How to create an open wireless along with private wireless?

Question

I am working in a restaurant and we got our own 10Mbps speed Internet connection. The high speed is intended for our servers and credit card phone line. We recently decided to open wireless up to customers who visit us. However, other neighbor stores keep stealing our connection and it lag our servers' connection. Even though we WEP our wireless connection, because we are a restaurant, we have to give out the password to customers for them to use our free WiFi connection.

My concern is it is just a matter of time until our neighbor stores know the password and steal our connection again. Additional information: our employees also use this connection and it is SLOOOOWW~ Plus, we only get 1-2 bars (our of 5) of signal when we are upfront while the router is located in the office in the back. (Around 20~40 ft away with around 6-7 walls/2-3 rooms) The first day I created a WEP, speed is at 4-5mbs (tested with http://www.speakeasy.net/speedtest/) but after 2 months it drop down to 1-2mbps. Sometimes it was even below 1mbps. So I want two network access on one service line.

Here is what I have done:

1. Set up the password WEP. No, I do not want to reset the password everyday~
2. I've create a password so outsiders cannot access our router information. But I feel this is not safe enough when more than 20 new strangers know our WEP daily.

This is what I want to know (or do):

1. Create 2 access on one service line. Might need 2 routers (?)
2. Increase the range to the connection. Router modifications are welcome but please with CLEARLY step-to-step or video demonstration.
3. Limit bandwidth for "guest" (around 20% of max speed) and Max "Private" bandwidth

What I want to accomplish from this:

1. I want to create one connection for guests so they can surf internet during their visit. I don't care if our neighbor steal our connection as long as we still have our MAIN connection for personal and server usage.
2. Limited usage for guest
3. Increase range (and speed if possible) for our guest and personal usages (modifications are welcome)

Let me know if you need any additional information.

Answer 1

First of all, I would highly advise using WPA2 encryption, not WEP. WEP is easily cracked with consumer hardware and tools. WPA2 is much more secure.

In order to set up advanced configuration on your router, it will be helpful to have router firmware like DD-WRT or Tomato. If your router isn't supported by one of those distros, it might be a good idea to get a router which is.

To deal with your bandwidth hogging guests, you should set up QoS (quality of service) on your router. In order to only restrict your guests, and not yourself, you will need to know the MAC addresses of all of your computers' wireless adapters. If you don't know how to find the MAC address, there are instructions on the internet for how to do so.

Configuring QoS will be different depending on your router's firmware. Find a section labeled either QoS, Quality of Service, Prioritization,or something to that effect. Turn on QoS, then add rules to give each of your computers' MAC addresses highest priority for all ports/services. Then, add a rule setting all other traffic to a lower priority level. You'll have to do some looking around in the config interface, but you should be able to either limit them to a certain percantage of the total bandwidth, or to a certain Kbps max up/down speed.

That should deal with the issue of prioritizing speed on your network. If you want to have a completely separate connection for your guests from your personal computers, DD-WRT supports multiple virtual wireless networks running from a single router, though this feature only works on some routers, so check ahead if you buy a new router. This would let you set up a private and public wireless network separate from eachother completely. You could then apply QoS only to the public network.

In terms of extending the wireless signal, see if moving your router's position relative to walls and other obstacles improves the signal. Changing the channel can also help, especially if there is interference from other WiFi networks. Finally, if you must get a second router to cover everything, look into finding a router which supports WDS. WDS creates a meshed network between multiple routers which clients can move between seamlessly. This will make it much smoother moving back and forth between the two routers. This requires having two routers by the same manufacturer with compatible chipsets. Details are available for DD-WRT and Tomato.

Answer 2

One option you may want to consider using is the installation of a directional antenna or two in the ceiling pointing down, instead of using an omnidirectional antenna. There are all sorts of different external antennas you can get which have beam widths of, say 90 degrees. You could put this in the upper corner of your establishment, pointing down and back towards where you want coverage.

This is like putting blinders on the wireless access point, so that it can't "see" people that aren't in your business. It can also improve performance by increasing the signal within your business (the same radio energy is concentrated to a smaller space, increase penetration through walls, and reduce interference from surrounding businesses that may have wireless networks, cordless phones, or other devices on the same frequencies.

People in neighboring businesses will get a weak signal if they get any signal at all.

You could also try installing a second AP in the dining room, and turning down the power on both wireless APs. This will also reduce the coverage area.

These techniques may be able to reduce or eliminate the amount of "stealing" of your wireless that goes on, without requiring that you change the network password regularly. However, if you have an oddly shaped coverage area it may require several APs and antennas.

So now that you are sure that it's only people in your business using it, you can deal with using shaping or quality of service to limit the amount of impact they have on your business critical network services as mentioned by other folks here. Remember that you not only have to limit incoming bandwidth but also outgoing. I've often found that when network performance really gets bad, it's because of someone saturating the outbound bandwidth (usually a small fraction of the incoming) with file sharing or a virus or worm.

One thing you may want to consider is getting another network connection for customers. Your credit card services may not need that much bandwidth, but you really want them to work no matter if someone is doing file sharing or not. So an inexpensive line for that, and then another line that is independent that the customers can share.

Answer 3

If you want a degree of control and security over who is using your connection, you need to have some form of access ticketing system. This is easy to setup and the wonderful folks at http://www.worldspot.net will give you a free account for this provided that you offer your hotspot free of charge.

Use this in conjunction with a router running dd-wrt firmware with chillispot and you have a fully managed, controlled public wifi system with a customisable opening page and (very important) you can ensure that people using your service click to agree to your terms and conditions of use before proceeding.

Answer 4

Here's what I've done with DD-WRT to make an open (no password) "guest" network for my own home. If your problem is your neighbors, set a password but change it every night and write it on a sign that people inside your restaurant can see. It soon won't be worth their trouble to keep up.

Start with a new Virtual Interface under Wireless, Basic Settings. Be sure it has a different subnet than your main network. "AP Isolation" is the setting that stops different WiFi clients from communicating with each other.

I then created custom firewall rules under Administration, Commands, Firewall.

# Forbid Guest to communicate with local network.
iptables -I FORWARD -i ath0.1 -o br0 -j DROP
iptables -I FORWARD -i br0 -o ath0.1 -j DROP

# Forbid Guest to communicate with router except DNS and DHCP
iptables -I INPUT -i ath0.1 -j DROP 
iptables -I INPUT -i ath0.1 -p udp --dport 53 -j ACCEPT 
iptables -I INPUT -i ath0.1 -p udp --dport 67 -j ACCEPT

# Allow Guest to talk to Web & Email but not general Internet.
iptables -I OUTPUT -o ath0.1 -j ACCEPT
iptables -I FORWARD -i ath0.1 -j DROP 
iptables -I FORWARD -i ath0.1 -o vlan2 -p udp --dport 53 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 80 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 110 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 143 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 443 -j ACCEPT
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 8000 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p tcp --dport 8080 -j ACCEPT 
iptables -I FORWARD -i ath0.1 -o vlan2 -p icmp -j ACCEPT 

# Move general TCP rules back to top of chain.
iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -D FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Lastly, under NAT/QoS, QoS, Netmask Priority, I limited the bandwidth use of the guest network so a freeloader can't significantly impact the internet link. (There's actually a guy in our neighborhood who obviously doesn't have WiFi at home and so roams the back paths with his tablet.)

Since you have legitimate customers, you probably want to set this to a sizeable fraction of your available bandwidth but keep enough for your business equipment.

Answer 5

Your current setup is weak in therms of security. If you let your guests access your network they can hack themselves into your router and configuration. My advice is to create a separate guest network. Also WEP is a weak type of security. It is very easy to break into.

I advice you to follow this tutorial, which is about setting up a separate guest network with Tomato, an open-source router firmware.

You also might want to look into channel-switching, it will improve the quality of your wireless signal.

Answer 6

Having multiple access points at one area is generally a bad idea. I hate to keep connecting to a weak signal public node, because of a private router somewhere up the ceiling jamming the signal - just to tell you, that my $2 went out in exchange to coffee and some bad wifi. And yeah, after connection is established, it is your neighbor's connection/your another private network.

our employees also use this connection and it is SLOOOOWW

Add a traffic shaping rule. I don't know, what software is available to you, but 1) most corporative firewalls like Kerio can do 2) Linux can do 3) Cisco can do 4) Cisco clones can do: just make 2 VLAN's, give a priority to first.

Plus, we only get 1-2 bars (our of 5) of signal when we are upfront while the router locate in the office in the back

Walls have wires, wires make noise. Gain more dbi with a better antenna. Also.. some wifi devices are very dependent on the low power signal's soruce direction: once you have 5 bars signal, it doesn't matters how you orient your laptop, got 1 bar? turn the laptop 90 degrees, got none.

Answer 7

You need a wireless router that supports multiple SSID's. If the router supports multiple SSID's then it usually supports the capability to make one private and one public, and limit bandwidth, etc. accordingly. Note that this isn't the same as multiple "physical access points" but presents multiple "logins" through a single access point.

SOHO/business class routers are the ones that might tend to have this feature. A company I used to work for subscribed to DSL and got a Netopia router which is capable of this.

Answer 8

Many high-end home routers offer guest accounts with bandwidth control, but again, you're looking at having all your guests use the same login and password.

One solution that might appeal to you is "authentication via receipt", where your customers have a simple, randomly-generated password on their receipt that is good for a predetermined length of time. I've experienced this as a customer in a coffee shop, and the cashier simply asked if I wanted wifi. I answered "yes", and she punched (I think) one extra button in the checkout process. Your guest access changes constantly, but you don't have to handle the changes. Your customer has the added security of having their own login, defeating FireSheep. A 5-minute search turned up a couple of providers - just look on "authentication via receipt" and similar phrases and I'm sure you'll find others. Any company offering this product should be willing to either install it for you or walk you through it. It seems tailor-made for your situation. Your neighbors will be out of luck.

I second the recommendation to upgrade your security to WPA2 - if WEP is what's protecting your commercial access as well, someone sitting in your parking lot for an hour or so with a laptop can crack it and steal customer credit card information.

As for range, several earlier answers made good suggestions about moving the router around. If those don't work, and if you have an older router, I'd buy a new one that can handle WPA2, guest accounts, and a wireless N connection on two frequencies (dual band). That's usually shown on the box as "802.11 a/b/g/n", with "dual band" indicated as well. Some of the newer ones might have "ac" as well, but that's not important at this point. The site smallnetbuilder.com reviews routers for distance and functionality, and is a useful reference in general. That, plus reading reviews at NewEgg and Amazon will give you an idea of what routers are getting the job done.