Duplicate question with different focus

Question

My question would be similiar/equal to How to secure an open wifi access point

I do understand that an insecure public hotspot is exactly that, insecure (at least from the user perspective).

However given the limits of physical access and a reasonable amount of additional configuration/security measures one could argue that it should be possible to make the Wifi AP itself (the OS) secure from whatever their users do.

My question would focus on that part as I am tasked to evaluate exactly that.

Following would be my draft. I currently see it as quite 100% sure to be closed, making the answer still missing in my opinion.

Setup:

Debian Linux on a small embedded computer connected to the internet via GSM Modem.

To debug, monitor, maintain and update the device it is connected via VPN to a server.

The device is currently able to act as a router for our other devices (via wifi or ethernet).

We now want to extend that router functionality to implement an open Wifi AP instead of the current closed one.

Problem:

I need to figure out if there is a way to reasonable secure the Wifi AP itself to prevent malicous user from accessing anything on the Wifi AP itself, especially our VPN connection.

For now I am thinking of at least limiting access via iptables, blocking every access to the VPN IPs, basically limiting the wifi clients to access anything else, but I was unable to find additional security steps I should take.

What other steps would one have to take?

Am I totally wrong in thinking that the primary question I linked already tries to ask this but the answers focus on something at least partially else? How would I otherwise further educate myself, seeing that it seems quite hard (at least for me) to find information about this topic?

Answer 1

Not an expert on networking, so I can not say a lot about the specifics of your question. Someone with better knowledge of that area could probably give you a more useful answer.

But I think the thing to do in a situations like this in general is:

• Keep the quesiton narrow. Exactly what resource is it that you want to protect on the AP? As I understand it, it's the VPN. Then ask about how to protect that and not about securing an AP in general.
• Be very explicit and clear about what you are not asking. E.g. that you are not asking about how to protect users from each other.

Your question could be put on hold as to broad or closed as a duplicate. Keep an eye on the comment section, and try to answer any questions and make edits as needed. Remember that you can make edits after a question has been put on hold, and it can potentially be reopened.