Hopefully that got your attention! Thanks for taking the time to read. Basically I'm after some advice regarding wireless captive portal solutions.

Problem:

I have a small network of five servers (mixture of Windows SBS 2008, Windows Server 2003, and a few Linux ones) and a handful of clients. We're building a conference room on site and it would be great if I can implement a wireless network for staff and visitors to use as they deliver presentations. Obviously, I'm not a blithering idiot so I know that with wifi, security is paramount. Previously, I've set up some Cisco Aironets working with RADIUS/AD authentication which worked well but were a pain in the bum to configure on the clients. Obviously the way to go now is with a captive portal.

The main features I'm after are to allow authentication of network users through AD, and thus unrestricted access to LAN resources a la RJ45, and registration/login of guests/visitors which gives them limited access (perhaps only DNS and HTTP out). Ideally a code of the day would be a good feature to stop undesirables parking outside the office and leeching free Internet access.

I'm aware of PacketFence which can be configured to do the above through ARP injection or VLAN tagging etc, and a couple of other open source bits of kit that will do the job too. No doubt there's a few other Linux bits that can be wrestled into submission ninja style (e.g. squid/iptables) as well, but thought I would see what you guys recommend. I appreciate there are some very knowledgeable folk on here - no doubt someone has done this before.

Money isn't too much of an issue, just as long as it doesn't run into silly numbers. I'm confident in Linux and would prefer an open source solution where possible. I'm becoming more and more convinced that purchase of a Layer 3 switch is inevitable as well so I can handle routing between VLANs etc.

Any advice would be greatly appreciated - thanks.

Are you trying to make this more complicated than you need to?

I have just set up a separate network in our for another company who will be subletting some of our office space. They just need an internet connection and we have a draytek router which handles the internet so I set up a two vlans and connected a belkin router to one thus giving a separate wired/wireless internet connection. I plan on getting a second draytek to replace the belkin router.

Forgive me, but I don't see how am I making it more complicated? I'm aware I could just give them a simple Internet connection relatively simply, like the way you mentioned, but as per my original post I wish to have the facility to allow staff to access the PDC and other network resources as if they are connected by RJ45. As far as I am aware, this can only be done through VLAN tagging and then the relevant hardware (Layer 3 switch I presume)( routes between VLANs/subnets appropriately.

This is the bit I wanted advice with... whether this is the approach I need to go, if so a recommended Layer 3 switch, recommended software (e.g. PacketFence) to use and so on.

How about two wifi networks - one which connects to your current production network, and roll out the connection details via a GPO for those which need it, and a secondary wifi network (on a different vlan) which only has access to the internet (probably via a proxy to filter out the worst of the internet)

They just need an internet connection and we have a draytek router which handles the internet so I set up a two vlans and connected a belkin router to one thus giving a separate wired/wireless internet connection. I plan on getting a second draytek to replace the belkin router.

I could so this with a single Draytek - the 2820 supports multiple vlans, which you can pair up to different SSIDs and network ports on the router itself (if they want some degree of wired infrastructure too).

Hmm a good idea, thanks. I completely forgot about the simple, multiple SSID type config. Would I still need a complex Layer 3 switch to handle the routing between VLANs? Or I suppose I could directly connect the "public" VLAN to a NIC on a Linux box and just route limited traffic straight out to the web.

You mention rolling out the "private" SSID details out via an SSID - by this do you mean using a hidden SSID? Or some form of certificate based authentication?

Also, for the public SSID, how would you recommend keeping out unsavoury leeches who could potentially park outside with a laptop/iPad and steal our Interwebs?

I could so this with a single Draytek - the 2820 supports multiple vlans, which you can pair up to different SSIDs and network ports on the router itself (if they want some degree of wired infrastructure too).

The draytek doesn't do dhcp on teh network so adding an extra router was the easiest way to add dhcp.

To the OP, does anyone external need access to any resources beyond the internet? Using a separate vlan (with or without extra router) gives this without the complication. You could add a wireless access point for staff.

Also, for the public SSID, how would you recommend keeping out unsavoury leeches who could potentially park outside with a laptop/iPad and steal our Interwebs?

Use WPA (or whatever you prefer) and print the key on a piece of paper stuck to the wall in the conference room - used to do that one place I worked at.

Use WPA (or whatever you prefer) and print the key on a piece of paper stuck to the wall in the conference room - used to do that one place I worked at.

I suppose the simplest solutions are the best :p I could do this then rotate the key every week or so just to be safe.

The DrayTek Vigor AP800 looks sweet. It apparently supports an external RADIUS server so I should be able to provide AD authentication this way if I set up the SBS with RADIUS. I'll see if our existing Procurves support 802.1q VLAN tagging, and if so I can then split the traffic into two VLANs down the same wire, and put the public feed into a NIC in an Ubuntu box and proxy out all crud except core services. The access point also has that multiple LAN feature so if I can't get VLAN tagging to work I can just run two RJ45s to it and segregate at the switch that way.

IIRC I sure I have come across some routers/access points previously where you can control the power output on the wireless, thus limiting the range, which may be one way to avoid people in the car park trying to steal internet connections.

Our office is in a converted barn and the draytek is at one end of the office and you can't get a connection at the opposite end (some of the walls are 2 foot thick), which was another reason to add a second wireless access point for me.

mbames, I too have a 2820 and this was another reason I had to add more hardware.

I think what I'll do is add WPA key for the public SSID and change it periodically. I'll also use Squid to show a disclaimer splash screen with some terms etc.

One more thing to pick your brains with - power over ethernet. Is it a full "standard"? May be a stupid question, but can you interchange PoE injectors for example? Reason I ask is IIRC we have some old D-Link PoE injectors in the server room, and wondering if I could use one of them with the Draytek AP...

OK I can't sleep and I've been sketching on paper and I have a quick VLAN question I'm hoping someone can help me with. We run HP ProCurves (V1810-24Gs to be exact) which are simple, managed L2 24 port gigabit switches. They support some fancy stuff like VLAN tagging (802.1Q), STP etc. At the moment I have a flat network. My ultimate goal is to be able to run one cable from the wireless AP which has two SSIDs on it. It should be tagging traffic from each SSID, e.g. VLAN1 for normal traffic and VLAN2 for "dirty", guest traffic.

The set up, roughly drawn will be as follows:

Procurve

Ports 1-20 (normal traffic - VLAN 1)

Port 21 (Wireless AP - VLAN 1 + 2)

Port 22 (Ubuntu Box - VLAN 2)

IP Addressing (TBC)

Normal traffic - 10.10.0.0/21

Dirty traffic - 10.10.8.0/27

Would this be a viable option? Or is it not possible on a layer 2 device? I can't see a problem with it personally but thought I would check.

Hopefully I can then have a second NIC on the Ubuntu server and handle the dirty traffic with a transparent squid set up.

You'll be able to run that VLAN setup on your HP device, although it won't pass traffic between the VLANs (which I'm assuming you need so that guests can get limited Internet access?) so you'll need either another dot1Q trunk with both VLANs fed down it, or two cables to two NICs on a layer 3 capable device (i.e. another Linux box or a router, capable of VLANs and dot1Q trunks, etc). This extra device will handle passing stuff between VLANs.

Also be aware that sometimes HPs do "odd" things. I had a ProCurve 2524 recently with 2 gigabit modules. I split it into two (literally, one uplink and 12 edge ports per VLAN, with all other ports forbidden to join, no IGMP, etc) and yet even though it should have behaved like two separate, physical, unmanaged "dumb" switches, it was still losing packets. Didn't get time to look into it properly though as it was an "emergency" bodge on our live network, so just removed all the VLAN setup.

Hi gac thanks very much for taking the time to reply.

I don't plan on getting the ProCurve to do the routing for Internet traffic between the VLANs, instead I've got an IBM X server with a pair of NICs in - I'll have one on the normal network and one on the dirty VLAN port on the ProCurve. I'll perform all the (limited) routing and a basic captive portal prompt with Linux/squid. Call me dull (I'm a VLAN noob), but will the switch be able to manage the fact there has to be 2 VLANs on one port? (i.e. the feed with tagged traffic from the wireless access point)... I'm guessing then it will deliver VLAN1 tagged traffic to ports 1-20 and VLAN2 traffic only on ports 21 & 22?

Funny you should mention "odd" behaviour - I once had something very similar with Netgear switches (I know, not my choice to buy them in the first place) which had SFP slots for fibre modules. We were running a few GSM7224s and GS724Ts on site. For some reason a handful of them just out and out refused to talk to eachother over fibre. Some of the others would work fine but no light would show on the device. Really weird. My colleague spent hours on the phone to Netgear in USA and they were baffled too.

This is why this time I made sure I ordered ProCurve. I think ours have lifetime warranty anyway, but I'll certainly look out for the behaviour you mention. Luckily we have two identical switches, which should come in handy if something does behave weirdly as I'll be able to replicate between the two.

As long as the AP and the switch port it's on are configured for trunking correctly (preferably using 802.1q but if they're HP APs then there may be a proprietary alternative protocol) then it'll handle it fine; everything that comes from your AP on the clean SSID will be on VLAN1's broadcast domain, anything from the dirty SSID will be on VLAN2.

Great thanks for your help