How to allow only internet access to wireless clients?

We have Two computers, a wireless router and want to allow wireless
internet access.
How do we keep the wireless users out of the server and workstation?

"dbasedos" <rdglide03-(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
> We have Two computers, a wireless router and want to allow wireless
> internet access.
> How do we keep the wireless users out of the server and workstation?
>

You get a personal firewall/personal packet filter on the workstation and
block all LAN IP(s). (LAN IP(s) are those IP(s) that can be used or issued
to machines connected to the router wired or wireless. You set rules with
the PFW/PPF to block all LAN IP(s), except for the two machines on the LAN
you want to share resources with each other.

For the server, you'll need a server class software FW on that machine.

Here are some other tips to protect the Windows O/S from attack on the LAN,
assuming the machines are Windows XP, Windows 2K, Win 2K3. or Vista.

http://labmice.techtarget.com/articl...ychecklist.htm
http://www.analogx.com/CONTENTS/articles/ipsec.htm
http://www.microsoft.com/technet/com...mt/sm0105.mspx
http://www.microsoft.com/technet/net...y/ipsecld.mspx
http://www.petri.co.il/block_ping_tr...with_ipsec.htm

IPsec is on Vista Home Premium. I have not applied the AnalogX rules to
Vista, but that will happen soon for this laptop running Vista's FW on a
dial-up.

On 23 Apr 2007 05:11:34 -0700, dbasedos <rdglide03-(E-Mail Removed)>
wrote in <(E-Mail Removed) .com>:

>We have Two computers, a wireless router and want to allow wireless
>internet access.
>How do we keep the wireless users out of the server and workstation?

You need wireless-to-wired isolation, ideally by getting a wireless
router with that feature. (See hotspot routers in the wikis below.)

An alternative is to setup VLAN separation in DD-WRT firmware running on
a suitable wireless router platform.

Yet another alternative is to use three low-end (cheap) routers:

+----------+
| Wired |
| Router |
+--+----+--+
| |
+-----+ +------+
| |
+-----+----+ +-----+----+
| Wired | | Wireless |
| Router | | Router |
+----------+ +----------+

That puts everyone on "double NAT" which generally works well, although
it can break some (older) network apps.


This answer was cut and pasted from an earlier post to this newsgroup by
me. Your question is also answered in the wikis below. Please always
check to see if your question is already answered _before_ posting it.

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>