0

Ive got a setup where im using 5 x Ubquity UAP AC PROs as wireless access points. The rest of the wired network is connected straight from the smart switch (Netgear GS716T), via a patch panel, to a mixture of AV / TV devices (sonos, TVs, set top boxes etc) and in wall cat6 sockets.

Im going to add some of the cat6 sockets to a VLAN and filter their traffic via openDNS. (the rest of them and the AV / TV devices will be unfiltered). This will be done via the smart switch.

For the wireless network im going to setup a main and a guest network. The main network will be unfiltered and the guest network will be filtered through openDNS.

This is where ive got the issue, the wireless (main & guest) network is setup and managed via the Ubquity controller, but i cant setup DNS filtering through there, this needs to be done on the network smart switch. As the each wifi access points would be plugged into a port, that port would be filtered or not, because both the guest and and main network go through that port, both the guest and the main network would then have the same filtering.

Is there a way i could tag / identify the wireless guest network so although both the main the guest wireless network are running through the same port only the guest wireless traffic would be filtered and not the main wireless traffic ?

Could this be done by targeting the SSID or some other method ?

| improve this question | |
  • 1
    A diagram would certainly make this clearer. how are your guest and regular users getting IP addresses? Are they on the same VLAN/subnet? – Ron Trunk Feb 9 '16 at 13:38
  • Usually, you would trunk multiple different VLANs to an AP, one for each SSID (main and guest in your case). The separate VLANs separate the main and guest traffic, and separate routing policies would be applied at the router. OpenDNS would be off-topic here since it is a protocol above OSI layer-4, and I'm not sure what you mean by filtering with DNS. – Ron Maupin♦ Feb 9 '16 at 18:42
  • @RonMaupin what i meant by filtering with DNS is to use openDNS as the DNS server for traffic on the guest network VLAN, then using to openDNS block select sites / site genres – sam Feb 11 '16 at 13:12
  • OK, but that's not really filtering. Granted, you could prevent someone using the OpenDNS from getting to sites by name, but it won't prevent anyone from manually setting the DNS servers on PCs or using IP addresses instead of names. Real filtering would block the traffic from those sites. – Ron Maupin♦ Feb 11 '16 at 14:48
3

I assume you are using OpenDNS' web filtering functionality here, and it looks like that essentially involves using their DNS servers to handle lookups, rather than your own.

You could define two SSIDs, associate them with different VLANs (on a single physical port) behind the APs, and then simply differentiate the settings that you provide to clients over DHCP (since you have two vlans, you'll need two scopes). For a user in the guest vlan, your DHCP would provide the OpenDNS settings, for your standard unfiltered users you would provide settings pointing to your internal DNS or whatever else you want.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.