Filtering for Church WiFi

[CWW]

Hi all,

I'm a software engineer but not real savvy on new networking products. I'm on the technology committee for my very small rural church. Last year, we were able to receive DSL at the church, which is in the village center. Many members of the church and the surrounding community do not have high speed access at all. We'd like to allow public high speed internet, but we'd like a content filter to keep our kids safe and not allow illegal activity (such as downloading pornography or pirated music). We are only staffed a few days a week, but we have a locked office for the equiptment while the social rooms and sanctuary are always open.

I am looking for a wireless router that will allow me to put in place the filtering I need without requiring a computer to be left on in the office 24/7.

Any help would be appreciated and welcome.

[[Admin] danroth]

OpenDNS -
you can use it with any router

[[Admin] osborn4]

Another option is an iBoss filter. It's a small appliance that goes between the router and the modem.

That's what we have at home and I like it.

Although, if I had heard of OpenDNS before purchasing the iBoss, I would have checked it out first.

[CWW]

Thank you very much - I should have read in more detail about these options in the other thread. OpenDNS will work perfectly for what we want to do. We'll be up and running by the end of the day.

[jonack]

One thing you should really think about is segmenting your internet. A decent router would allow you to split your network into two distinct and separate pipelines. One would be specifically locked down and MAC addresses you allow along with a really strong password that way your computers of staff and your church organization are kept safe and secure without any issues. The 2nd would be an open system for those in the community. One thing to think about is that even a really strong signal can only be read from about 100 feet away with open line of sights usually. If you truly want to feed the neighborhood you should affix your antennas on the outside of the building as high as you can get it. That way the signal pushes as far and as strong as possible. One thing you need to look into is your user agreement with whoever is giving you DSL. Often sharing a connection with other people who don't work at the business or live in the residence is forbidden via your user agreement. They will take notice when your DSL connection is continually slammed with tons of traffic and usage at all hours of the day...Especially for a church.

I would buy a nice two segment router then segment the other section for outside traffic and filter using OpenDNS just like danroth said.

One last piece of advice: Make sure you have policies in place before you do this, and those that are in charge know all of the peaks and valleys. It could be a huge neighborhood outreach with great kingdom spreading benefits or if you get hacked and people steal all of your data...a huge burden on the church....

[darmstrong]

Some additions, some custom antennas can be used to share the signal farther. Google search ccrane and look at there wifi antennas. (2nd thread I think I've mentioned these antennas and I don't even work for them.)

As far as user agreements, our current business plan includes wifi sharing of internet. We are not sharing internet to those people who live near us, but rather for those people on our grounds. Of course, that does include a few people occasionally in our parking lot.

IPCop will do routing, firewall and filtering fairly easily. I use it on our church network and personal network. It requires an old computer and 2-3 network cards. 3 is prefered for you setup as it has 1 card for traffic coming from the internet, 1 card for your church network and 1 card for your wireless network. Using VPN, you can connect to your church network from the wireless network.

[jonack]

darmstrong:
Does the IPcop act as a network segmenting tool? That seems really interesting. How do you load multiple network cards in it and without any issues. One thing to think about is if you have multiple people connecting that it might slow down your internal network connection. If IPcop had some bandwidth shaping tools that would be pretty sweet!

[darmstrong]

Originally Posted by jonack

darmstrong:
Does the IPcop act as a network segmenting tool? That seems really interesting. How do you load multiple network cards in it and without any issues. One thing to think about is if you have multiple people connecting that it might slow down your internal network connection. If IPcop had some bandwidth shaping tools that would be pretty sweet!

IPCop was originally designed to be a ultra secure Linux firewall. It supports 4 network cards. Typically they are Red (the internet), Orange (DMZ), Green (Your regular network), Blue (wireless network or secondary network). It is designed to run as a proxy, DHCP server, firewall, traffic shaping, dyndns updater, Through the use of addons, you can gain features like filtering, advanced proxy settings, basic traffic shaping, authetication, Open VPN, update accelators,

It's designed to run on OLD computers and uses a web interface primarily. My original setup here at my house was a 486 with 96 MB RAM. I had no issues, other than, I always wanted more space for my updates. (It will cache any Windows Updates, Avast Virus Updates and some other programs to a directory for easy access)

The addons do take the command line to install, but they are EXTREMELY to install.

[CWW]

I was planning on having the single church computer (powered up only 8-10 hours/week) with the records on it not be on the wireless network at all but connected directly to the DSL modem. There is no reason at all I can think of to have wireless enabled on the office desktop computer, so it should not be visible on the wireless network. Is this a correct understanding? This is how I keep my financial records and other private data off of our wifi network at home.

We have been working on some policies but it would be great to see examples if any other faith communities have put this in place. Because we're not a very tech savvy church, I also want to include information about protecting your own personal information on a shared wireless network.

[[Admin] osborn4]

If it's plugged into one of the ports the wireless router,then it will be visible. That's how the laptops in my house share the printer connected to the desktop.

I'm not a LAN guru, so I'll let others come up with ideas on how to segment your office computer away from the WiFi users.

[CWW]

Right - and it will be plugged into the DSL modem only (which is not wireless). The wireless router will be connected to a separate port on the DSL router. That's the plan anyway.

[tedanderson]

I have a similar setup where my wireless is segmented from the rest of the office so that if a client comes in and wants to use their laptop, they can.

I have a 4-port wireless DSL modem w/built in firewall and router. What I did was install second wired router behind the DSL modem and then I configured it as a different network. All of the office PC's run on 172.16.x.x and all of the visiting wireless users come up on 192.168.1.x giving them a straight shot out to the public network. The wired router is seen as wired DHCP client on the 192 side making my 172 side invisible if someone attempts to hack my network.