Thetownend.com

Scenario:- We have foreign students, obviously they like to use my internet connection. Our latest student is from Kazakstan. I use OpenDNS to block access to file sharing sites etc. Looking at my OpenDNS logs he has been trying to access p2p sites and when that hasn't worked, proxy sites to bypass the restrictions, which are also blocked. Having read up a bit I realise that OpenDNS is not infallible, all it needs is for him to change the DNS servers in TCP/IP connections and it's bypassed, obviously I can't have admin rights on his lappie. My adsl router is a BT Business Hub 2700HGV, the firewall is pretty basic tbh, I can port forward but I can't block specific ports ie 53

If there's any downloading to be done, I'll be doing it, not some student

So I'm looking for some ideas from you tech savvy lot, not too expensive tho please

cut his fingers off - he's from Kazakstan, he'll understand

nice!

I presume it's Windows, so you could edit the Hosts file, although you'd likely have a fair bit of editing to do.

If they're female and decent put a webcam on and tell them they need to be naked and do dirty things before the internet will work. They're from Kazakhstan and its probably normal there.

Not sure I like the sound of that one Barry. I was thinking along the line of a hardware firewall, but these seem quite expensive. Was sure router had a bridge mode, but it appears not. I'd like the router to handle the BB connection and wireless, is that possible?

chalkie, he's male and I'd like to send him home with all his fingers if poss

As a bit of an after thought Barry, wouldn't editing the hosts file only affect the pc it's installed on? I don't have access to his

Oh right, yeah, it would only affect his pc. I incorrectly presumed you had access to his pc, so I have no idea I'm afraid Mr Ballmouth!

So what is your set up? A small local network at home? Wired or wireless?

Sounds like you need a better router / firewall, which can block certain traffic based on the local ip address or network logon. Haven't got a clue of what options there are, but you should be able to pick up some decent old kit that will be more than capable of what you want. Maybe have a look for some Cisco stuff, an 800 series router should do what you want but you're looking at £150 second hand.

One option is a PC acting as a router and firewall (there are some decent open source solutions for both), worth looking in to if you've got an old one sitting around - doesn't need to be very powerful.

Firewall : http://www.smoothwall.org/
Router / Firewall : http://www.vyatta.com/


What has bridging got to do with it? Not sure you can use it to filter or block traffic and even if you could it operates below the IP (network) addressing layer so would be useless. Wireless routers do handle the internet connection.

Small home network. My pc's are mostly wired inc homeplugs. So just the students wireless. Don't fancy a pc on 24/7 as well as router and I've not got the room. Pretty sure a Draytek 2820 would do the job, but I've had a Draytek before(2800 wireless) the features were great but it used to drop bb connection and even wireless connection so once bitten twice shy. My line is also 1.76km from exchange and the 2700 is good for coping with that, so sync at 7552
Bridge, thought you had bridge from router to firewall. Don't know where I got that from. It does appear that you can't disable firewall in 2700 will that be a problem
Cisco, do you have to have any qualifications to set one of those up?
Always fancied a Cisco 877W might be fun

Bridging operates at the data link layer where all routing is via MAC addresses. Though I think there are some hybrid devices that can do more than that. Either way, not sure it's the place to be filtering though I could be talking shit.

The Cisco 800 series come with an easy to use management tool so no degree required. The cool thing is they all run Cisco IOS so you can fuck about with them at a lower level if you want. So best of both worlds. 

Ok jonny, so how about this one?

http://tinyurl.com/36ryfaf

The 2700 can still handle the BB and wireless I take it?

Would you need a crossover cable to connect 2700 to 873?

I've never looked at the 837 before, I've been planning to buy a later model with wifi - one of the 870's.

I'd look for one that has the maximum amount of ram installed, or make sure upgrading it will be cheap. There are also various versions of Cisco IOS, some with more features that you may or may not need. So it's worth looking for one with the best and latest version, think you should be able to upgrade it yourself but it will mean scouring the torrent sites as Cisco don't give them out for free.

I think you should be able to hook them up together, but the 837 would have to connect to the BB with the 2700 before it - otherwise you won't be able to filter the wifi traffic. The other option is a more expensive 870 series model with wifi, which should do it all on it's own (the 837 and 870's have a built in firewall which should be as good or better than the 2700). Either way, make sure the one you buy has the right BB connection - there are different models for ADSL and cable.

Router to router should be a crossover cable, though it's possible some configurations and routers might need a patch cable. When using two routers you'll need to make some changes to the IP configuration on them, chances are that straight out of the box they'll conflict with each other.

I think your best option could be to leave it as it is and to tell your lodger that he needs to stop downloading porn or you'll block him from the network.

Don't blame me if it goes wrong or doesn't work, I've never tried any of this myself - my networking is more theoretical than practical.

I'm not sure I'm missing something here, and I understand the excitement of a technical challenge as much as the next bloke, but couldn't you just politely ask the student that if you're going to continue to allow him to use your internet, then can he please not use dodgy file sharing sites?

Well you missed my post that says exactly the same thing.

I think you're also missing the point that he likes fucking about with computers so he's looking to make the solution as technically challenging as possible.

Did you edit that in to play mind games with me? I swear I read your post. This reading thing is too much for me.

Oh dear I was relying on you Jonny. If I can get that 837 for basic price of 4.99 plus 4.00 postage, if I can't get it to work, it won't matter too much. I have been looking at the 877W and umming and aarring for quite a while now. Financially they are out of my price range at the mo unless I flog a few things on ebay first

@Ben, that's just too easy, and besides he might say he won't, but the temptation might be too strong. I'd prefer that he didn't have the option

I'd go for the asking not to use p2p sites/software option. If they use them again block their MAC address until they learn.

Or you could find an old computer (or build one from old components) and make a hardware firewall that way. I've never done this mind.

I was just adding a disclaimer so I don't get the blame if it doesn't work. I've done all the studying for the Cisco entry level certification, just need to take the exam and put it in to practice - I've got a big stack of Cisco routers I've been meaning to wire up and play around with at some point.

Detailed info on the 837 here:

http://www.cisco.com/en/US/prod/collateral/routers/ps380/ps4874/product_data_sheet09186a008010e5c5.html

Should be fine provided you've got an ADSL connection (and not cable/Virgin).

Oh you will get the blame, believe me

He's been on his pc all day and OpenDNS has blocked nothing. I'm presuming he's discovered the workaround

Good news jonny. I got it for £8.99. Your the brains in this outfit and if it doesn't work it will be your fault ;)

I deffo haven't got the room for the old pc lark Si, I've got enough of em as it is. I don't like to ask em as it makes me look like a bit of a killjoy, however the £8.99 router should be arriving soon, never mind about jonny's disclaimer

I'm more than happy to take £8.99 worth of blame.

Glad to hear it jonny. It will be fun with you to guide me

You're lucky it wasn't a penny more. I'd have washed my hands of it at £9.

I knw you've bought someting, but there are plenty of all-in-one adls router/wap/content filters out there.

The 2820 as you said and also this from netgear which I have used before

http://www.netgear.co.uk/wireless_adslrouter_dg834g.php

Shame I've only just read the thread, I've got one of those Netgears Bo referred to which you could've had for nothing.

Does that allow you to filter and block traffic based on local ip / wifi id and the type of traffic / source ip?

I've got an older model of that router and I've never seen or found a way to implement that level of control. I was under the impression that you have to block or allow content to the entire network and can't apply it at a user level.

Thanks for the kind offer Samdy, but Netgears' don't perform too well on my line, lot's of disconnections

However if anyone want's to breath new life into a DG then this custom firmware could be for you

http://dgteam.ilbello.com/forum/index.php?action=register

Been out at customers today. I've been carded, think it's arrived. Will collect tomorrow

First problem encountered already. Can't access it. Thought I'd set it up on my other pc, just connect it with ethernet and power up with no adsl connection

Have tried 10.10.10.1 didn't work

Then tried finding the ip via cmd

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>Netsh interface ip show config

Configuration for interface "Local Area Connection"
    DHCP enabled:                         Yes
    IP Address:                           169.254.242.210
    Subnet Prefix:                        169.254.0.0/16 (mask 255.255.0.0)
    Default Gateway:                      0.0.0.0
    Gateway Metric:                       379
    InterfaceMetric:                      20
    DNS servers configured through DHCP:  None
    Register with which suffix:           Primary only
    WINS servers configured through DHCP: None

Configuration for interface "Loopback Pseudo-Interface 1"
    DHCP enabled:                         No
    IP Address:                           127.0.0.1
    Subnet Prefix:                        127.0.0.0/8 (mask 255.0.0.0)
    InterfaceMetric:                      50
    Statically Configured DNS Servers:    None
    Register with which suffix:           Primary only
    Statically Configured WINS Servers:   None

Default Gateway comes up as 0.0.0.0 tried that as well along with 169.254.0.0

Any ideas?

Tried 192.168.1.1 ?

169.254.0.1 or 169.254.0.254

Actually I'm betting with a 169.254.x.x net address and no default gateway that DHCP has failed?

Don't think it will be Samdy as the Ip issued to the pc is 169.254.242.210 with a subnet possibly of 255.255.0.0
192.168.1.1 would give it a subnet of 255.255.255.0

But hey ho will give it a try tomorrow as the San Miguel is going down fine and I'm losing the ability to concentrate

I *think* you need to connect your PC to a specific port to access the config.

Try each of the ethernet ports with 10.10.10.1, though it should be port 2 (from the right).

Did you get a Cisco SDM cd with it? If so, use that instead of the web browser interface (user/pw = cisco/cisco).

Failing that, it might still have the previous config in it which could be fucking things up. So you could connect to the console port and do a factory reset (I can dig out the commands if you need them).

It says what the subnet mask is (/24), so the 1st usable IP would be 169.254.0.1 and the last 169.254.255.254 (allowing for the network and broadcast addresses).

A 192.168.x.x IP doesn't necessarily mean a subnet mask of /24, could be anything /16 or higher. Could possibly be lower, which whilst not good practice for a private network, will work. Of course if you're using classful addressing then it would be fixed at /16, but who does that nowadays?

Thanks Jonny

Will have another peek tomorrow. Not tried port 2, only 1 and 4

Done port 2 now

No Cisco cd. Think I might need those commands, but only when you have time of course

Have asked the seller about the default login. Wether they will be forthcoming is a different matter

No, it would be 169.254.0.1 to 169.254.0.254 with a Class C (/24) subnet mask, but it does say /16 in his post so we'll let you off.


I assume this is second hand?

'870 password recovery via serial:

http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/trouble.html#wp1038210

you might be able to reset to factory default from here?

It is second hand Batch. I've got a sneaky suspicion I've bitten off more than I can chew with this one. That link is gobbeldy gook to me

meh, its just connect a cable and type the commands!

Batch, I'll be honest and say I'm lost at step 1

Step 1 Connect an ASCII terminal or a PC running a terminal emulation program to the CONSOLE port on the rear panel of the router.

I've got the CONSOLE bit soapy tit wank and I'm thinking terminal might mean Telnet

That was a typo. Honest.


Telnet will do it. Or HyperTerminal.

You might not need to reset the passwords. Try this to restore to factory defaults....

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_tech_note09186a00802017a1.shtml

If it prompts you for a password at any point and the seller hasn't provided it, you'll need to reset them.

Hyperterminal. I doubt telnet will work over the serial port, particularly in its given state.

Hopefully the factory reset Johnny pointed out will sort it out without the need.

Nice to see you chaps up early to help me out. Ta

So anyway stfcinB, as a matter of interest do you have the serial cable that connects from the serial port on the PC to the router?

 :D Nope

Does your PC have a serial port?

Yep, think so. Looking on fleabay at others it appears to be special serial cable Serial connector one end and RJ45 the other

Guess I'm knackered at the mo then

Probably should have mentioned you need the right cables, was a real bitch connecting my Mac to Cisco routers.

Not sure this helps but I've just noticed that IP address you're seeing is part of a special "link local" subnet (169.254.0.0/16), which basically means DHCP isn't running on the router so Windows is allocating an IP from the subnet.

Guess that's why the Default Gateway is showing as 0.0.0.0
 

Is there anything there that's going to help me get into the f**ker?

Think we all knew it was going to be a pain in the arse

Had another go earlier trying a few more ip. No joy. It's nearly bin time, unless the ignorant bint that sold it me replies to my question
Mind you I guess I could get her on a technicality, the heading and description both state

CISCO 800 SERIES 837 ROUTER & ALL CABLES & POWER PACK

Cisco 800 series 837 router with all leads etc good working order.

It can't be in good working order If I can't access it?

And clearly the serial lead is missing

The Cisco website says it comes with the console cable, so it's not a technicality - it should have come with it.

Plus if you can't get it working due to the config being changed, it's not in good working order.

If they don't reply file a complaint, might get them moving or worst case is you get your money back.

You can get the console cables on eBay (search for Cisco Console Cable), I just checked and you can get one for £2.50 inc p&p.

Reckon I should just bite the bullet and get a cable. I'll go have a peek. Ta jonny

Got one, 5-7 days delivery

Make sure you've got the right port on your PC. Mac's don't which really fucked me over, took me a while finding an adapter and then the driver software to actually get it working (think I had to resort to a Windows virtual machine in the end).

No serial port on my XP machine, but have one on Win 7 machine. I'm thinking I will have to use putty, That I believe will act as a terminal

Anyhow you now have a few days of peace so chill and enjoy

Thanks for all your assistance on this

Just as a bit of fun I have enabled the parental controls in the 2700hgv and blocked all his internet access. This has cost me 1.5 meg of sync rebooting this time of night and TBH I'm not even sure that the controls work when using the OpenDNS servers. Still I'll sit tight and see what happens. Call me tight but we don't charge extra for the internet

Got my cable today, been having a tinker, think I've managed to factory reset it. Still cant access CRWS
Here's running config

Current configuration : 886 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
!
no aaa new-model
ip subnet-zero
!
!
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
 ip address 192.168.240.125 255.255.255.0
 shutdown
 hold-queue 100 out
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
ip classless
ip http server
no ip http secure-server
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login
!
scheduler max-task-time 5000
!
end

I've had a few to drink and am about to go out but try the following....

Start from the factory reset, so if you've entered any commands do a power reset first and if you've saved the config after entering commands then do another factory reset first. The bits on the left (including the > or #) are the command prompts you should get, the stuff in brackets is comments (don't type them in).

Router>enable    (enter privileged mode)
Router#configure terminal    (enter global config mode)
Router(config)#interface Ethernet0    (configure Ethernet0, the only real port which is attached to a 4 port switch)
Router(config-if)#no shutdown    (open the interface)
Router(config-if)#ip address 10.10.10.1 255.255.255.0    (assign an IP and subnet to the port)
Router(config-if)#exit    (exit global config mode)
Router(config)#end    (exit privileged mode)
Router#copy running-config startup-config    (save the config to nvram, so it will start with it in future)

Configure your PC manually (no DHCP) with an IP of 10.10.10.2, subnet 255.255.255.0, default gateway 10.10.10.1 then connect your PC to port 1. Then keep your fingers crossed and open a browser and go to 10.10.10.1, hopefully you'll be in CRWS.

If it doesn't work let me know and I should be able to help some more tomorrow.

Thought the subnet for 10.10.10.1 should be 255.0.0.0?

Normally but presumably not for CRWS. As long as you assign the addresses Johnny posted you'll be OK.

New running config. PuTTY seems to work quite well as a Terminal on Win 7. I'm surprised


Current configuration : 881 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
!
no aaa new-model
ip subnet-zero
!
!
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
 ip address 10.10.10.1 255.255.255.0
 shutdown
 hold-queue 100 out
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
ip classless
ip http server
no ip http secure-server
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login
!
scheduler max-task-time 5000
!
end

Still can't get into CRWS. Ah well that's enough for one day. Cheers guys. Beer time!

Subnet masks for the 10.x.x.x range will always begin with 255 but the rest is variable.

10.10.10.1/24 is the first "usable" address in the 10.10.10.0 network (to figure this out do an AND on the ip and subnet mask). I say "usable" as 10.10.10.0 is actually the first address and is usable if subnet zero is enabled (and it is on your 837 router according to the config you posted).

Look up subnetting if you're bored for an explanation.

That shouldn't say "shutdown", it means the port is closed.

What happened when you entered the "no shutdown" command?

That could be a task for the morning jonny. I'm happy at the mo that things are further forward than last week. Strange that I still can't access it tho, however tomorrow is another day. Let's enjoy the night first ;0)

Where did we enter the "no shutdown" command?

I reckon some clown missed that one

Now you've got me going again, I'm going to have to have another crack

Latest

Router#show running-config
Building configuration...

Current configuration : 871 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
!
no aaa new-model
ip subnet-zero
!
!
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
 ip address 10.10.10.1 255.255.255.0
 hold-queue 100 out
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
ip classless
ip http server
no ip http secure-server
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login
!
scheduler max-task-time 5000
!
end

Is it still fucked?

aaaaaah I've just emptied me plums of netgeek sperm over me keyboards - too early !!!!

@jonny nope I can almost get in now, if I had a compatible browser

Managed to get into it, Netscape 4.7 did the trick

I think I'll be OK. Its been a while but my first job was developing ISDN bridge/routers ;)

10.x.x.x. is normally a private class a address. You can of course apply a class c mask if you wish.

Also I'd very much doubt 10.10.10.0 is usable as a host address, its the network address and I think used to be used as a broadcast address by older Unix based systems. Unless of course Cisco have ignored the RFC, which wouldn't be altogether surprising.

Again, that used to be true but not anymore - updated RFC's were issued 15 years ago. I'm not sure whether they actually get used in practice as it seems to confuse everyone and it can cause problems if the network isn't configured properly.

I'm studying towards my Cisco CCNA certification and it confuses the fuck out of everyone studying for it, primarily as the Cisco course material isn't clear on the subject and they don't clearly state what is expected when it comes to the exam.

Well you learn something new ever day!

edit, are you absolutely sure the network address can be assigned in this case? Its a Class C, so 10.10.10.0 is the network address, which I thought was reserved along with the broadcast 10.10.10.255.

If it were class A then 10.0.0.0 and 10.255.255.255 would be reserved network/broadcast addresses, but 10.0.1.0 (etc) would be fine?

It seems that I'm up and running

Hooray!

Only on the one pc so far, the win 7 doesn't want to connect. Might be something to do with the network showing as public

Have you made any more changes to the config yet?

I don't think DHCP was set up plus there was only one IP address set up on the ports.

You can change all that shit via the command line, but I'd stick with the web interface for now. Though you might want to then look at the config via the command line to see the effect of the changes - if you're interested in learning more about IOS and router configs. Being a sad techie, learning IOS is cool as its the OS that pretty much runs the entire internet.

Not sure why it would need a specific (old) browser, but the version of IOS it's running is old. Would be worth upgrading it at some point, if you decide to and need some help let me know as whilst installing it is pretty simple, finding the right version for your router ain't so simple.

Done DHCP etc. Couple of problems, the main one being it's not using the OpenDNS servers even though I specified it in the CRWS ISP setup so there's something wrong there. Also now trying to use the CRWS I get a java applet window constantly checking the "Router model, IOS version and IOS features" with this going you can't change anything in the CRWS
However I can access it using SDM

Windows 7 pc now up and running, appears the problem was I had set the ip I wanted it to use manually, switched it to dhcp and voila

Latest Running Config

Router#show running-config
Building configuration...

Current configuration : 4003 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
no logging buffered
enable secret 5 $1$Nc78$IGJVT5PjPoa.52GDxFfkg0
!
username Router password 0 xxxxxxxxxx@
username CRWS_Venky privilege 15 password 0 $1$W1fA$o1oSEpa143457876
username CRWS_dheeraj privilege 15 password 0 $1$W1fA$o1oSEpa802771682
username CRWS_Vijay privilege 15 password 0 $1$W1fA$o1oSEpa1362991162
username CRWS_Ritesh privilege 15 password 0 $1$W1fA$o1oSEpa1849835979
no aaa new-model
ip subnet-zero
ip dhcp excluded-address 192.168.240.1 192.168.240.129
ip dhcp excluded-address 192.168.240.181 192.168.240.254
ip dhcp excluded-address 192.168.240.125
ip dhcp excluded-address 192.168.240.139
!
ip dhcp pool CLIENT
   import all
   network 192.168.240.0 255.255.255.0
   default-router 192.168.240.125
   lease 0 2
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
 description CRWS Generated text. Please do not delete this:192.168.240.125-255.255.255.0
 ip address 192.168.240.125 255.255.255.0 secondary
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 no ip mroute-cache
 hold-queue 100 out
!
interface ATM0
 no ip address
 no ip mroute-cache
 atm vc-per-vp 64
 no atm ilmi-keepalive
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
 dsl operating-mode auto
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
interface Dialer1
 ip address negotiated
 ip access-group 111 in
 ip nat outside
 ip inspect myfw out
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname xxxxxxxxxxxxxxxxx-dsl
 ppp chap password 0 xxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxdsl password 0 xxxxxxxxxxxxxx
 ppp ipcp dns request
 ppp ipcp wins request
 hold-queue 224 in
!
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 192.168.240.139 12123 interface Dialer1 12123
ip nat inside source static udp 192.168.240.139 12123 interface Dialer1 12123
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
no ip http secure-server
!
access-list 23 permit 10.10.10.0 0.0.0.255
access-list 102 permit ip 192.168.240.0 0.0.0.255 any
access-list 111 permit udp any any eq 12123
access-list 111 permit tcp any any eq 12123
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 139
access-list 111 permit udp any any eq netbios-ns
access-list 111 permit udp any any eq netbios-dgm
access-list 111 permit gre any any
access-list 111 deny   ip any any
dialer-list 1 protocol ip permit
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 access-class 23 in
 exec-timeout 120 0
 login local
 length 0
!
scheduler max-task-time 5000
!
end

Not a clue what those in red are?

From a quick check it looks like those users get added automatically by CRWS, not sure why or if they get cleaned up.

I can't see any entries in that config for DNS, the following commands *should* do the trick....

this should enable it for the specific DHCP pool....

router>enable
router#configure terminal
router(config)#ip dhcp pool CLIENT
router(config-dhcp)#dns-server x.x.x.x x.x.x.x (up to x6)
router(config-dhcp)#exit
router(config)#ip dns server
router(config)#ip name-server x.x.x.x x.x.x.x (up to x6)

this should enable it globally....

router>enable
router#configure terminal
router(config)#ip dns server
router(config)#ip name-server x.x.x.x x.x.x.x (up to x6)

Check to make sure it works (you'll need to refresh the IP settings on the PC's) before saving the config (see previous commands).

So the OpenDNS addies go in the kisses ie 208.67.222.222 208.67.220.220

I was a tad concerned about the red entries, thought I'd been hacked by a load of indians

Guess the next problem will be the addition of the wireless router

Yes.

I thought the same. Guess it must have been written in India and they put their names in for a laugh.

The wireless router has to go BEFORE the 837. So you need to plug it in to one of the ports on the 837. You'll need to set up DHCP so the address ranges don't clash between the two (eg 192.168.1.0/24 and 192.168.2.0/24). The default route on the wireless needs to be the IP on the 837 port you plug it in to, ie the IP of where the ethernet cable goes to.

Except when the packet gets to the 837 you need to identify where it came from to be able to filter it, which you should be able to do via the IP (which would rule out DHCP on the wireless) or wireless logon session (if you can identify it on the 837 and I've got a feeling you won't be able to). Which probably means you won't be able to use DHCP on the wireless so you'll have to assign the IP's manually, unless the wireless allows you to assign IP by wireless logon session.

The MAC won't help you either, as the MAC for the original source PC won't be available on the 837.

Does that make sense?

Not one little bit. The 837's ip being 192.168.240.125 so Wireless router could be set as 192.168.440.125
The rest is certainly gobbledygook

Oh and what do I do with the ISP settings in wireless router, just delete including the OpenDns server settings?

I'm making some of this up as I go along, but I think it's all good....

The wireless default gateway needs to be the IP address of the 837, which looks like 192.168.240.125 - you can confirm it by checking what is showing as the default gateway on the PC you've connected to the 837. (When the wireless gets an IP packet destined for the internet, it won't know where to send it, so it sends it to the default gateway - the 837).

The ISP settings for the wireless should (basically) be changed to point to the 837. All you're doing in effect is adding an extra router (the 837) between the wireless and your ISP's router. So you point the 837 to the ISP and the wireless to the 837.

When it comes to filtering traffic on the 837 you need a way of identifying the packets you want to filter, which means the IP addresses (of the local computer and the internet computer). So you need to have fixed IP addresses for the computers that are connected through the wireless, which means no DHCP. You might be able to assign IP based on the logon used to the wireless, otherwise you'll have to hard code them on the computers.

Then you need to set up the filtering on the 837. I'd imagine you can do this based on the IP addresses, or the type of traffic and probably some other things. Not sure how to do this but I read in some of the 837 documentation that it's possible (via the web interface). I've never done any of this myself but it's been on my list, based on my reading up on it the above should work.

Though helping you has convinced me to get rid of the Cisco routers I've currently got (2500/2600/3600 series) and never used and get a bunch of 800 series ones instead. Fuck knows why I bought them in the first place.

As regards the MAC comment, just forget all about the MAC addresses for what you're trying to do. It's irrelevant.

Applied these today, but that's as far as I've got as I've been sorting out some stuff that I bought in my old tits up companies online fire sale. Namely LCD monitors and a nice little Fujitsu Dual Core pc

Just a curious question jonny. Would it be possible to set my pc's with a manual addy(which I normally do anyway) and the Cisco as static, as they are wired, and have the wireless router use DHCP for all the students ip's, that would then make it easy enough just to set the key on their lappies? If you see what I mean which I'm sure you do, then if they take said lappies anywhere else then they don't have to faff around in the Control Panel. I've got a feeling that this isn't possible

Anything is possible. Probably.

Will all of your PC's connect to the 837 and all the students to the wifi? Or will some of your PC's go through the wifi as well?

I've got a batch of 837 routers en route to me, should be here tomorrow hopefully. Will make it a lot easier for me to help once I've got them as I can set up the same configuration and get it working, then supply you with the config settings.

Yep as stated, most of my networked items are hardwired, either direct to wireless router or through homeplugs. Should I ever sort my laptop out or purchase another one, then that will be the only one of mine that will need to connect wirelessly. Unless of course I include my Desire and any lappies I'm doing reinstalls on

Have you got those 837's yet jonny?

Sat at the Fedex depot. Should be re-delivering them to me at work tomorrow.

No worries as it looks like the file sharer of the year will be leaving us. He's not happy about the fact that we don't have the heating on all day and set at 30 degrees. He's cold, bless
Still need to get it sorted though as I imagine we'll have another contender soon

You got yours up and running yet jonny? I've had another factory reset and play around this afternoon, had the router connected to the net.
One problem I've found, if you set the router to DHCP you can't set the ip's on the pc's manually and connect to the net, if you then remove the manual ip and set the pc to DHCP then it connects. Is there a way round this aside from setting the 837 as static?

Surely you can define the DHCP pool of addresses to exclude the statics you want to assign?

Yes I see what you mean Batch, what I want to do is basically manually configure my pc's as static ip's, so If I configure the secondary network as 10.10.20.1 so I can use 10.10.20.2-10.10.20.10 as static then assign say 10.10.20.11-10.10.20.50 as DHCP

How to add ISP details manually. CRWS doesn't get it right

Have now got my 877W but I'm failing at the first hurdle ie setting up my ISP connection.

I have a static ip issued from my isp which is 193.xxx.xxx.27 and the subnet is 255.255.255.255
The Cisco Configuration Professional which I am using to configure it just tells me to "Enter a Valid IP and Subnet"
Does anyone(jonny) know the commands to enter them manually?

@Jonny, 877W now flogged on ebay. If you want the 837 to mess with let me know and I'll post it, otherwise I shall just bin it. Unless anyone else wants it?