2

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with static IPs.

The setup is an interactive experience in a retail setting, and the primary machine serves a local Node.js socket server for three separate JavaScript apps on the network to communicate. It's set up this way because the corporate IT policy prohibits creation of in-store wireless networks for fear of passers-by hacking machines wirelessly and exploiting displayed experiences.

However, I want the application on the primary machine to give off some sort of "heartbeat" that I can remotely monitor. I was thinking I'd like to have a fourth machine that's wi-fi enabled to the LAN, have it communicate with the primary machine of the other three, and report the heartbeat to a remote server over wi-fi.

Is there a way to provide wireless Internet access (from, say, a public wi-fi) to an individual computer on the wired LAN, without 1) extending it to others, and without 2) providing a path whereby someone who wirelessly hacks into the single machine with wi-fi could gain access to the other machines on the wired LAN?

Improve this question
3
  • you should look at captive portal solutions
    – Mike Pennington
    Apr 19, 2014 at 11:49
  • Uh... you really, REALLY need to contact corporate IT about this. You also need to read up on PCI Compliance. Like, stop what you're doing and do it now. You are quite likely risking your job with this plan.
    – Smithers
    Jan 22, 2015 at 21:47
  • Oh, I didn't do it this way. I was merely brainstorming and then asking "Is there a way...", as a path to getting more understanding. While PCI Compliance wasn't necessary in my case (this was just a temporary interactive marketing experience in a retail setting where no sensitive data of any kind was captured, stored or displayed), questions like mine from other stakeholders got IT to relax the rules for using wi-fi networks in store, so it got sorted out. Thanks for the suggestion, though.
    – Gregir
    Jan 23, 2015 at 4:29

1 Answer 1

Reset to default
2

1) Yes

You can connect a computer to two networks. The practices is commonly called "Dual-homing" and requires a bit of a trick to make it work. Your computer that's on both the wired and wireless networks will need to know which network to use a default gateway on. In your case, since your wired network uses statically assigned IP addresses, it's pretty simple; don't put a default gateway in when you're typing in the IP address for the wired NIC. The computer won't pass information from one network to another (providing wifi access to the wired computers) without some additional configuration, so you shouldn't need to worry about that.

2) No, but the risks can be mitigated.

Once an attacker gets into one computer on a network, they'll be able to access the rest. This would mean they would need to gain control of the dual-homed computer before they could talk to the rest, but once that step is done, they're home free. You can mitigate this risk by installing a host-based Intrusion Prevention System (IPS) on the dual-homed computer, by installing a software firewall on the dual-homed computer, by using strong security on your wifi connection, by protecting your wifi with IPS and/or firewall, or by protecting the wired networked computers with IPS and/or firewall, but without an air gap, there's always the possibility of compromise

Improve this answer
7
  • In mitigating the risk, could you set up a VPN server on the dual-homed computer, and have one of the application-serving computers send the heartbeat over VPN?
    – Gregir
    Apr 19, 2014 at 5:16
  • You could, but I'm not entirely sure what the purpose would be unless you just wanted to hide the heartbeat message contents. Let's hit this from a conceptual standpoint. You have a dual-homed computer (A) that is being used to monitor (is that the only thing A does?) the status of a server on a wired network (B) that feeds javascript apps to two workstations (C, D) on that same network, and you're wanting to monitor B's status remotely, is that right?
    – Avery Abbott
    Apr 19, 2014 at 13:52
  • Yep, that's all (A) does. (B) is a full interactive application and it sends socket messages to (C,D) to play videos at specific times. (A) is something I want to add after the fact to remotely monitor (B)s heartbeat, but corporate IT will skin me alive if it allows a path for hackers to take control of (B,C,D) in any way. I don't know much about VPNs (obviously). Just wanted an almost foolproof secure path between (A) and the rest. Just short of an air gap.
    – Gregir
    Apr 19, 2014 at 14:50
  • How do you plan on monitoring B's heartbeat? Pings? Service checks? WMI? SNMP? And how are B, C, and D connected? If it's a switch, which model do you have?
    – Avery Abbott
    Apr 19, 2014 at 17:11
  • 1
    The more I think about this the more I think I'm overthinking it ;-) If you run a good secure wireless network (strong encryption, some form of authentication, and a cryptic and hidden SSID) and put a good firewall program on A (preferably on A-D), the odds of someone hacking in and changing things around over WiFi are about the same as someone plugging into your switch to do it.
    – Avery Abbott
    Apr 19, 2014 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.