Hi,
I have a "firewall"-box configured as NAT-router/firewall/transparent proxy which makes a connection to the internet with a WLAN card (to a hotspot). In fact for the moment it's a Kerio Winroute firewall on a Wintel box.
So the "firewall"-box has actually 2 interfaces. One wired (connected to the internal LAN) and one USB wireless adapter which makes the connection to the internet through an access point.
The connection setup works fine when the firewall is disabled but as soon as I start the firewall I also start losing the connection. The strange thing is that even though the Wireless monitor application (that came with the WLAN card) indicates the it has no connection to the internet anymore the clients behind the firewall can still connect sometimes.
I have the same situation when I use the WLAN card on my PC and turn on a personal firewall.
I assume that certain traffic cannot pass anymore once the firewall is running and maybe that's why the connection is dropped after a while.
Now my question. What's the exact traffic flow involved in the "connection setup" and "keep alive" of a wireless connection and which ports need to be open on the firewall to keep the connection alive?
Of course I don't want to have any unnesessary ports opened on the outside interface.
Thanx for your answer.
Software/Hardware used:
ASKED:
September 6, 2005 3:52 AM
UPDATED:
September 9, 2005 9:06 AM
I already tried to allow these services between the access point to the external interface:
- DHCP/BOOTP
- all ICMP
- HTTP (the access point seems to send an announcement message encapulated in an HTTP packet)
Most software based firewalls include a log of denied traffic. Your best bet is to watch the log and see what traffic is denied. You can then open the specific services you see are repeatedly blocked which are involved in maintaining the connection.
Alternatively, you can do the research on the protocols. However, you might need to check with your ISP to see what proprietary things they might be doing to secure the hot spot.
Best regards,
Telecomking
I already tried logging dropped packets but I don’t see anything dropped. Where could I find the exact connection setup sequence from a WLAN card to an access point?
Hi !, You said that you don’t want unnecessary ports to be accessed, is that right. Use some traffic analysis tools to check on TCP/UDP ports open and use some other tools to redirect known traffic thru your configured ports in the Fwall.
This way you can monitor your clients traffic while keeping your infrastructure safe.
Hope it suffices.
Thanks