Help setting up a wireless network (please!)

[Andrew Gabriel]

I treat the WAP as untrusted, just like I treat the internet as untrusted. When I had my first 802.11b WAP in 2000, it was directly on the Internet (ISDN, later ADSL), outside my firewall.

Until 2006 (when I started paying for the ADSL line myself), I deliberately left the WAP wide open as all my American colleagues do, to provide roaming internet access to passers-by, although such usage was very small whenever I monitored it.

It's still pretty much the same setup, except I don't keep it wide open anymore, and there's a bit of wirewalling there. Access to my LAN from the WAP goes through same checks as access to my LAN from the Internet.

I quickly discovered that visitors must only be allocated NAT'ed IP addresses. Otherwise Skype, which most of the Windows users have installed and running in the background, discovers it's got a real IP address and becomes a supernode, and quickly starts saturating my link with half the world's skype calls.

[Bob Eager]

For the record, it should be noted that this is a bit of an oversimplification. That's true only if the subnet mask has been correctly set to 255.255.255.0...which it should have been, but who knows? And if you were using (say) 10.0.0.1 as an address, you *might* have the subnet mask set to something else.

Assuming a netmask of 255.255.255.0. I know it *should* be set like that, but best to be sure. If it's set to something else (and I have seen that) the above may not work.

[Adrian C]

Wow. Tell me, with the plethora of different wireless chipsets possible on a PC, and the random fact that the user may be using Microsoft wireless configuration OR something else, and different operating systems - exactly how is a setup disc wizard FOR THE WAP going to set up encryption on the PC?

[dennis]

True, but adding a few seconds doesn't add much to security. And it really does only add a few seconds.

It does make the whole process of setting up the network more difficult and may lead to errors being made.

[dennis]

What makes you think they don't all store the data in the same place? What makes you think there isn't a standard set of library calls to manipulate them? Can you name a card/driver combination where things like the "net" commands and "ipconfig" don't work?

[John Rumm]

Damn, I actually agree with dennis on something...

Any wifi sniffing tool will immediately disclose the live IP addresses and valid mac addresses of the existing clients, so the "obscurity" of titting about with these measures is pretty much nil. You just make your own life harder.

[John Rumm]

That ought to keep the wireless side secure. Given you only have the one known user on the wireless side (wifey on wifi ;-)) there is not much else to worry about.

FYI: The WAP configuration may also allow you to control the level of bridging between wired and wireless. So for example if you wanted the netbook to see the internet but have no access to any of the wired clients, that can usually be done. Also because you made the (sensible) decision to go for a separate WAP, you have the option of setting firewall rules in both the WAP and the router to control exactly what can be done from where if you want.

[Adrian C]

They don't. I don't see the development of an industry wide definition set of wireless profiles other than the microsoft SP2 set.

There is a Microsoft Wireless LAN API but it's not available if the user has decided to use manufacturers wireless drivers.

Wow. Pure Dennis.

Go on. How do you set SSID and WPA encryption with "net" and "ipconfig" CLI tools? You can maybe do some things with "netsh wlan" in Vista, but XP?

It would be very stupid and unusual for a router/WAP manufacturer to issue utilities that jerk around with the users network card configuration. An unknown quantity.

I've checked the manual for the Dlink DAP-1160. It does nothing of the sort and offers instructions for the user to do the adaptor encryption setttings manually.

Screaming at someone for running the install disc and suggesting that had ruined the install somewhere so suggesting system restore...

Pure Dennis. :-(

[Mike Barnes]

I wouldn't be so confident.

[Mike Barnes]

I'm glad you said that. I was skimming the new postings to the thread and I saw your EUREKA! and made a mental note to go back to that message and follow it up with a reminder about security. Too many people sit back with a sigh of relief when they get it working and don't risk screwing it up by applying any security. It's refreshing to see that you're not one of them.

WPA2 is OK. Choose a long password. But accept that a sufficiently determined attacker will be able to crack it, and I'm led to understand that tools that make it easy for anyone to do that are freely available on t'Internet if you know where to look. How far do you trust your neighbours?

The two things they can do are: access the internet (slowing things down for you and adding to your bandwidth usage) and carry out various nefarious activities, which, if they're traced to your ADSL connection, you'll have to come up with an explanation for; and access the PCs on your wired network.

If you don't share files or printers between the PCs on the wired network you should disable sharing on all PCs. If you do share files or printers, there might be something you can do with passwords, but I'm the wrong person to ask about that. I side-step the problem by having two routers and two LANs, one for wireless and one for wired. So the wired LAN is protected from the WAP just like it's protected from the Internet.

[dennis]

You aren't going to explain how the standard commands and utility programs manage to access this data that you claim is stored in odd places then?

Wow pure TMH.

You are the one that claims they are all different, why can't you name one so I can have a look?

Who said it was XP?

Why not, its the easy way to uninstall stuff. Why do you think system restore was added if not to make life easy.

Yep, and nothing you have said is anything other than you stating you are correct and failing to back up anything you say.

Pure TMH.

[Adrian C]

Waste of time. As always. See ya.

[dennis]

I agree you were a waste of time as you failed to have any logical answer to anything I said. Even your last ditched attempt by suggesting using system restore to uninstall stuff is wrong fell flat on its face. cya.

[John Rumm]

I think at the moment the only realistic attacks against WPA2 with AES is to dictionary attack weak pass phrases. So if you have selected something reasonably secure, then you should be safe for now.

Which perversely, you would have a better defence against if you left the wireless side unsecured.

[dennis]

It isn't worth the roving user trying to break it. You can make it so nobody finds it worthwhile by changing the passphrase often enough.

[Adrian C]

My last ditched attempt is not to continue speaking to idiots like you who plainly have no clue what they are talking about and only exist to confuse the matter of the original question even further.

System Restore. Really. Not XP? Really. Pure Dennis. Really.

:-(

[tony sayer]

Also if your in a terraced house or flats bear in mind that everyone could have a wireless point and interference can and does take place!..

Also from video senders microwave ovens and the like;!..

With regard to changing your IP addy on the PC sometimes this takes a few minutes to get its act together. In a DOS prompt box type "ipconfig" and that should show you what its set to.

You can have more than the one IP address per machine like we do here..

If all else fails ask a teenager to set it up for you;)..

[dennis]

You are being the idiot here. The solution as done in more detail here was to ignore the CD and do it by manual means, which is exactly what I said BTW.

Do you even know what system restore is? I doubt it by the way you keep bringing it into this thread. Windows does checkpoints and you can wind it back to one of those check points by selecting it and saying yes please. It is infinitely better than some uninstall programs and doesn't leave registry entries and stuff like that that some installers leave behind.

Now we have established that it is you that doesn't know what you are talking about we can forget it.

Pure TMH.

[Laurence Payne]

The chipset doesn't come into it. If it's transmitting the right kind of wireless (and it will be) the computer will be able to pick it up. The software provided on the computer will be fine.

Standard procedure with all this sort of gear is to ignore the software provided. Connect to a computer with a network cable. Find the address of the device from the manual. Typically it will be

192.168.0.1 or 192.168.1.1 Type it into your web browser, in the same way as you'd type a www. address. There may be a default logon and password. Typically some combination of "admin", "user" and "password". Again the manual will tell you.

Once you're into the device's control panel (which looks and acts just like a web page) make any necessary settings. For an access point the only changes you'll probably need to make from the defaults is to choose a network name and set a password (so that neighbours and passers-by can't access your connection).

[Laurence Payne]

Doesn't really make any difference. Anyone who can see the network at all can also see the ip.