WiFi for the office

[mjts2345]

Hey everyone,

Just have some Q's for secure wifi options for work. I'll lay out the environment, then ask what options we might have. Would love input.

I work for a non-profit organization. We would like to have wifi in the office, but have some needs and concerns.

Needs:
1) We have 10 employees who need WiFi (iPads mostly, but some laptops)
2) We have hundreds of volunteers that are in the office on any given week, and we would like them to be able to utilize the wifi

Concerns:
1) There are secure files on a server in the office. Currently only those logged into the internal network can access these files. It's important that only the employees can have access to these files.

So I ask, is there a way to have wifi with double layer security. In other words one password for employees that allow access to the server and files, and one password for volunteers that just allow access to data for internet use?

Thanks for all your insight and thoughts. Very much appreciated.

Happy to answer any other questions that might help give solutions.

~Mjts2345

[Detonate]

Easiest way would be to use two routers, daisy chained. the first router would be open to the public, the second router, fed by a cable from a lan port on the first router to the wan port on the second would have a WPA2 secured wireless point for the employees. I would choose two different brands of routers with different gateway IP addresses to avoid IP conflicts. I too work for a non-profit that provides free income tax preparation service. I have them setup this way, except one site where I don't have a wired connection to the first router. At that site I use one computer to connect to the wireless network on the unsecured router and use internet connection sharing on that computer which is connected to a lan port on the second router and has Windows Internet Connection Sharing enabled. DHCP is turned off in the second router and a wireless network is created using WPA2 -AES only. Employees connect to that router wirelessly. You may have to change some gateway IP addresses in the routers to make this work. If you run into problems I can probably help. I have done this several times. You might also look a getting a WAP, I have not tried this but it might be even easier.

[edfair]

I did this with a WAP and assigned IPs in the lower part of the IP range, manually fixed IP addresses of the local machines in higher ranges and restricted access on the server to specific machines. But I suspect that your mix of equipment will require more.

Have also done it with multiple routers used as switches all in the same network by segmenting the assigned addresses. But this was with fewer nodes and without your mix.

[glc]

The simplest way is get a router that has a "guest access" feature. No password required, and it's run on a completely different subnet than the secured access. This will allow guest Internet access but no network access. I believe most, if not all, of the Linksys E-series routers offer this.