Setting up public wifi hotspot with BT Business Broadband

[sorcerer]

Apologies straight away for a very long post

A friend runs a hairdressing and beauty salon and has decided that she wants to offer clients free wifi whilst they are in there. She signed up for BT Business Broadband and the service (ADSL2+) is now active, using the supplied BT Business Hub 3 (a combined ADSL modem/wifi router).

She has just one computer in the salon, a laptop, that holds all the employee and payroll-type stuff. Naturally, she wants to access the internet on that laptop now that they have broadband in the salon and, of course, she wants to do that wirelessly rather than wired, so keeping the 'private' and 'public' wifi networks completely separate from each other is an absolute necessity.

I have absolutely no experience in this aspect of our work, but I seem to remember reading somewhere that some business-class routers have two or more SSIDs on the wireless side, thereby making it a trivial matter to keep private and public networks separated - sadly, the BT Business Hub does not. In fact, to call it a 'business' hub would seem to be a bit of a misnomer because it seems to offer nothing over and above the BT Home Hub 3.

So, I dug out a Cisco/Linksys E2000 router that I'd bought many moons ago and installed DD-WRT on to play with, when computers were just a hobby of mine, in the days before I had to attempt to make a living out of them. I never did get to grips with DD-WRT and its gazillion settings and parameters that can be altered and adjusted, which is why the E2000 was languishing forgotten, in a dark area of the loft until now.

I'm currently having a play with it here at home (I've got a BT Home Hub) before setting it up at the salon and I need your thoughts and comments on what I've done and what I've found. It seems to work, but does it work correctly, or is there a better way of doing it that I don't know about?

The BT Hub is obviously the gateway and the Linksys sits behind it. As such, my idea is to have the BT Hub service the laptop on the private wifi network and the Linksys will provide the public wifi network. To that end, I used an ethernet cable to connect one of the BT Hub's LAN ports to the WAN port of the Linksys and I put the Linksys on a different subnet (192.168.2.xxx, whereas the BT Hub is on 192.168.1.xxx).

I thought about giving the laptop a static IP address but decided against it in case they take it away from the salon to use elsewhere, so I currently have DHCP turned on, on both routers and it doesn't seem to cause any problems - but is it OK to do this?

I've switched on 'AP Isolation' on the Linksys so that wifi clients on the public network can't connect to each other. Using 'Fing' network scanner on my iPhone, when connected to the Linksys router it only sees devices with 192.168.2.xxx addresses - when connected to the BT Hub, it only sees 192.168.1.xxx addresses, so I think I've achieved the goal of keeping the private and public wifi networks separate. The private network will be protected by (1) a good strong password and (2) MAC address filtering, only allowing the MAC address of the laptop to connect to it.

One problem (not insurmountable but a bit inconvenient) is that the password of the public network will need to be changed weekly to avoid neighbours jumping on it. Unless anyone can suggest something different, the only way that comes to mind is that the laptop be taken to the Linksys router and connected by ethernet to do the password change, which seems a bit clunky?

I fully admit that I am an absolute noob when it comes to this sort of thing and I may be going about it all the wrong way, so feel free to point out the errors of my thinking and point me in the right direction if you don't mind.

Thanks very much and apologies again for such a long post.

John

 

[YeOldeStonecat]

Well, you're heading in the right direction..."multiple SSID" and the guest one with "Client isolation mode".

Being over on this side of the pond, I'm not familiar wit BT or what hardware they use, but most ISPs over here ship a "gateway" appliance for their business clients which is a combo modem/router in 1 box. I prefer to use the router of my choice for my business clients...so I reconfigure the ISP supplied gateway to pass the public IP to the router I bring. This way you avoid the dreaded "double NAT" setup.

So for your situation, I'd get an entry biz level wireless router that supports multiple SSID's and client isolation mode. The production network wired in with the business wireless, and a "guest" wireless SSID with isolation mode enabled so they can't touch anything else on the network.

You don't need or want MAC filtering....it's really useless as a security measure, there are tools that the freeloaders use which easily let them bypass that. And it just adds complication. WPA2 is all you need.

For the weekly password change, just show the client how to log into the wireless router and change the security key for the "guest" network.

 

[sorcerer]

Thanks for your reply Stonecat

Well, you're heading in the right direction..."multiple SSID" and the guest one with "Client isolation mode".

Being over on this side of the pond, I'm not familiar wit BT or what hardware they use, but most ISPs over here ship a "gateway" appliance for their business clients which is a combo modem/router in 1 box.

That is indeed what BT and most other ISPs do here too

I prefer to use the router of my choice for my business clients...so I reconfigure the ISP supplied gateway to pass the public IP to the router I bring. This way you avoid the dreaded "double NAT" setup.

I'm ok with the rest of your reply and thanks for the information, but I'm not familiar with this my friend - what is "double NAT" and why is it a bad thing?

Cheers, and thanks again.

 

[Martyn]

Have a look at the Asus range of routers. I have BT Infinity 2 so a Home Hub 3 and the Openreach modem. I replaced the HH3 with an Asus RT N66U and the wireless coverage is superb. You can also have multiple ssids for guests etc. You need to look at their site as my router needs the Openreach box.

 

[YeOldeStonecat]

I'm ok with the rest of your reply and thanks for the information, but I'm not familiar with this my friend - what is "double NAT" and why is it a bad thing?

Cheers, and thanks again.

"Double NAT" is ..for example, when you have 2x routers...back to back.

Modem==> Router 1 < 192.168.0.xxx range ==> Router 2 < 192.168.1.xxx range.

Now computers connected behind router 1 are fine. But computers connected behind router 2 with the 192.168.1.xxx IPs will have to pass through its NAT...and then pass out through router 1s NAT. So they're double NAT'ing.

With most basic tasks like surfing the web...it works fine, you don't see side effects save for a little slowness and pokier name resolution. But with some other types of traffic, they can't deal with double NAT well. Such as if someone has to VPN to the office to do work. Or some legit file transfer stuff. Or some remote desktop software. Or communications like Skype will suffer in performance and clarity.

 

[sorcerer]

Martyn - thanks very much, will do.

Stonecat - ah, right, I understand now. My experiment, as it stands, is currently double-NATing then. I'll take Martyn's advice and look at Asus routers for the job.

Cheers guys

 

[eliforp]

I know I have posted this before but you may want to look at putting in a couple ubiquiti unified ap's. These have the function of splitting public and privet and they also have the ability to issue access codes for your clients customers. I have never had problems with these and they are really cost effective. Little to no skill needed to set them up.

 

[Martyn]

I forgot the link to the one I have. I'm not sure if it will fit your needs but it is a great little unit. I think I paid just over £100 for it

http://www.asus.com/Networking/RTN66U/

It allows 6 guest wireless networks 3 on each of the 2.4Ggz and 5Ghz. Before I had boosters but this unit covers the house

 

[Mick]

Assus are pretty good. Take a look at the Draytek range too. They're (reasonably) easy to set up and have a good support forum if you need them.

 

[DocGreen]

I had a look at HotSpotSystem.com a while back... they basically worked using DD-WRT on just about any old router, gave you a bunch of different options on how you wanted your wifi to work. You could set it up to be completely free, or charge for access... set limits on time and bandwidth... setup a landing page or walled garden... require users to answer certain questions prior to accessing the net (such as email, phone, name, etc)... and had the option to be completely white-labeled.

Played around with it and it seemed pretty cool... never actually put one to use though.