Setting Up Wireless Access In A Cafe while protecting my network

Hello,

I have a small cafe with an office in the back. We have a linksys
wireless router. Currently, all of the computers in the office and
cafe are accessing the internet and each other through the router -
small network.

I would like to offer free wireless service in the cafe to my
customers through my existing service. The problem is that I don't
want them to be able to access my network. Is there an easy way to
setup a second access point that taps into the primary router, but
only allows the connection to get to the internet?

Thank you very much
Mal

On 10 Aug 2004 13:11:13 -0700, (E-Mail Removed) (MalNSF) wrote:

>I have a small cafe with an office in the back. We have a linksys
>wireless router. Currently, all of the computers in the office and
>cafe are accessing the internet and each other through the router -
>small network.
>
>I would like to offer free wireless service in the cafe to my
>customers through my existing service. The problem is that I don't
>want them to be able to access my network. Is there an easy way to
>setup a second access point that taps into the primary router, but
>only allows the connection to get to the internet?

I posted some methods in the distant past. See:
http://www.google.com/groups?selm=ok...7v2o%404ax.com
http://www.google.com/groups?selm=sg...0u2t%404ax.com

Not a 2nd "access point" but perhaps a 2nd "wireless router". The
easiest and most expensive way is to arrange for a 2nd IP address
from your ISP. Both IP's go through the DSL or cable modem, which
then goes to a cheapo 4 port ethernet switch. From there, they go to
your two routers. Neither LAN on each router can see the other.

If two IP's are deemed excessive, then put the two routers in series.
Something like:


/----\ /----\
== DSL ====| |======================| |====
Modem | |=== 192.168.0.xxx | |==== 10.0.0.xxx
| |=== | |====
| |=== Office LAN | |==== Coffee Shop
| | | | Network
\----/ \----/
Router #1 Router #2
Wireless 192.168.0.xxx Wireless 10.0.0.xxx
for office LAN for coffee shop

I'm not really sure which network should be the coffee shop and which
the office LAN. Probably the way I drew it because it's fairly easy
to monitor and sniff the coffee shop network at the office LAN router.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831.336.2558 voice http://www.LearnByDestroying.com
# (E-Mail Removed)
# 831.421.6491 digital_pager (E-Mail Removed) AE6KS

Jeff Liebermann <(E-Mail Removed)> wrote:

> /----\ /----\
> == DSL ====| |======================| |====
> Modem | |=== 192.168.0.xxx | |==== 10.0.0.xxx
> | |=== | |====
> | |=== Office LAN | |==== Coffee Shop
> | | | | Network
> \----/ \----/
> Router #1 Router #2
> Wireless 192.168.0.xxx Wireless 10.0.0.xxx
> for office LAN for coffee shop

> I'm not really sure which network should be the coffee shop and which
> the office LAN. Probably the way I drew it because it's fairly easy
> to monitor and sniff the coffee shop network at the office LAN router.

I would rather have the Coffee Shop be the first router.
That would have the Office router connected to the Coffee shop, but
protected by NAT from the coffee shop. Wired your way, isn't the office
traffic on the "public" side of the coffee shop router, and easily
accessible?

--
---
Clarence A Dold - Hidden Valley (Lake County) CA USA 38.8-122.5

Like as been said before get a second wireless router, B wireless routers
are cheap, get a cross over cable plug the new router in to the old. Give
the new router a different SSID and channel number and different IP number
and enable auto DHCP, no WEP or WPA. On your existing router enable MAC
filtering. and WEP or WPA.


"Jeff Liebermann" <(E-Mail Removed)> wrote in message
news(E-Mail Removed)...
> On 10 Aug 2004 13:11:13 -0700, (E-Mail Removed) (MalNSF) wrote:
>
> >I have a small cafe with an office in the back. We have a linksys
> >wireless router. Currently, all of the computers in the office and
> >cafe are accessing the internet and each other through the router -
> >small network.
> >
> >I would like to offer free wireless service in the cafe to my
> >customers through my existing service. The problem is that I don't
> >want them to be able to access my network. Is there an easy way to
> >setup a second access point that taps into the primary router, but
> >only allows the connection to get to the internet?
>
> I posted some methods in the distant past. See:
>
http://www.google.com/groups?selm=ok...7v2o%404ax.com
>
http://www.google.com/groups?selm=sg...0u2t%404ax.com
>
> Not a 2nd "access point" but perhaps a 2nd "wireless router". The
> easiest and most expensive way is to arrange for a 2nd IP address
> from your ISP. Both IP's go through the DSL or cable modem, which
> then goes to a cheapo 4 port ethernet switch. From there, they go to
> your two routers. Neither LAN on each router can see the other.
>
> If two IP's are deemed excessive, then put the two routers in series.
> Something like:
>
>
> /----\ /----\
> == DSL ====| |======================| |====
> Modem | |=== 192.168.0.xxx | |==== 10.0.0.xxx
> | |=== | |====
> | |=== Office LAN | |==== Coffee Shop
> | | | | Network
> \----/ \----/
> Router #1 Router #2
> Wireless 192.168.0.xxx Wireless 10.0.0.xxx
> for office LAN for coffee shop
>
> I'm not really sure which network should be the coffee shop and which
> the office LAN. Probably the way I drew it because it's fairly easy
> to monitor and sniff the coffee shop network at the office LAN router.
>
> --
> # Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
> # 831.336.2558 voice http://www.LearnByDestroying.com
> # (E-Mail Removed)
> # 831.421.6491 digital_pager (E-Mail Removed) AE6KS

On Tue, 10 Aug 2004 22:43:18 +0000 (UTC),
(E-Mail Removed) wrote:

>Jeff Liebermann <(E-Mail Removed)> wrote:
>
>> /----\ /----\
>> == DSL ====| |======================| |====
>> Modem | |=== 192.168.0.xxx | |==== 10.0.0.xxx
>> | |=== | |====
>> | |=== Office LAN | |==== Coffee Shop
>> | | | | Network
>> \----/ \----/
>> Router #1 Router #2
>> Wireless 192.168.0.xxx Wireless 10.0.0.xxx
>> for office LAN for coffee shop
>
>> I'm not really sure which network should be the coffee shop and which
>> the office LAN. Probably the way I drew it because it's fairly easy
>> to monitor and sniff the coffee shop network at the office LAN router.

>I would rather have the Coffee Shop be the first router.
>That would have the Office router connected to the Coffee shop, but
>protected by NAT from the coffee shop. Wired your way, isn't the office
>traffic on the "public" side of the coffee shop router, and easily
>accessible?

I dunno. I don't think the 192.168.0.xxx network is accessible from
the coffee shop because the default route will send literally every
packet to the office LAN router at 192.168.0.1. If I specify one of
the other machines by IP address (from the coffee shop side), it will
still go to the router. However, I've been in the sun for 5 hours
working on my truck and my brain is not running at peak efficiency.

Here's a web page with exactly the same arrangement. If they sayeth
it worketh, then far be it for me to disagree.
http://www.publicip.net/index_sub.ph...&from=hotspots
(When it doubt, hide behind authority and whatever Google can find).

What kinda goo is good for plugging a hole in the side of a car
battery?

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831.336.2558 voice http://www.LearnByDestroying.com
# (E-Mail Removed)
# 831.421.6491 digital_pager (E-Mail Removed) AE6KS

Jeff Liebermann <(E-Mail Removed)> wrote:
> I dunno. I don't think the 192.168.0.xxx network is accessible from
> the coffee shop because the default route will send literally every
> packet to the office LAN router at 192.168.0.1. If I specify one of
> the other machines by IP address (from the coffee shop side), it will
> still go to the router. However, I've been in the sun for 5 hours
> working on my truck and my brain is not running at peak efficiency.

It would go into the router, but right back out to the appropriate IP,
methinks.

> Here's a web page with exactly the same arrangement. If they sayeth
> it worketh, then far be it for me to disagree.
> http://www.publicip.net/index_sub.ph...&from=hotspots
> (When it doubt, hide behind authority and whatever Google can find).

There-ya-go. Winner. Oops, there's a caveat in bold:
"The ZoneCD can be configured to block all network traffic to your *wired*
network. "

Of course, that's also a good reference page for the Original Poster.


> What kinda goo is good for plugging a hole in the side of a car
> battery?

JBWeld works on gel cell batteries and gas tanks ;-)


--
---
Clarence A Dold - Hidden Valley (Lake County) CA USA 38.8-122.5

On Wed, 11 Aug 2004 00:09:04 +0000 (UTC),
(E-Mail Removed) wrote:

>> Here's a web page with exactly the same arrangement. If they sayeth
>> it worketh, then far be it for me to disagree.
>> http://www.publicip.net/index_sub.ph...&from=hotspots
>> (When it doubt, hide behind authority and whatever Google can find).

>There-ya-go. Winner. Oops, there's a caveat in bold:
>"The ZoneCD can be configured to block all network traffic to your *wired*
>network. "

Well, there's always my favorite way. I use Freesco router
http://www.freesco.org
http://freesco.sourceforge.net/
http://www.freescosoft.com
with multiple ethernet cards on the LAN side. Each ethernet port goes
to an access point or router wired as an access point. Router is
centrally located with firewall rules using IPChains. I use old P133
machines and an ugly mix of ethernet cards.

>Of course, that's also a good reference page for the Original Poster.

Yep. I downloaded the PublicIP hot spot software, went through their
signup ordeal process, and then forgot about trying the software.
Oops.

>> What kinda goo is good for plugging a hole in the side of a car
>> battery?
>JBWeld works on gel cell batteries and gas tanks ;-)

I used ordinary epoxy. That worked well enough. Now to clean up the
mess it made of the battery shelf...


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558

"Christian" <(E-Mail Removed)> wrote in message news:<hqcSc.5668$oA5.2152@okepread05>...
> Like as been said before get a second wireless router, B wireless routers
> are cheap, get a cross over cable plug the new router in to the old. Give
> the new router a different SSID and channel number and different IP number
> and enable auto DHCP, no WEP or WPA. On your existing router enable MAC
> filtering. and WEP or WPA.
>
>
> "Jeff Liebermann" <(E-Mail Removed)> wrote in message
> news(E-Mail Removed)...
> > On 10 Aug 2004 13:11:13 -0700, (E-Mail Removed) (MalNSF) wrote:
> >
> > >I have a small cafe with an office in the back. We have a linksys
> > >wireless router. Currently, all of the computers in the office and
> > >cafe are accessing the internet and each other through the router -
> > >small network.
> > >
> > >I would like to offer free wireless service in the cafe to my
> > >customers through my existing service. The problem is that I don't
> > >want them to be able to access my network. Is there an easy way to
> > >setup a second access point that taps into the primary router, but
> > >only allows the connection to get to the internet?
> >
> > I posted some methods in the distant past. See:
> >
> http://www.google.com/groups?selm=ok...7v2o%404ax.com
> >
> http://www.google.com/groups?selm=sg...0u2t%404ax.com
> >
> > Not a 2nd "access point" but perhaps a 2nd "wireless router". The
> > easiest and most expensive way is to arrange for a 2nd IP address
> > from your ISP. Both IP's go through the DSL or cable modem, which
> > then goes to a cheapo 4 port ethernet switch. From there, they go to
> > your two routers. Neither LAN on each router can see the other.
> >
> > If two IP's are deemed excessive, then put the two routers in series.
> > Something like:
> >
> >
> > /----\ /----\
> > == DSL ====| |======================| |====
> > Modem | |=== 192.168.0.xxx | |==== 10.0.0.xxx
> > | |=== | |====
> > | |=== Office LAN | |==== Coffee Shop
> > | | | | Network
> > \----/ \----/
> > Router #1 Router #2
> > Wireless 192.168.0.xxx Wireless 10.0.0.xxx
> > for office LAN for coffee shop
> >
> > I'm not really sure which network should be the coffee shop and which
> > the office LAN. Probably the way I drew it because it's fairly easy
> > to monitor and sniff the coffee shop network at the office LAN router.
> >
> > --
> > # Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
> > # 831.336.2558 voice http://www.LearnByDestroying.com
> > # (E-Mail Removed)
> > # 831.421.6491 digital_pager (E-Mail Removed) AE6KS

Thank you very much for the help. I really appreciate your time and
effort. I will be in the cafe next week and will give it a try.