Best way to secure a LAN network

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Best way to secure a LAN network

gordonz

52 posts

Master Geek

#72558 29-Nov-2010 04:37

I have a small tourist accommodation and provide a password protected wifi for guests to use.
I now want to install VOIP phone in each unit, what is the best way to prevent the LAN cable to the IP phones being used to obtain un-metered internet access other than physically making the plugs inaccessible?
Could I use the MAC addresses of the phones and prevent any other device from connecting?
I use Linksys WRT54GL routers for the wifi but would need to buy another router to provide extra sockets for the 7 or so phones. Any recommendations on routers?

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz

freitasm

BDFL - Memuneh
80654 posts

Uber Geek
+1 received by user: 41050

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#410543 29-Nov-2010 07:25

You could install a second WRT54GL and configure its firewall to only allow SIP traffic through. You'd need a switch to use more than the four LAN ports in the back...

What kind of connection do you have and what speeds? You would probably need to use something like DD-WRT firmware on both WRT54GL and configure some QoS (Quality of Service) to give priority to the VoIP service - otherwise someone using the wireless connection for a large download could impact the quality of your voice calls.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#410557 29-Nov-2010 08:54

Buy a Mikrotik router and get somebody to configure this for you. It'll solve all your problems and create a far better hotspot solution as well.

webwat

2036 posts

Uber Geek
+1 received by user: 145

Trusted

#410830 29-Nov-2010 19:35

I would say an option is to connect phones directly to a switch that only connects a voip PBX if you have one there onsite. You probably still want to get a network security guy to filter LAN traffic since you don't want customers messing around with your voip system.

Time to find a new industry!

nate

6473 posts

Uber Geek
+1 received by user: 458

Retired Mod

Trusted

Lifetime subscriber

#410887 29-Nov-2010 21:19

webwat: I would say an option is to connect phones directly to a switch that only connects a voip PBX if you have one there onsite. You probably still want to get a network security guy to filter LAN traffic since you don't want customers messing around with your voip system.

How will you stop people stealing the VoIP phones? They will be worth far more than your standard Warehouse bought telephone.

gordonz

52 posts

Master Geek

#410907 29-Nov-2010 22:01

Thanks everyone for all your suggestions. We are in a very isolated location for technical help and I am not always here to sort out even basic problems so I want the minimum of sophisticated set-up and gear on site. Maybe the simplest way is to just have a LAN cable coming out the wall and a plate screwed to the back of the phone to prevent access to the RJ45 plug. Guests get limited free Wifi enough for most to do e-mails and some browsing (50MB/ day) so theres not a lot of motivation to get more bandwidth.

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz

gordonz

52 posts

Master Geek

#411170 30-Nov-2010 13:27

Maybe it would make more sense for me to use a SIEMENS Gigaset A580 IP Phone. I could then use a inaccessible transmitter between every say 2 handsets place the phones wherever I like in the units at a very reasonable cost per unit and with fewer LAN cables.
I am using 2talk and at the moment. I plan to have a separate extension for each handset but no PBX (to keep the set-up simple).The guest units can make local calls for free with a PIN required for long-distance calls and also call reception .
Any comments on this possible set-up?
How hard is the provisioning of the A580 for 2talk?
Is the A580 the best unit for the job?

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz

Dyson

Shop now for Dyson appliances (affiliate link).

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#411197 30-Nov-2010 14:08

From experience I can say without a doubt your best option is to forget about VoIP handsets. Go for a 8 port SPA8000 SPA ATA and use corded analogue phones.

Use cordless phones and they will get damaged/destroyed/stolen (take your pick, 1 option applies per customer).

gordonz

52 posts

Master Geek

#411239 30-Nov-2010 15:22

Thanks, I had that possibility in mind too but good to hear from someone with experience in the field.
We don't get any theft to speak of in 7 years running the operation (the wonders of keeping a credit card on file and catering to the market segment that we aim for) but the simpler we can keep it for us and the guests the better.
Do you still have all or most of the 2talk functions available with a guest analogue phone?
Would we still need a more sophisticated phone in the reception?

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz

webwat

2036 posts

Uber Geek
+1 received by user: 145

Trusted

#411551 1-Dec-2010 11:29

Yes good point about risk of theft. VoIP handsets are more complicated to use and more valuable/tempting for people to steal. You can use the same wiring to connect POTS phones to a 8-port ATA or PBX in your office, so you are still using voip but customers use it from the old phones.

Time to find a new industry!

gordonz

52 posts

Master Geek

#411570 1-Dec-2010 12:05

Do you still have all or most of the 2talk functions available with a guest analogue phone?
Would we still need a more sophisticated phone in the reception?

As a newbie I am still coming to grips with the possibilities of VOIP in our situation, thanks so much for all the help and ideas.
Looking over 2talk's website all the basic PBX functions (call transfer, call waiting etc) that I think we need seem to be done using simple key pad entries so I think a $25 basic analogue phone plus and 8 port ATA and one 028 extension per guest unit will suffice avoiding the need for an on-site PBX and good cost savings and all the programmable stuff is in the office which avoids having to disturb guests if anything isn't working.
I can see we need a phone with a display for the reception and office and possibly programmable keys to quickly and easily transfer calls to the extensions but I am just working out if we need a IP phone for that or if an analogue one will suffice?

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz

webwat

2036 posts

Uber Geek
+1 received by user: 145

Trusted

#412764 4-Dec-2010 10:44

Probably useful to get nice voip handsets for the reception and office if its already got compatible cabling for computer + phone, or if you can get more ethernet outlets to each work area. You might want to allow an extra landline phone at reception as an emergency backup, for when internet goes down or 2talk drops out.

Time to find a new industry!

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

gordonz

52 posts

Master Geek

#412779 4-Dec-2010 11:46

webwat: Probably useful to get nice voip handsets for the reception and office if its already got compatible cabling for computer + phone, or if you can get more ethernet outlets to each work area. You might want to allow an extra land-line phone at reception as an emergency backup, for when internet goes down or 2talk drops out.

Yes I am thinking the same, keep my land-line for the efpos machine, use the Voip phones for out-going calls for both ourselves and the guest's local calls and that way free up the land-line for booking enquiries etc.
Once we have some experience and trust in the Voip system I think I would get the incoming calls to go first to the Voip then to be forwarded to the Telecom land-line if there is no answer.
Does the SPA8000 have the ability to route internal calls from one line to another without using the Voip?

Research Scientist, BBC, Kingswood Warren, UK in a previous life (1970's).
Now Owner/Operator of a Luxury Resort www.adrift.co.nz