What ports to block/allow?

[JonTom]

I have a wireless access point that is open for our hotel guests to use. I really don't want to lock it down with WEP, etc as I want to be as easy as possible for guests to get online. I don't need to monitor their usage as we don't charge for access.

However, I am noticing that our traffic is way too high. I suspect that neighbours (or guests) are using the access point (which I don't really mind in principle) and are using p2p apps (which i want to stop).

What ports should I block to stop this? I realize that the more savvy of the neighbours/guests will likely just change from the default ports...

Would it be easier to only allow certain ports? I'd like to allow guests to surf, email and they may also need other ports - which ones?

Suggestions welcome...

Thanks

 

[n0cmonkey]

Turning off uPNP should be a big help.

 

[InlineFive]

Many of the programs that people use for P2P will jump ports randomly. I think your only solution is an application level packet filter.

 

[Changlinn]

or a simple but effective transparent proxy, means they can get nothing but net...heheh
you can also cache pages this way to lower your real world usage and only allow valid web requests on the http port.

 

[jamesbond007]

Not sure what you have already for a WAP, but pick up a Linksys WRT54G and put the Sveasoft firmware on there. More information and links here:

http://forums.anandtech.com/messageview...atid=40&threadid=1343138&enterthread=y

You can block specific applications. Screenshot here:
http://myweb.cableone.net/twiggy9560/blockapps.jpg

You can also boost the signal a lot on the router to improve the quality through your hotel.

May or may not be what you're looking for, but it's a cheap and powerful way to manage network access and have WiFi features.

EDIT: I also must add that you can also adjust QoS settings so you can prioritize your packets. ie: web browsing gets priority over all other packet transfers so it won't feel as sluggish if others are hogging up the available bandwidth or during high-traffic times.

 

[Woodie]

Whatever you do, please do NOT block IPSec VPN! We depend on that when we're traveling, and need to get access back to the home office.