From owner-freebsd-questions@FreeBSD.ORG Fri Jun 30 09:13:25 2006 Return-Path: X-Original-To: questions@FreeBSD.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0884816A5FC for ; Fri, 30 Jun 2006 09:13:25 +0000 (UTC) (envelope-from norgaard@locolomo.org) Received: from strange.daemonsecurity.com (59.Red-81-33-11.staticIP.rima-tde.net [81.33.11.59]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53DD944648 for ; Fri, 30 Jun 2006 08:48:35 +0000 (GMT) (envelope-from norgaard@locolomo.org) Received: from [192.168.7.193] (68.Red-80-34-55.staticIP.rima-tde.net [80.34.55.68]) by strange.daemonsecurity.com (Postfix) with ESMTP id CF4162E021 for ; Fri, 30 Jun 2006 10:48:33 +0200 (CEST) Message-ID: <44A4E55B.3020908@locolomo.org> Date: Fri, 30 Jun 2006 10:48:27 +0200 From: Erik Norgaard User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: questions@FreeBSD.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: Subject: wifi: Combining open non-encrypted AP and EAP-TLS in one X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jun 2006 09:13:25 -0000 Hi: I have got the idea that I want to set up a hostap on my FBSD box. My idea is that I want to allow strangers to associate and get their network configuration via dhcp. Any attempt to access the Internet will then be redirected to a web page explaining that they have to register first. Once registered, the AP should support (or rather require) EAP-TLS and allow access to the Internet. I know, this sounds very much like VPN. Indeed it is, (and I might fall back on this). But the difference is that it is bound to a particular wireless network. Users may connect to other networks where all this is not required. So for usability I think it is easier if the wifi controller takes care of connecting with the correct certificate. So, my first question: Is it possible to configure a Wireless NIC in hostap mode to support both non-encrypted open association as well as EAP-TLS (or some other type of encryption/authentication scheme)? Secondly, is it possible to make the firewall (on the the hostap box) aware of whether a client uses security and only allow access if the wireless connection is encrypted? I use packet filter, and this is somewhat like authpf w. ssh that can invoke rules, or it could be solved with the traditional VPN. But I would like to use the EAP-TLS scheme. Thanks, Erik