Bridging Firewall to Public Wifi

Question

My building offers wifi to its residents. It is not managed by IT professionals. I would like to use this internet source some of the time, but would like to be protected from machines on that network as well as protected in general. Consider that I have a spare machine with a PCI wireless adapter, a switch and a few machines connected to the switch. Is it feasible to configure the spare machine such that it connects to the building wifi and serves the few machines connected to the switch? Does this cause a NAT issue. Is this something that could be configured with PF Sense, pf in Open BSD, or something similar? I am a novice-intermediate user. I have not configured or managed a firewall before, but I've been using Linux exclusively for a couple of years. So long as the above is possible, I could probably figure it out.

Answer 1

pfSense should absolutely work. My immediate response was going to be to get a cheap router capable of OpenWRT (Neatgear WNDR3700) and connect to the WiFi though Luci... but that was before I saw that you already have hardware. It is absolutely do-able and I encourage you to try it.

As to whether it'll cause NAT related issues, that largely depends on how you configure it. When I did this same thing using OpenWRT, it would have put me behind a second NAT if configured the way you are looking to do it. This can be worked around (disabling NAT, accepting DHCP from the building server rather than your box, etc...). Basically, you are just trying to put IPTables between you and the building WiFi.

I can fire up a virtual machine (or several) and help you pound through it if you hit any snags.

Answer 2

There is one free Linux distribution that matches your requirements and that's ZeroShell.

It provides the main LAN services for small-to-medium-sized networks, similar to the commercial solution RouterOS. It's offered on a Linux LiveCD, so it doesn't have to be installed. It just needs a small drive to save the configuration.

ZeroShell can perform as a router, firewall, RADIUS server, wireless access point, VPN, and more. It includes QoS, hotspot, and Internet load-balancing and fail-over features. It also supports VLAN tagging, multiple SSIDs, and Windows Active Directory.

As it's free and runs from a liveCD, you can try it without much effort. Here is a good starting tutorial provided by LinuxPlanet.