4

I have a rookie question regarding routing and wifi access points.

Background

I have a main switch (cisco catalyst 2950) that sits behind my router/firewall. On that switch I have an IDS (snort) listening on a span port, which is mirroring all traffic entering and exiting the network. I also have a Linksys WRT54G wifi router proving wireless service whose "internet" port is also plugged into the switch.

The network is segmented into two subnets, x.x.1.1/24 for the wired portion of the network, and x.x.2.1/24 provided by the linksys ap for the wireless.

Issue

My issue is that when reviewing alerts from snort, any traffic from the x.x.1.1 network can be attributed to the actual machine behind my network, but traffic coming from a machine on my wifi router has a source (or destination) ip of the AP itself.

Now, I understand that this is because the wifi router is a router and as such, is acting exactly how it is designed to.

Question

I need to provide wireless access, yet provide the IDS insight into the actual source/destination machines on the wireless network. But I'm not sure if it's possible. Is there a feature/technology/mode that can be found on wifi routers that will let me extend the x.x.1.1 network? Do I need to replace the wifi router with some other piece of wifi equipment?

Considered Options

I've looked at the following options:

  1. Spanning a port of the wifi router to monitor traffic on the x.x.2.1/24 network. My current wifi router doesn't provide span/mirroring capability and doesn't appear to support modified firmware images.

  2. Putting the wifi router in some "mode" that allows it to not "route" traffic. My hardware currently has a gateway mode and a router mode. Both modes appear to cause the same issue. Is there another "mode" that may be available on other consumer level wifi access points?

  3. Purchasing a piece of hardware that does not route traffic but provides wireless access? Does this even exist?

I understand that this is a complex question with imperfect information. A complete answer would be fantastic, but something that gets me on the right track would be more than enough. Thanks for reading to the end!

Improve this question
3
  • 1
    Considering this is your first post, it's excellent - well written and clear (although maybe a bit long :) ) +1
    – Dave
    Mar 4, 2013 at 16:26
  • Why did you connect the router's Internet port to your LAN rather than connecting one of its LAN ports to your LAN? (LAN ports are for other devices in the same LAN. Internet/WAN ports are for connections to other networks.) You chose to create two LANs. Why?
    – David Schwartz
    Mar 4, 2013 at 16:47
  • Rookie mistake. By highlighting that issue, you put me down the right path. Thank you!
    – J.T.S.
    Mar 4, 2013 at 16:56

2 Answers 2

Reset to default
1

You have two LANs instead of one. Unless you did this for some reason, change it so that you only have one LAN.

Disable the WRT54G's DHCP server. A LAN only needs one DHCP server.

Connect one of the WRT54G's LAN ports to one of the 2950 ports. Disconnect the Internet/WAN port -- this router will be connected only to your LAN.

Let any devices connected to the WRT54G get new IP addresses from the router in your LAN.

Improve this answer
1
  • Awesome - You hit it square on the head. The key was utilizing a lan port on the WRT54g instead of the "internet" port. Thank you!
    – J.T.S.
    Mar 4, 2013 at 16:54
1

If the traffic from your AP all has the AP's IP address then it's doing more than routing: it sounds like it's NATting. In other words, the addresses that it gives wireless clients are private to that network, and are all translated to a single address by the AP.

I don't have a WRT54G, but from a wee bit of Googling I gather that you can't disable NAT without also losing its DHCP server functionality. On the other hand, you're fortunate in owning an AP that is well supported by third-party firmware. If you can install DD-WRT (or one of the other projects') firmware, you'll have much more control over your device.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .