topic Guest Wireless Internet Firewall Rules in Wireless

Guest Wireless Internet Firewall Rules

John Capobianco — Mon, 05 Jul 2021 06:54:24 GMT

Good morning -

I am hoping to find a sample, guide, best practices, and practical example of a set of Internet firewall rules for wireless guest users. Common current services and applications for tablets (Skype, Apple services, etc) must work and I would also like to identify commonly blocked outbound ports for wireless guest users. The service should have a more open ruleset but still be secure. Even if I could find a good starting point.

Thanks!

Guest Wireless Internet Firewall Rules

Stephen Rodriguez — Tue, 07 Jan 2014 15:45:26 GMT

There really isn't one a sample nor best practices for this.

It all depends on what you are looking to do.

IMO, the guest network should only be blocked from reaching to the internal network. Other than that leave it open, but maybe QoS/AVC and mark them as lower priority so they can't utilize a lot of your interwebz bandwidth.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

Guest Wireless Internet Firewall Rules

John Capobianco — Tue, 07 Jan 2014 16:01:36 GMT

Thank you for the reply. We are using the WLC to rate limit guest bandwidth and are approaching this to have a near-wide-open access to the internet on the guest network. Just trying to see if there are commonly blocked ports or blocked services applied or if we simply use Layer-7 aware / application aware services to block things like Torrents but allow Skype for example.

Guest Wireless Internet Firewall Rules

Stephen Rodriguez — Tue, 07 Jan 2014 16:23:15 GMT

I'd stick with Layer 7 aware services. That way you can drop or mark down bandwidth hogs, but still let the users get where they need to.

The problem with FW/ACL is you never know what a user is going to need. I had a customer years ago that had changed the ports her VPN used. If you didn't know what they were, they never would be able to connect.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered