Setting up a Wireless Network and Securing It

Hello everyone, I'm in need of a bit of help. I have a tiny home network of 3 PC's (which is about to grow to 5 PC's :)) and I want to make it a wireless network. Having wire's and the trouble's of everything can become a hassle, and I'd love to try something new. My question's are:

1. Where can I go or What can I look at for help that can get me started in Wireless Networking?

2. What security measures should I be aware of and how much does it differentiate from a regular network?

I'd really appreciate the help, I'm clueless as to getting remotely started with setting up the wireless network, and it's something I've wanted to do since I heard about Wireless Networking. Thanks in Advance for any help. :)


EDIT: I've searched google, but to not much avail. I'd love to hear it from people who have set one up and all. Thanks!

Hey Spyder32, have you checked other threads on here that have to do with wireless networks? There are alot of good info on those.

Heres a link that should help out some:
http://www.amazon.com/exec/obidos/tg...808305-3428012

I pretty sure you can go to CompUSA and ask and they should tell you everything you need to know. And as for security, my wireless network is a Microsoft network. In the base station options, there is a big menu of security options, such as MAC and WEP and a firewall. I don't know about Linksys and the others, but the Microsoft hardwares comes with security.

But, unless you like reinstalling things, I wouldn't get Microsoft stuff :p

In one of the threads before, someone talked about how wireless was rushed and people should wait until it's improved, sorta like XP I suppose.

Hope this helps

Yeah, I was hoping to have some form of a *nix box to serve as a firewall box for the network. Any suggestions on which OS to use as a firewall? I'm also not sure if I want a Microsoft network (your saying it's secure? You expect me to believe that ;)) in general. I'm pretty good with a Linksys router and I've worked with those in the past. I'm just really getting into Wireless Networking and I'd love to find some resources I can read on it.


EDIT: Another question that I want to know, is how much is it different from a regular network and what security risk's follow it? Thanks in advance!

Well, its different from a regular wired network because your signal travels out all over the place, its like having 300ft of wires going in all directions for someone to just plug into.

What do you mean. which OS to use as a firewall?

What I mean is this: I want to use one box of mine (don't care which one) to act as a firewall and nothing more for my network. Is this possible for a Wireless Network and if so, which OS should I use that would best suit the firewall plan?

A wireless network has all the same security concerns as a standard wired network, plus one additional problem. That problem is, with a wired network, you can physically controll where the cables go, etc, and put protections in at the perimeter of your network. With wireless, due to the nature of radio waves, you cannot control where the network extends, it naturally propigates as far as it can determined by its surroundings.

There are several ways to improve security on a home wireless network. Change the SSID on the access point from the factory default, tell your access point not to broadcast your SSID, turn on WEP(Wired equivalency protocol)(flawed and crackable < 5 hours even at 128bit encryption because bits of the key are often visible in the transmissions), only allow certain MAC addresses to communicate.

Problem is, even with all these things if someone is determined to get into your home wireless network, all it requires is time. it is possible to spoof MAC addresses, and the MAC addresses of your wireless cards need to be visible all the time. It only take about 5 hours( or less) to break WEP, and start reading all your traffic, at that point someone could also get onto your network if he chooses.....

Here is a great article for home wireless networks....

http://arstechnica.com/paedia/w/wire...802.11b-1.html

Also, for more detail on wireless security, another great article is here...

http://arstechnica.com/paedia/w/wire...ecurity-1.html

<Edit>
If you are planning to have a nix box setup as a firewall , use ssh tunnelling between your nix box and your clients, or some form of VPN, that pretty much gets rid of all of the security concerns about the wireless, if you have all your machines setup only to communicate with each other.
</edit>

Good Luck,

IchNiSan

Thanks for those resources IchNiSan! I have still a few questions, mainly this: Can you control the nature or direction of the radio waves and if it goes out, can someone intercept it or anything like that causing a security risk for the network itself? I still have quite a few questions, but these papers are helping. Thanks for the help so far guys, it's helping a ton.

You cannot control where the radio waves go. Unless of course you wanted to line the walls of your house with lead or something.

There are many different antennas, which send out different patterns, but those are more to provide service in specific areas than to prevent access.

A home access point typically has a range of about 300 feet, if it is in an open field, the walls of your house and other things will affect that range greatly, and you really only need to worry about people who can get really close.

If there is enough power left in the signal for someone to read it with their wireless card/antenna(pringles cans have been used in the past) the can certainly capture all data, and perhaps send data of their own, but they cannot prevent it from travelling, unless they jam it with interference on the same frequency.

I suppose that if someone were to set up a machine to act like an access point on your network, they work it so that your computers talked to their system, which then forwarded the traffic on, potentially modified.... Not really likely. I don't think a home user would have to worry terribly much about this kind of thing, unless you have some really important sensitive data at home, in which case, well, don't bother with the wireless.

Interesting, thanks. I'm really into this and as much as it might seem like an easy project to some, but I'm a total idiot at Wireless Networking and have barely studied it. If 300 feet is the range limit, I should be good and not to worried about the traveling of the waves. In a sense, this is alot like Radio waves and frequency level's, correct? Thanks again for all the help. :)

It is exactly like radio waves and frequency levels. As that is the medium you are working with, radio waves.

The three hundred feet I mention is not a hard number, but I believe most of the antennas which come with the typical home wireless access point are about that. you can get bigger ones if you want...

Greetings all

Use the following as possible guidelines for securing your WLan.

------------------------------------------------------------------------------------------------------------

Securing your Wireless LAN

Radio interference

Place Access Points (AP’s) well within the building so that they are shielded as much as possible from any unwanted radio transmissions from the outside world. (Site survey).
Install wireless network equipment as far from potential interference sources as possible, such as microwave ovens and DECT cordless phones.
Check for other networks within the intended coverage area prior to implementing a wireless LAN. If these are insecure then the relevant network owner(s) should secure them.
Test for radio interferences.

Radio Propagation

Place Access Points (APs) well within the building so that they are shielded as much as possible from any unwanted connections. (Site survey).
Configure wireless APs and wireless NICs to use WEP in order to encrypt all network traffic.
Consider using directional antennas to focus the radio transmission into the building.

Wired Equivalent Privacy (WEP) weaknesses

Configure wireless APs and wireless NICs to use WEP in order to offer a rudimentary level of protection from malicious third parties.
Consider encrypting specific sensitive traffic on an individual basis using an encryption application on the client computer (e.g. PGP).
Consider using a Virtual Private Network (VPN) in order to encrypt all data being transmitted across the wireless LAN. Consider changing WEP keys frequently, for example daily for critical networks and monthly for non-critical installations.
Consider using proprietary key management solutions.

Poor network address management

Change the default SSID (Service Set Identifier) of the Access Point.
Disable beacons within APs that broadcast the SSID.
Use IP address filtering to limit access to client computers with authorised IP addresses.
Use MAC address filtering to limit access to client computers with authorised MAC addresses.
Disable the DHCP server in the AP and configure the AP to assign static IP addresses only to authorised MAC addresses.

Lack of user authentication

Consider using an authentication server solution, such as IEEE 802.1x
Consider using APs or wireless NICs that employ proprietary authentication services.
Consider using a VPN in order to provide user authentication.

Unauthorised or inappropriate hardware implementation

Perform wireless network monitoring, using tools such as Network Stumbler, on a regular basis in order to detect any unauthorised equipment.
Check the configuration of wireless NICs in clients computers so that they do not act as APs.
Protect the AP with a firewall.
Consider placing the AP in a De-Militarized Zone (DMZ) so that all wireless network traffic is logged.
Standardize wireless network equipment upon a single preferred manufacturer.
Use only equipment that carries the “Wi-Fi” logo.
Test all wireless network equipment prior to using it to support business applications.

Client computer attacks

Check the configuration of wireless NICs in client computers so that they are not set-up in Ad-Hoc mode. Install a personal firewall software product on each client device and configure it to reject any unknown inbound connections. Disable the use of file or drive sharing on client computers.
Configure the client computer to only permit connection to an AP with a known SSID.
Password protect the client computer so that if lost or stolen it cannot be used easily.

------------------------------------------------------------------------------------------------------------

Regards

Meerkat

:cool: