking such a broad question, I'm just hoping that
someone has done this already, or someone might have some ideas for me.

TIA,
Jason

Re: iptables and wifi access point

[Arnt Karlsen]

On Sun, 27 Jul 2003 15:59:56 -0400, 
Jason <arnjuka@optonline.net> wrote in message 
<3F242F3C.9D1E2BEA@optonline.net>:

> Hi all, this is my first time writing here.  Here goes.
> 
> I'm setting up an accesspoint with a redhat9 box and a prism 2 netgear
> wifi card.  The box has the wifi adapter and two wired nic adapters.
> The wifi is for the access point and all the clients that will connect
> to it, one nic is for the dsl, and the other is for wired machines on
> the network.
> 
> I wanted to use iptables and cbq {i think} for routing/firewalling and
> bandwidth limiting and shaping.  If anyone has done this before and
> maybe has sample config files, or if you know any good docs to read
> please point me in the right direction.
> 
> I want to make the network as secure as possible and as accessable as
> possible.  Sorry for asking such a broad question, I'm just hoping
> that someone has done this already, or someone might have some ideas
> for me.

..http://shorewall.net/ ,  http://lartc.org/ ,  http://webmin.com/ ,
my http://fmb.no/ipcop/setup-cbq-0.0.4.tar.bz2 really needs a gui.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

RE: iptables and wifi access point

[George Vieira]

1. Security = Forget WEP (or even 128bit WEP.. it sucks.). Use IPSEC tunnels over wifi.
2. You can setup the wifi cards ethernet name to be anything, ie wifi0 or eth10. Makes scripting easier.
3. DO NOT USE MAC FILTERING... Wifi can easily be spoofed mac addresses hence the reason for number 1 above.
4. Remember in some/most/all countries that subleasing internet access is illegal without a carrier license (it is in Australia, dunno about anywhere else)..


Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au
 

-----Original Message-----
From: Jason [mailto:arnjuka@optonline.net]
Sent: Monday, July 28, 2003 6:00 AM
To: netfilter@lists.netfilter.org
Subject: iptables and wifi access point


Hi all, this is my first time writing here.  Here goes.

I'm setting up an accesspoint with a redhat9 box and a prism 2 netgear
wifi card.  The box has the wifi adapter and two wired nic adapters.
The wifi is for the access point and all the clients that will connect
to it, one nic is for the dsl, and the other is for wired machines on
the network.

I wanted to use iptables and cbq {i think} for routing/firewalling and
bandwidth limiting and shaping.  If anyone has done this before and
maybe has sample config files, or if you know any good docs to read
please point me in the right direction.

I want to make the network as secure as possible and as accessable as
possible.  Sorry for asking such a broad question, I'm just hoping that
someone has done this already, or someone might have some ideas for me.

TIA,
Jason

Re: iptables and wifi access point

[Arnt Karlsen]

On Mon, 28 Jul 2003 08:04:18 +1000, 
"George Vieira" <georgev@citadelcomputer.com.au> wrote in message 
<09B04A55822EFF4DA48D2E0BB2941D4A15BFD0@wardrive.citadelcomputer.com.au
>:

> 1. Security = Forget WEP (or even 128bit WEP.. it sucks.). Use IPSEC
> tunnels over wifi. 

..ok, a dumb question: which tunnelling gives best signal security 
per cpu omph expenditure?

> 4. Remember in some/most/all countries that subleasing internet
> access is illegal without a carrier license (it is in Australia, dunno
> about anywhere else)..

..huh?  I thought it was the isp's who put stuff like that in 
their service contracts?  
(Usually to protect their own network and business.)

..and, logging _is_ wise, so you can show "who did what when", 
whenever the cops etc get nosy.  

.._after_ they produce the search warrant, of course.  ;-)

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

RE: iptables and wifi access point

[Cedric Blancher]

Le lun 28/07/2003 à 00:04, George Vieira a écrit :
> 1. Security = Forget WEP (or even 128bit WEP.. it sucks.). Use IPSEC
> tunnels over wifi.

It's better than nothing. I would say "do not have your secrity rely on
WEP". WEP sucks, that's a fact, but it introduces an authentication
scheme (i.e. have the right key to access network) that frightens most
of script kiddies.

> 3. DO NOT USE MAC FILTERING... Wifi can easily be spoofed mac
> addresses hence the reason for number 1 above.

Same than above. Yes, you can abuse easily this kind of security
setting, but it does not mean you do not have to use it. And you forgot
to mention BSSID broadcast disabling in beacon frames.

You have security features in WiFi that are not efficient enough to
bouild your security on top of them. But using them can make 90%
wardrivers to skip your AP just because they're activated.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE