Providing file shares etc securely

Im quite keen to hang an access point of my LAN somehow to provide access to some stuff to anyone which wants to take it.

What is the best way that people have come up with to prevent access to the entire LAN from anybody. I specifially have no interest in sharing my jetstart connection. I also dont want to provide crazy access to all my shared files.

Whats the best to do so people are likly to find the media etc, but have stuff secure. I was thinking another machine which ran an FTP server, and the AP was only connected to that. DHCP on that interface to assign private IP addresses, and what? How do people find what IP has the FTP server on it. Username/passwords, etc, etc - these are all questions that I have no idea on.

If I want to get lan access there would be no problems putting a PPTP server on it to connect into from a laptop etc.

Hi,

The best idea would be to think of the wireless network as like the internet (ie a public network that you have no control over who's on it, or who can access your connection). So the best solution would be to seperate your connection from your lan via a firewall.

Something like

Internet connection -> firewall -> LAN <- firewall <- wireless connection

and if you need to, you can set up NAT mappings to a port, such as ftp, http etc.

ie 10.1.1.1 (wireless ip) port 80 maps to 192.168.0.1 (lan ip) port 80
That way the server at 192.168.0.1 looks like it's on the wireless network

As for finding the ftp/usernames/passwords i don't think the only way would be to tell ppl the information, or you could just set up anonymous access and hope that ppl find it.

I'm hoping to code up a node information page soon, which would allow you to put up services that your access point offers/information about that access point, so you could possibly post your ftp information there.

As for PPTP, there's no problems with that, you'll just need to open up that port to a server that's inside the network and connect to it via your laptop.

Hopefully this answers some of your questions.

Im just wondering, when people connect to an unknown AP, what type of things do they do? Im definatly going to put a web server there, I will portfoward it to my linux box here and try to vhost something with the IP as the site name, so that people can get details of the site, have a guestbook where you can only add to it when using a wireless connection etc, a way of leaving your mark electronically I guess. (View from the net too of course, but on a *(&(&ing dynamic IP jetstart connection it sucks to find it)

But what can I do to make people bother trying it? I could make the SSID something like HAS_HTTP etc... Thing is, im going to need a DHCP there, and thats looking like the biggest challange at the moment.

yer was thinking the same thing on the ssid.

althou u are going to need to follow the nzwireless howto for setting up your AP if u are wanting to join in on the network at later dates. i think. Compatibility etc

basicly if you set your SSID to something like noodles.akld.nzwireless.org then hopefully ppl will get the idea that that is where information for the node is going to be and go to http://noodles.akld.nzwireless.org/

Problem is thats all linux based - im not game for that just yet, and im not going to be sharing my internet on the node either, so im just going to go for a hardware accesspoint/router for now.

None of the hardware routers I have come across can pinhole from the LAN to the WAN side, instead assuming the NAT or the full routing will allow data to go out. Ideally I want port 80 on the default gateway address to have the http since thats the first place people are likly to look. I think I will have to put a DHCP behind it as it seems the DHCP in the d-link and linksys's etc will only assign themselves as the gateway.

Anyway, I have a bit on ebay at the mo for a 15dBi omni, if i dont win, im gonna buy one ($140 US + shipping), I can always swap to a PCI card later if i get a handle around linux. Dlink 520s seem to go for cheap on there. I cant get over the cost of wireless gear in NZ, even outpost.com or buy.com is cheaper then trade from the few places I have tried.

Gonna run with a hardware AP and see how far that will go etc before putting the effort into configuring a linuxbox for it.

Once I have that done, i think a mini-itx system will do the trick nicly.

jeeeeeesus $USD140.00 + freight for a 15 db omni !
Ouch. Waveguide 180 or 360 degree coverage. $80 - $90 NZD, freight 5 bucks. Give me a yell.

Got a site with details on these antennas? Whats the gain on them like? I have decided that the range from heres not enough to bother trying a 15 dB, but the added height of it may help a little, I can always put up a tall metal pole with an 8-12dBi on the top.

the international shipping will most likly be the "checked baggage" method so its not a huge cost to get here.