Dobro & Network
Dobro
Hey! I’ve been thinking about setting up a free community Wi‑Fi hub for local shelters and I could use some help with the tech side. What do you think?
Network
That’s a noble idea, but we need to keep the stack tight. First, make sure you can route packets with low latency—use a dedicated VLAN for the hub so the shelters don’t interfere with your own traffic. Put a firewall in front, and think of authentication like a handshake: no rogue devices, just captive‑portal‑authenticated clients. Add fail‑over with a spare router and a static route table so a single outage won’t knock the whole thing down. And don’t rely on a “smart” cloud gateway you didn’t set up; write the config yourself so you know every rule. If you can keep the topology simple and monitor logs in real time, the hub will stay online long enough to help.
Dobro
That sounds like a solid plan! I’m happy to help write those config files or set up the VLANs—just let me know what you need next. And if you want a quick rundown on monitoring, I can pull together a simple dashboard too. We’ll keep the hub running smoothly so everyone can stay connected.
Network
Glad to hear you’re on board. For the VLANs, we’ll need a separate ID for the shelter traffic, a static route table, and ACLs to block any broadcast storms. The config file should list every interface, the MTU, and a dead‑man heartbeat to a secondary router. For monitoring, set up syslog to a dedicated server and a simple Grafana panel that tracks packet loss and jitter. Let me know which interface you’re using as the uplink, and I can draft the exact snippet. Just remember, every rule we add is a line of defense; keep it tight and keep it documented.
Dobro
Thanks for the details! My uplink is the eth0 interface on the router, so that’s the one we’ll be pointing to the core network. Let me know if you’d like me to start writing the ACLs and heartbeat script or if you want a quick overview of the MTU settings first. We’ll keep everything documented so it’s clear for the team.
Network
Let’s start with the MTU. Since we’re on a standard Ethernet link, 1500 is fine unless you see fragmentation in the logs; then drop to 1472 for IPsec or VPN use. After that, move to the ACLs—lock down all ports except HTTP/HTTPS and maybe SSH for admin. The heartbeat script can just ping the secondary router every minute and log to syslog. Keep everything in a single config file with comments on each block; that’s how you won’t lose track during a reboot. When you’re ready, send me the draft and I’ll review it for any hidden packet leaks.
Dobro
# Router Configuration Draft for Community Wi‑Fi Hub
# -----------------------------------------------
# Uplink Interface (eth0) – connects to core network
interface eth0
ip address 192.0.2.2 255.255.255.0
mtu 1500 # Standard Ethernet MTU
description Uplink to core
no shutdown
# Downlink Interface to shelters (eth1)
interface eth1
ip address 10.10.10.1 255.255.255.0
mtu 1500 # Same MTU, change to 1472 if you see fragmentation logs
description VLAN for shelter traffic
no shutdown
# VLAN configuration (if using a switch)
vlan 100
name ShelterTraffic
exit
interface eth1.100
vlan 100
ip address 10.10.10.1 255.255.255.0
no shutdown
# ACLs – restrict to essential ports
access-list 100 deny ip any any log
access-list 100 permit tcp any any eq 80 log
access-list 100 permit tcp any any eq 443 log
access-list 100 permit tcp any any eq 22 log
access-list 100 permit ip any any host 10.10.10.255 # Broadcast for VLAN
interface eth1
ip access-group 100 in
# Static route table – keep it simple
ip route 0.0.0.0 0.0.0.0 192.0.2.1 # Default gateway to core
# Heartbeat script – runs every minute, logs to syslog
# (This would be saved as /usr/local/bin/heartbeat.sh)
##!/bin/sh
# ping -c 1 192.0.2.3 >> /var/log/heartbeat.log
# logger -t heartbeat "$(cat /var/log/heartbeat.log | tail -n 1)"
# Scheduler to run heartbeat (example cron entry)
# * * * * * root /usr/local/bin/heartbeat.sh
# Syslog configuration – forward logs to dedicated server
# (Assumes syslog-ng or rsyslog)
#logdest syslog {
# udp {
# host 203.0.113.10 port 514;
# }
#}
# Grafana Panel – you would point Grafana to the syslog or SNMP data source
# No config here, just a reminder to set up a panel for packet loss and jitter
# End of configuration. Feel free to tweak MTU or add more specific ACLs as needed.
Network
Looks solid, but there are a few quirks to tighten. First, you defined eth1 twice—once as a plain interface and again as eth1.100. Drop the plain eth1 block if all traffic goes through the VLAN; otherwise keep both and assign one to the VLAN trunk. Second, your ACL 100 blocks everything except the three ports and the broadcast, but remember that DNS (53) is essential for clients—add a permit line for UDP/TCP 53. Third, the static route points to 192.0.2.1; make sure that’s the real upstream gateway. For the heartbeat, instead of writing to a log file then cat’ing it back into logger, just pipe the ping result directly: ping -c1 192.0.2.3 | logger -t heartbeat. Also consider enabling SNMP traps on eth0 so you get an alert if the link drops. Finally, add a NAT rule on eth0 if the shelters need internet access through that same gateway. Other than that, comments are good and keep everything documented. Let me know if you want the exact ACL lines with DNS added or help setting up SNMP.
Dobro
Thanks for catching those! Here’s a quick updated snippet with your tweaks:
# ACL updates – add DNS and keep the rest tight
access-list 100 permit tcp any any eq 53 log
access-list 100 permit udp any any eq 53 log
# Keep the VLAN only, drop plain eth1 if it’s just a trunk
interface eth1.100
vlan 100
ip address 10.10.10.1 255.255.255.0
no shutdown
# Heartbeat simplified
# ping -c1 192.0.2.3 | logger -t heartbeat
# SNMP trap example (basic)
snmp-server community public RO
snmp-server enable traps linkdown linkup
# NAT rule for shelter internet
ip nat inside source list 1 interface eth0 overload
access-list 1 permit 10.10.10.0 0.0.0.255
Just let me know if you’d like the full ACL block with DNS added or help wiring the SNMP traps. Happy to make it perfect for the shelters!