Re: Salvaging Unwire Portland

>>>>> "Michael" == Michael Weinberg <[email protected]> writes:

Russell> The obstacle that I don't have a ready answer for, at least
Russell> that wouldn't require additional node-host investments is
Russell> where the prospective node host is doing "unsafe" things like
Russell> using windows fileshares from a laptop over wireless.  I am
Russell> somewhat clueless about the state of windows networking these
Russell> days, but that sounds unsafe to me.

Michael> Windows XP, at least, makes file sharing rather difficult,
Michael> demanding your acceptance of a warning stating that others
Michael> could be in ur foldrz grabbin ur filz. The sharing tab that
Michael> used to let you turn on network sharing is now designed to
Michael> offer you sharing among users (on one computer) as the
Michael> primary option, with a grudging offer of network sharing
Michael> below it. I don't think that it's any more dangerous than
Michael> file sharing on any other system, and it is most certainly
Michael> off by default.

Okay.  Some people are probably doing it now and want it to keep
working.  Other people aren't doing it now and don't want/need it at
all.  The latter group is going to be easier to convince.  The former
will need to be convinced either to spend more money or we'll need to
figure out a more clever solution for them keeping their bits safe.

Russell> The solution that I know would work would be to get a
Russell> separate device to provide the open wireless, and do their
Russell> fileshares over an encrypted network.  This would have the
Russell> drawback of requiring additional investment by the node host,
Russell> which would be a disincentive for them.  Maybe someone else
Russell> has a better solution.  Not everyone is going to be doing
Russell> that though, so it's an obstacle for only a subset of the
Russell> population.

Michael> This is what I do at my house, more or less. In my
Michael> incarnation, so that I can avoid double NAT, I require
Michael> multiple IPs, which is obviously an additional investment as
Michael> well. A device that would route 2 subnets would be very nice,
Michael> can we make OpenWRT or DDWRT do that with multiple SSIDs?

Right now, afaik, multiple SSIDs aren't possible on the broadcom
radios in most access points.  They are coming with the new mac80211
stack and the reverse-engineered broadcom driver, but not there yet.
Again, afaik.  I believe it is possible with atheros radios, like
those in the WGT634U and Meraki, though I have yet to play with that.

As far as routing though, it's no problem.  Only one external IP needed.

  WAN -- to ISP
  LAN -- 192.168.x.y/24 (the private wired network)
  WIFI -- 10.11.x.y/z (www.personaltelco.net, the pubic wireless network)

then use iptables to masquerade everything going out the WAN interface
like so:

  iptables -t nat -I POSTROUTING -o $WAN_IFACE -j MASQUERADE

and disallow connections from 10.11.x.y on the 192.168.x.y network.


-- 
Russell Senior, Secretary
[email protected]

-- 
The Personal Telco Project - http://www.personaltelco.net/
Donate to PTP: http://www.personaltelco.net/donate
Un/Subscribe:  http://lists.personaltelco.net/mailman/listinfo/general/
Archives:  http://news.gmane.org/gmane.network.wireless.portland.general/
Etiquette: http://www.personaltelco.net/index.cgi/MailingListEtiquette