How can I block an access point from PCs on same LAN

[Greenbandit]

How can I stop connections that come in via my Netgear WG602 Access Point from being able to see the PCs on my LAN?
I have:-
- a Netgear DG834 broadband router set to 192.168.0.1
- a 5 way hub plugged into the DG834 with PCs in the range 1921.168.0.2 to 192.168.0.10
- a Netgear WG602 set at its default 192.168.0.227 also plugged into the DG834.

I have got the system working with SSID + MAC Address Authentication + WEP encryption and my Wii can connect to the internet but I want to make sure that if anyone connects to the WG602 that they cannot see the PCs or their shared directories.
EDIT - I meant WPA2-PSK encryption (not WEP)

Can this be done by changing the settings in the DG834 or WG602 or do I need to add another firewall/router between the WG602 and the rest of my LAN? Can anyone help?

p.s. By definition I cannot be paranoid because I know they are after me!

[Jay]

you could put it on a different subnet

[watercooled]

If the people in question dont need access to you network (or shouldn't be on there) I'd strongly recommend setting up WPA (not WEP which can be very easily broken) with a strong password which will prevent anyone gaining unauthorised access to your network. If they are allowed on your network then all I can think of is setting up a different subnet (as mentioned above^), password-protecting file sharing (I think it's possible but I'm not exactly sure how to do it) or putting another router between your existing router and your AP.
For a strong random WPA password, I recommend: https://www.grc.com/passwords.htm and use the middle password. You will probably want to put it on a USB drive to transfer it between PCs.

[Greenbandit]

you could put it on a different subnet

Yes that was my 1st thought, I tried the WG603 set to 192.168.0.128 but since subnet masks seem to need contiguous bits set to zero, I could not find what subnet mask would allow both the PCs and the WG603 to both see the 192.168.0.1 gateway but not see each other.

If the people in question dont need access to you network (or shouldn't be on there) I'd strongly recommend setting up WPA (not WEP which can be very easily broken) with a strong password which will prevent anyone gaining unauthorised access to your network. If they are allowed on your network then all I can think of is setting up a different subnet (as mentioned above^), password-protecting file sharing (I think it's possible but I'm not exactly sure how to do it) or putting another router between your existing router and your AP.
For a strong random WPA password, I recommend: https://www.grc.com/passwords.htm and use the middle password. You will probably want to put it on a USB drive to transfer it between PCs.

Sorry I meant WPA. There should be no-one accessing the WAP, but since there are 2 main roads, many houses & 4 other networks within its range, I like to cover all possibilities.

I already have password protection on the shares (except of course from the C$ default shares that I'm not sure how to disable). I work on the basis that until I know it is impossible to access the files on my PCs via the WAP, I take the "if it can happen, act as if it will happen" approach to security.

I think your extra router idea is the way forward but I don't want to spend more cash until I know it is the only way forward. I'm still looking through the DG834 setup options in case it can do it. I'm bored already with reading through Netgear help pages & networking articles, but I'm not giving up yet.

& thanks for the GRC password page link - I had missed that page.

[TheAnimus]

If ur really parinoid about this stuff, consider using a spare/old box as a http://m0n0.ch/wall/ ?

[peterb]

You could get a router that has a specific setting that prevents users who are accessing the router through the wireless link from seeing the internal network. Some Draytek routers have tat facility.

You could also consider setting up a vpn to your network which would give an additional level of authentication and privacy protection.

[Greenbandit]

If ur really parinoid about this stuff, consider using a spare/old box as a http://m0n0.ch/wall/ ?

I will keep looking to see if the DB834 or WG602 have setting that let me do what I want with no extra hardware, but in the meantime I have ordered an £8 4GB solid state SATA drive to fit in a spare box to try the m0n0.ch way forward.

You could get a router that has a specific setting that prevents users who are accessing the router through the wireless link from seeing the internal network. Some Draytek routers have that facility.

You could also consider setting up a vpn to your network which would give an additional level of authentication and privacy protection.

The router idea exactly what a mate at work said. The problem with the VPN idea as I see it is that it would prevent me from using shared diredtories between my existing 4 PCs, or have I missed a trick here? My problem is not so much that I could not sort it by replacing my existing broadband router or by adding an extra router between the DG834 and the WG602, the problem is that I want to be a flash git and sort it by setting up the kit that I already have instead of spending more cash. I am only in this situation because I wanted to get my Wii online, and lets be honest, getting a Wii online does not really achieve anything of real value.

I am just being sad by wanting to be able to sort the problem. I was hoping that someone would say something like "I managed that, all it takes is....."

[Greenbandit]

Is YOUR system up to Folding?

Actually yes they are but having a world rank of 99.1% on BOINC I don't want to move over to a different system

[MadduckUK]

You could get a router that has a specific setting that prevents users who are accessing the router through the wireless link from seeing the internal network. Some Draytek routers have tat facility.

Wireless Isolation, my DG834N can do it, but no idea if its implemented across the rest of the range.

[Jay]

if all else fails get a cheap Cisco switch fro ebay a use a VLAN

[Greenbandit]

I have pulled up the DG834N manual & I can see the setting that isolates the wireless from the rest of the LAN It would have worked if the DG834 was the same, but it isn't But the idea was spot on.

I think a cheap switch/router is the answer. Ebay here I come.

Thanks for the ideas peeps.