Robby Workman <(E-Mail Removed)> wrote:
>On 2005-12-12, Floyd L. Davidson <(E-Mail Removed)> wrote:
>>
>> I'd suggest looking for a Linksys WRT54G, perhaps on on eBay.
>> The older (version 2 or 3) models were going for $40 a few
>> months ago, and there is a whole new version on the market now,
>> so I'd expect they are even cheaper. The latest models go for
>> $60-$80, so that is an option too.
>>
>> It's almost a plug and play to set one up. You get a full
>> fledged (Linux based) firewall and a four port switch for wired
>> access plus 801.11g wireless if you want it (laptop, print server,
>> whatever).
>
>Seeing as how they're Linux-based, I'm guessing that this is possible,
>but I've never used one (my router is an old Pentium box), so I'm not
>sure - does the router treat each port like a separate interface? In
The stock firmware from Linksys does not allow that. But for
versions 2 and 3 various third party firmware is available which
enables it.
>other words, does it allow one to completely isolate the boxes hooked
>in via cable from those connected wirelessly?
Even with the stock firmware there is a way to do that though!
Just buy two of them, and use one as the firewall to the
Internet, but with the wireless disabled. The other one should
have the wireless turned on, and have a LAN port connected to a
LAN port on the first one. The trick then is to put the
wireless on one subnet and the LAN ports on a different subnet,
and route *both* of them to the Internet port (which is unused).
Hence everything on the wireless will be seen by all wireless
clients, and everything on the 4 LAN ports will be seen by
anything connected to any of them (because it is a switch). But
the routing between the two of them will be disrupted because
all packets to either subnet will *only* be routed to the
Internet port... thus being dumped in the bit bucket.
The hard part is figuring out how to use the HTTP interface to
set up routing.
And regardless of the fact that it can be done, it is a waste of
time compared to just downloading DD-WRT firmware which allows
logging into the router and doing it the easy way.
>Something like DROP
>everything from $WIRELESS_IF except those packets going to $INTERNET ?
>
>I guess what I'm asking is: is this possible?
>
> iptables -A FORWARD -i $WRLS_IF -o $NET_IF -j ACCEPT
> iptables -A FORWARD -i $WRLS_IF -j DROP
>
>Perhaps I should by one just to play around with it...
I picked up a couple of them new originally, and had so much fun
that I bought another pair of used ones on eBay. The used ones
were perfect, and cost me $40 each last spring. Great
toys... :-)
--
Floyd L. Davidson <http://www.apaflo.com/floyd_davidson>
Ukpeagvik (Barrow, Alaska)
(E-Mail Removed)