Setting up Wifi for public at business

[ChiSox]

So the restaurant at the golf course I work at wants wifi setup...

Internet is through cable modem then through gigabit switch connects to our server then out to about 20 computers...

My main concern is security...what would be the best way to prevent any network access from public computers

 

[ktr]

Probably an access point on a separate subnet.

edit: meant to say separate vlan. (thanks Munki)

 

[Munki]

separate subnets a "hacker" can figure out if he really wanted too via static IP, im not saying this is easy. If you do it this way don't turn on/off one bit. Make it clever. Is said switch manageable? Model?

EDIT: Your best bet is to setup a public vlan. If the switch supports it, of course.

 

[caleb]

If it doesn't you can do it another way around. Put your whole private network behind another router so that his LAN is on the WAN side of your router.

 

[Bot]

the netgear wndr3700 lets you create 2 wlan's and 2 guest wlan's
you can configure if they can see and/or access the local lan.

i am not sure whats the tech behind it, so i can not speak on if it is security or not but it's worth taking a look at it. i have yet to find anything related to a security flaw in this.

 

[Kreij]

I needed to do something similar at work (not public access, but "guest" access), but I am not sure what your security requirements entail.

Here's what I did.
My internet comes in (dsl modem) and next hits a router(firewall) that translates it to our internal non-routable (private) IPs and then hits (unmanaged) gigabit switches. I hooked up another router to the switches, who's WAN side was in my internal LAN IP range and who's private LAN side was a completely different non-routable (private) IP, then set the default gateway to point to the first router's IP address only, so anything that hits the guest router goes out the main router to the dark underbelly of the internet and never to the LAN.
Due to the fact that my LAN is all non-routable addresses, I can't even access the WAN side of the router from my internal LAN network to configure it. lol

Works fine, but may not be what you are looking for.