Hi Everyone,
I'm trying to create 'Guest' Hotspots using a UTM425 (on 9.105-9) and AP30's.
I've followed the guide (new interface, masquerading, vouchers, etc), and everything works fine as expected. I can connect to the unsecured hotspot and get directed to the portal to enter a voucher code, after which I can access the internet.
The problem I've found is that clients connected to a Hotspot for some reason can access IP's on our internal LAN's.
For example, we have some fileshares, for arguments sake on \fileserver\share. If I try accessing the share using the hostname of the server, I can't resolve it and access it. It's the same for internally hosted websites too.
However, if I use the internal IP address of the fileserver instead of the server's hostname (ie, \10.10.10.2\share), I can access the shares with no problems. It's the same for internally hosted websites. If I replace the hostname with the internal IP of the server that's hosting the site, it opens fine.
Surely this shouldn't be the case? The hotspots are set up as 'separate zones', on a completely different subnet to our internal LAN's.
The guest WLAN interfaces are not members of any firewall rules that allow them to pass traffic to any of the internal interfaces (that I can tell). The only firewall rule in place for them allows 'web browsing' and 'VPN protocols' to 'internet', which in turn is bound to our internet connection interface.
I've been crawling through all the Firewall and NAT rules we have and cannot see how the traffic is being passed between the networks.
I was wondering if the problem lies with the VLAN's we have on our internal network and L3 switches routing the traffic before the UTM saw it, but from what I've read, these access points create an SSL connection between the access point and the UTM so it shouldn't matter if there are routes on other network equipment, the UTM should be handling all traffic from its AP's?
As a test, I connected an AP directly to the UTM on a spare NIC we had with a completely separate subnet to our internal LAN's, but the behavior of the hotspots was the same.
Have I found a potential bug, or could there be something I'm missing somewhere?
This is quite worrying as it means our guest hotspots aren't as secure as we need them to be.
I'd appreciate any suggestions, and if anyone needs more information, just let me know what you need to know!
Thanks!
This thread was automatically locked due to age.
