Wired Firewall for limiting access

[joshuab]

Hello all!

I need to limit access on a wireless access point so it can not access other LAN resources. Simply using another subnet doesn't seem to work. I decided I need to use a firewall for this. One with a public LAN port and private LAN port. I can't find one! The ones I find are over $200+. Simple 4port router/fw/switches are all over for $30! Why can't I find a simple device to restrict access to say, only port 80 without breaking the bank!? Thank in advance to any suggestions.

[mjc]

Well...yeah, what you want is usually found in 'business' class or better equipment, not your average 'home' models. Therefore, the major $$$$.

But, if you have a spare computer collecting dust (doesn't have to be anything fancy...about a 500 MHz PIII class machine with about 128 MB of RAM, a hard drive, optical drive and room for at least two NICs), you can run something like this (http://m0n0.ch/wall/) or this (http://www.clarkconnect.com/). Even something like this (http://www.publicip.net/) may be helpful.

[jlreich]

If you want to run a dedicated machine as a firewall with a separate LAN for wireless you will need three NIC's.

That being said, if you just want a simple method of keeping the wireless out of your wired LAN just change the workgroup name on one or the other. That will keep them from accessing one another.

But if you want true protection yes you need to run a dedicated firewall with separate NIC's for each LAN. Which as MJC indicated is pretty easy, doesn't require a fast machine, and many are free. I use IPCop and have it running very nicely on an old socket A machine. It ran OK with 128MB ram, but after I added another 128MB it runs very smooth with zero swap space usage.

I am thinking of trying something other than IPCop since I have been having trouble keeping a valid IP address with my wireless LAN and have had to resort to adding it to my wired LAN in order for it to work correctly. But then again I need to go through some of the documentation and/or ask about my problem in their forums. It could very well be I am missing something simple. ;)

[yawningdog]

There is a Knoppix variant called Knoppix STD. It runs a firewall tool called firestarter. I've no experience with it personally, but it might be worth checking out.

[mjc]

The last link I posted, the one for publicip.net, the ZoneCD is a bit more than a firewall...it is basically able to set up a WIFI hotspot or Internet cafe...or more. I've tinkered with it a little, but it was/is overkill for what I was wanting.

What a router is, basically, is a switch with an embedded computer in the box...most often they are running a 200-500 MHz CPU, a few MB of RAM and a highly modified linux kernel.

Also, there is a chance that you may be able to do what you want with a Broadcom chip based 'consumer' model, if you switch to something like http://openwrt.org/...there are all sorts of addons/pluggins you can use to modify the basic capabilities of it.

[Variable]

Change the wireless lan to another network.
One is 10.1.1.x and the other is 192.168.x.x.

[bassman]

I guess I am missing something here. Are you trying to prevent desired AP from accessing other AP's/Routers, or are you trying to prevent resources using this AP from accessing other resources? Or even another network?
In either case, changing your AP's IP range should work, (as stated by Variable )
Please clarify what restrictions you are trying to achieve and we can go from there ;)