Not able to block PING to an AP
-
Moving the AP to another subnet only forces the clients to go over the firewall because they don't "know" the direct path to the AP.
If someone sniffes traffic and see that the AP is on a different subnet, there is no stopping them from changing their IP into the subnet of the AP and access it. -
Ohh ok I see, except I create a Subnet just with two hosts possible :)
There were are discussing about, is there a way on Psense to force the clients to retrieve their IPs over the DHCP sothat no one can add manually an IP? -
That's not possible in networking.
You can not control the computer of anyone connecting to your wireless network. -
There are switches that can snoop DHCP and will drop traffic from any IPs not leased from a trusted DHCP server.
Everything OP is talking about is better accomplished at layer 2 (ie not in pfSense).
-
are you wanting to stop people from the wired network the ap is connected to or the wireless network if they connect to the AP wireless network? With a real AP the management interface would be on different network that the wireless ssids. Be it the management is the native vlan without tagging, and ssids tagged or with management and ssids all in their own tagged vlans.
This would allow you to prevent access to the AP management interface be it a gui, ssh, ping etc..
From the wired side nobody should be able to access this wired network that would not be authed either with 802.1x or just physical security to the network were no ports on that network are in open areas, etc.
-
Thanks,
but you are talking about a "a real AP the management interface".
For now, I'm just using a self-made-AP with Raspiberry. Also I'm not familar with creating VLANs within Pfsense. can someone guide me please ? -
your AP is a raspberryPI? What wireless did you connect to it? What OS are you running? Why would you do that? When you could use any wireless router as an AP. They can be had for 20$ that I would have to assume would blow away the usb wireless that you could add to a raspberryPI box..
I can understand not having the budget/money for an enterprise class AP.. Can your home made pi AP do vlans, what OS is is running Raspbian, Pidora, Risc, Arch, other??
Enable firewall and block it on the AP would be your other option.
-
Yes RaspberryPI. It's for home and also for a miniproject at the school. So we need to do it byself :)
Raspbian is running on.
So you mean create rules in Raspbian right ? I though also about it, but I don't which rule to write or which rule will correspond to that ? Meaning blocking Pings etc.. to the AP. on this Raspi, I have also apache server. -
here is simple guide on setting up firewall on raspbian
http://www.heystephenwood.com/2013/06/setting-up-firewall-on-your-raspberry-pi.html
Setup rule to only allow your management IP to ping (icmp) to ssh and if your serving up the gui for the AP in apache then block all but your IP, etc.
-
A good login/Pass on the AP would do the trick ? :)
Seriously, while in the same subnet (thus not firewalled) everything happens locally into that subnet. You should protect your AP with its built-in options : AN option like "block admin / management from Wireless side" "Block wireless management" often populate APs for that reason.
And yes, you should concider a dedicated subnet for your WLAN subnet. Do not bridge it if you want to use PFSense features.
-
Hi Guys,Thanks for your advice !
