<div dir="ltr">I use the network perimeter firewall to isolate each network segment from the other. One segment each for:<div>WAN (OPLIN-provided)</div><div>LAN1 (library-owned staff computers)<br></div><div>LAN2 (library-owned patron computers)</div>
<div>WLAN (wireless access points for transient WiFi devices)</div><div><div>DMZ (for any on-site web servers)</div></div><div><br></div><div>I assign a full class C (/24) subnet to each network segment. Example:</div><div>
WAN: (OPLIN-provided IP address(es) )</div><div>LAN1: 10.30.1.x</div><div>LAN2: 10.30.2.x</div><div>WLAN: 10.30.3.x</div><div>DMZ: 10.30.4.x</div><div><br></div><div>By default there is no communication between the segments. Any necessary communication between segments is handled at the firewall with rules/exceptions.</div>
<div><br></div><div>This also facilitates a common point for http caching and content controls (filtering). The network perimeter firewall transparently redirects all outbound HTTP requests through the content filter (dans guardian) and then to the HTTP cache (squid) to locally cache common content, including such large bandwidth eaters like Windows Updates, and other common updates from other vendors. All network segments (except WAN and DMZ) benefit from the transparent caching, so even John/Jane Doe bringing their laptop in to do 300 Microsoft Windows Updates will mostly pull from the cache rather than sucking up half the library's Internet bandwidth.</div>
<div><br></div><div>Any captive portal you want to configure for the transient WLAN users, you can just slip into place between your access points and the network perimeter firewall. Or, with pfSense (the firewall I've been using lately), there is a captive portal available in the firewall. I haven't tried it yet, though, so can't yet speak to it's capabilities/limitations/effectiveness/etc.</div>
<div><br></div><div>Depending on the capabilities of your PIX or Zeroshell box, you could maybe leverage either of them in a similar way. I don't know much about the PIX and I don't know anything about Zeroshell, but a quick glance at its (Zeroshell) feature list makes it look somewhat similar in capabilities to pfSense or IPCop...or Smoothwall...or...(insert your favorite FOSS or semi-FOSS firewall here). With the appropriate configuration, it could probably handle the job.</div>
<div><br></div><div>HTH,</div><div>Chad</div></div><div class="gmail_extra"><br clear="all"><div>______________________________<br><b>Chad Neeper</b><br><font size="1">Senior Systems Engineer</font><br><br><b>Level 9 Networks</b><br>
<font size="1">740-548-8070 (voice)<br>866-214-6607 (fax)</font><br><br><font size="1"><i>Full LAN/WAN consulting services -- Specialized in libraries and schools</i></font><br></div>
<br><br><div class="gmail_quote">On Fri, Apr 11, 2014 at 2:43 PM, Fred Miller Jr. <span dir="ltr"><<a href="mailto:millerfr@oplin.org" target="_blank">millerfr@oplin.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt">Good Afternoon,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt">Wanted to reach out to other IT people on a new way of setting up our wireless. I would like to know the best way to separate our traffic (wireless vs. internal). Right now we have a cisco pix box that needs to stay in place due to our ILS and a linux program known as Zeroshell. Would like to get rid of the Zeroshell software, but still separate the traffic so patrons using wireless wouldn’t be able to get into our internal network. Any kind of information will be helpful.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal"><b><span style="font-family:"Times New Roman","serif";color:#e36c0a">Fred Miller Jr <u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman","serif"">IT Service Manager <u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:"Times New Roman","serif"">Auglaize County Public District Library <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman","serif""><a href="tel:%28419%29738-2921%20ext.1011" value="+14197382921" target="_blank">(419)738-2921 ext.1011</a><u></u><u></u></span></p>
<p class="MsoNormal"><a href="mailto:millerfr@oplin.org" target="_blank">millerfr@oplin.org</a><span style="font-size:11.0pt"> </span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">
<b><u><span style="color:#0322bd"><a href="http://auglaize.oplin.org/" target="_blank">Visit our Library Website!</a><u></u><u></u></span></u></b></p><p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt"> <u></u><u></u></span></p></div></div><br>_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
Search: <a href="http://oplin.org/techsearch" target="_blank">http://oplin.org/techsearch</a><br>
<br></blockquote></div><br></div>