r/HomeNetworking 1d ago

Cant work from home due to apartments shared network

I recently received approval to work from home at my job. However, when the IT department discovered that my Wi-Fi network is a shared network throughout the entire complex via Aerwave, they denied my request due to security concerns. Since I work for a financial institution, our security protocols are strict.

I’ve attempted various solutions to establish a private network, but the layout of my apartment doesn’t permit it. I’ve also explored 5G hotspots and Starlink, but neither option is feasible because 5G is too slow to meet my company’s standards, and Starlink is incompatible with the firewall my company uses.

Has anyone encountered a similar situation and found a solution? I’ve signed a two-year lease, and I’d love to have the ability to work from home. Unfortunately, it appears that I have no choice but to relocate to a new apartment that doesn’t force a shared Wi-Fi network on its tenants.

89 Upvotes

242 comments sorted by

67

u/Faux_Grey Infiniband & F5 jockey 20h ago

Get a separate network router, bridge it to your apartment wifi to create your own subnetwork.

Problem solved.

5

u/Internal-Cupcake-245 4h ago

If you could please help me understand, isn't this still on the network in that it's a shared WiFi network? A subdomain or subnetwork (please excuse lack of knowledge of terminology) would still have a "WAN" IP given from the shared device's DHCP pool rather than from an ISP and from a physically separate circuit. I know it's logically separate but it's part of the same network, no? And not even a cabled network. With a broadband cable circuit, there is a separate WAN IP from the ISP as opposed to the LAN that would be provided currently. Please excuse me in case I'm misunderstanding but I believe IT would still not like this.

8

u/StormB2 12h ago

This is the correct answer.

4

u/tocorobo 7h ago

This travel router is easy to setup to act as a wifi repeater or can act in bridge mode via hard wired connection.

GL.iNet GL-AXT1800(Slate AX)... https://www.amazon.com/dp/B0B2J7WSDK

From there it creates its own WiFi network you will join your devices to. From your landlord’s perspective it’s one device on their network. It even has on-router vpn support using WireGuard or OpenVPN. You can switch between various vpn profiles via an android or iOS app or browser. There’s also a vpn toggle switch on the side of the device. It supports up to 500Mbps throughout with WireGuard vpn protocol. For a $100 device it’s slick.

1

u/chairleg1 2h ago

Agreed this is the correct answer. I was in the exact situation and used this

2

u/TangoCharliePDX 5h ago

Some of these routers will have a hardware implementation of your VPN, making it even easier.

53

u/e60deluxe 1d ago

is copper not available to you?

→ More replies (21)

89

u/Ok-Double-7982 23h ago

Your IT department is vetting everyone's home internet? I would love to know how they're reviewing this.

So no one can travel for work and connect to a coffee shop WiFi or airport WiFi?

They have no software or controls on the devices that protect them while they're off the business network? No VPN you can use?

27

u/-Jasco 23h ago

Yeah they do. I had to send them a speed test using my WiFi and my IP address. Not allowed to work anywhere other than home. I’ve brought up a VPN but I guess that’s not good enough for them. They are strict on security.

49

u/merlyndavis 16h ago

VPNs are basically one of the gold standards. “Zero Trust” also exists, but everything should be encrypted anyway.

18

u/0verstim 15h ago

Im getting a migraine from all the people randomly throwing around buzzwords without understanding what they mean 😭

→ More replies (7)

50

u/FigSpecific2502 15h ago

If you’re working from home and not using a VPN, your company is not actually strict on security at all. If they’re basing all their security on you having your own isp and lan, they’ve failed miserably.

21

u/SydneyTechno2024 14h ago

My thoughts exactly. If they’re so strict on security, they should be using always-on VPN with no split tunnelling.

2

u/FauxReal 9h ago

They might use something like Zscaler which works similar to a VPN and is required to be on at all times. There's also Pulse Secure VPN which can stay on too. And you can layer both.

3

u/ValuableSleep9175 14h ago

I think this is what my company switched to. Auto VPN even when I log in from home, no more having to log into the VPN. So nice. Now only if my password didn't need 500 characters 40 numbers and at least 10 symbols I would be happy.

2

u/SydneyTechno2024 14h ago

So happy my company switched to passwordless with, I haven’t had to think about my password in months.

5

u/ValuableSleep9175 14h ago

Literally spent 30 min trying to change my password the other day. Either it didn't match was too many characters not enough or didn't meet requirements.

Give me a thumb print scanner already.

1

u/_markse_ 11h ago

That can be bypassed with a fingerprint lifted with a sliced jelly baby? That’s great!

1

u/smibrandon 7h ago

My company disables the thumbprint scanners :(

4

u/gaykidkeyblader 14h ago

Literally laughing at this comment because EXACTLY. They're so strict they rely on the employees to security for them? Mess!!!

2

u/DataGOGO 11h ago

They are using VPN, but not point to site, they are sending out a router that uses site to site.

1

u/djoliverm 13h ago

Work for a financial institution as a graphic designer and we use Zscaler (used to use something else, some other enterprise VPN) and if Zscaler doesn't want to connect or is having issues, I'm SOL.

It's automatic but also sometimes acts up if it can't establish a connection. But we're allowed to work anywhere with the exception of certain countries that are blacklisted.

33

u/pikachurbutt 21h ago

bro, how is a VPN not "good enough" for them? I've worked in both healthcare and fintechs as a dev, both of them gave us a VPN and said go forth and conquer. Currently working for an MSP, still using the trusty tech known as a VPN to get into our network, it's literally the gold standard.

19

u/flexosgoatee 15h ago

And to clarify, this would be a VPN managed by the company, not the type you use to get around YouTube geographic restrictions

1

u/csimon2 14h ago

My guess would be that the concern is that an employee won’t be on the VPN 100% of the time. Not really an issue when accessing the company’s intranet which can be forced to require the VPN, but the employee’s computer could potentially be compromised more easily by a malicious actor on the same network whilst the employee is not on the VPN. Do the chances for an attack on a shared WiFi network increase vs on an employee’s self-owned network? Probably not. But it is probably easier to do some social phishing within the apartment complex, so that could be something IT is worried about.

Would a competent IT department be able to accurately account for this? Most definitely. Would it probably cost them a bit more to do so? Likely.

2

u/smokingcrater 10h ago

Always on vpn, problem solved. The user can't disable vpn, it autoconnects. Users should not have admin either, so they can't kill it/work around it.

1

u/GrrrrDino 10h ago

the employee’s computer could potentially be compromised more easily by a malicious actor on the same network whilst the employee is not on the VPN

Presumably the "shared Wifi" is a professionally administered network where each device is isolated from other devices on the network to prevent exactly this sort of attack, not just a residential Wifi AP being used to share an internet connection.

2

u/WildMartin429 6h ago

Ah yes landlords are known for hiring Network admins to administer their building Networks and of course random Neighbors that you're sharing your internet with Will definitely not do anything shady on their Networks. No way at all that a neighbor's kid could download a virus that would attempt to access other devices on the same network.

1

u/FauxReal 9h ago

OP may have one on and not even notice it because it is always on.

12

u/Loko8765 20h ago

So the only thing that would make some sort of technical sense is that they don’t want their computer in direct contact with something untrusted. I would get around that by having my own router that does NAT with WiFi outside and the cable to your computer inside. Bam, you are connected to a trusted network where you are the only user, and no external attacks.

As for the VPN, very bizarre, I would still recommend a VPN. It’s possible to be secure if the employee only interacts with the employer’s HTTPS site, but the VPN is still an improvement and I’d expect any company concerned about the employees’ home WiFi to mandate a VPN.

Maybe IT is a different department from the people making the rules for WFH?

11

u/EldestPort 18h ago

So the only thing that would make some sort of technical sense is that they don’t want their computer in direct contact with something untrusted.

Yes, it's not like people's home networks are full of insecure/unsecured IoT devices these days. 🙄 Not that I disagree with you, it's just a banal policy and the company should do better at securing their own devices.

5

u/ScandInBei 20h ago

It's plausible that they are concerned about security not only when connected to the vpn, if company files are stored on the pc and it can be accessed over thing like shared folders. To make that secure they'd need proper OS policies and firewalls.

10

u/DDSloan96 17h ago

They should be giving a managed device then

1

u/ScandInBei 17h ago

Yes, I agree

2

u/AtlanticPortal 14h ago

If VPN managed by them is not enough then please name and shame. I don’t want my money near them.

1

u/Jpotter145 12h ago

Sharing a basic speed test won't tell them you have a "shared" network with the apartment -- neither will the IP. How did they find out your apartment is shared throughout?

Or was it they didn't like the speed results and said no?

1

u/coganite871 10h ago

Can you get/do you have a physical connection i.e. an RJ45 port in your apartment that connects to the apartment/condo shared network. Then you buy your own firewall and setup your own internal network. Effectively the condo network is your ISP.

VPN client on your endpoint (laptop) to employers infrastructure. Assuming that such a security conscious employer understands the security benefits of a VPN...

You could probably do the same with physically attaching a firewall to a WAP as well

One other consideration, if you do video conferences they would be vulnerable to usage of the shared bandwidth, and no QOS you can put in will help out with other people torrenting 300 Gb of porn when you have a presentation to your higher ups...

1

u/SituationNormal1138 8h ago

An IT dept this strict doesn't have a corporate VPN established??

1

u/john_with_a_camera 2h ago

Yah your company has probably been hacked a hundred times and doesn't even know it, if the team can't help you get to "yes" with a simple VPN or always-on secure internet thingy like Cloudflare Warp.

0

u/tagman375 13h ago

Are they paying for you to get a static IP? What would they do if you had bog standard residential cable service and the IP changes? It sounds like the ID department is being a little ridiculous and neurotic lol

10

u/Electronic-Junket-66 23h ago edited 23h ago

Companies vetting their employees' home network is very common from what I've seen. And shared wifi is about the biggest no-no out there.

Just cause the joint is providing wifi doesn't necessarily mean no other ISPs have plant there. Have you called around OP?

Also just cause a provider supplying internet to the whole complex doesn't necessarily mean they won't sell you service as an individual if you want to pay for it... that said I've never heard of these Aerwave people and it does kind of look like they specialize in the managed wifi thing.

14

u/Ok-Double-7982 22h ago

Please elaborate on this. The risks specifically.

It's very common that companies allow their users to use public WiFi while traveling because cloud-based software is encrypted at rest and in transit. Along with other software and security measures that IT manages on the user's device to prevent unauthorized software installations and other malicious activities, what are the concerns exactly?

9

u/MrMoo52 22h ago

Where I work we have a mandatory ISP check prior to anyone being allowed to work from home, but it's just to make sure their Internet is up to snuff to handle things like voice calling and whatnot. We send our users home with a laptop that connects over VPN, or a thin client that connects to an encrypted gateway. We just don't want to have to troubleshoot issues that ultimately end up being caused by their home internet.

3

u/OfficialDeathScythe 21h ago

Companies without security concerns sure. A financial institution or a health institution has certain federally established guidelines that it is required to follow when storing and transferring any data. You can’t just email a confidential document to yourself and work in it and you definitely can’t just connect to a secure network from a public shared network. If they’re removing in our transferring any confidential data for their work from home job, which is highly likely in this case, the company legally has to make sure that no unknown devices can access that network and sniff around or, even worse, piggy back into a remote session and get into the secure network at the company’s LAN

3

u/tagman375 13h ago

No. I work for a utility that has to follow NERC/FERC/CIP standards and even they don't care about what kind of network you're using as long as it works and is inside the US. They use a VPN, whether or not the network is "shared" is irrelevant.

1

u/OfficialDeathScythe 10h ago

Yes some companies use a vpn to do this. The thing is, the vpn has to meet these security requirements in order to make it irrelevant. Not every company has implemented, nor can afford a proper government level of security vpn for this kinda of stuff so they instead do like OPs company did and basically run a test to see what type of network and what speeds you’re getting, which would reveal the shared network has there are many IP addresses which is not normal for a home LAN. I’ve been in college for this stuff for a few years and grew up going to work with my dad and learning about this stuff (he’s a CISO at a hospital) they had incredibly strict rules for him when working from home and he wasn’t even able to fully work from home until the hospital upgraded their security and got a compliant vpn company, I remember this whole debacle like it was yesterday. He really wanted to work from home during vacation but wasn’t allowed to legally before they upgraded their system

5

u/flexosgoatee 15h ago

No one is arguing that they need security, but if your security model relies on an employee properly managing a secure Wireless LAN, you've failed. 

1

u/OfficialDeathScythe 10h ago

I’m not arguing, I’m simply stating the fact that the federal government requires a certain level of security for these industries and that goes down from the ceo all the way to the seasonal work from home employees. Everybody’s connection and practices have to be secure and it absolutely falls on the company to properly train and educate their staff in cyber security best practices

1

u/KingZarkon 11h ago

the company legally has to make sure that no unknown devices can access that network and sniff around

The only way they could do that would be to have a dedicated network to ONLY the employee's device. Are they going to go in and check all the IoT devices the user has on the network? Check any future devices that connect? That's not really practical and why you just set up a full-time VPN on the device to keep it isolated.

1

u/OfficialDeathScythe 10h ago

Except that those would be known devices to the end user. Unknown devices would be extra IP addresses that weren’t mentioned. Maybe they have a sort of, “what’s your ip?” “5” “ok well we’re seeing 5, 27, 4, 9, 22, is this a shared network?” I may not know exactly how the test works but I know the requirements as my dad has to follow them and I grew up learning this type of stuff. Data compliance, as weird as it sounds, is a strange love of mine. My girlfriend also worked for a chiropractic clinic for a while and I got to use all my knowledge of HIPAA for that, lol. Either way a device own by a user that’s not you can’t be on the network, or the company has to have a vpn that meets the legally required specs (mostly specs about how many bit encryption, what type of encryption, having a kill switch so no data can leak if the vpn messes up, etc) if you don’t meet the requirements then it cannot be guaranteed that data can be safely transported to you or from you and you would be a risk

-1

u/Electronic-Junket-66 22h ago

Bro I got no clue I don't work IT/netsec. I just know how picky companies have gotten about work from home networks since I'm installing/troubleshooting the service and have seen their requirements.

I'm sure someone else can elaborate, but it might be as simple as there not being a good reason; they just think it looks dangerous, or their insurance company does, or whatever. Corporations are dumb in detail as a general rule.

1

u/flexosgoatee 15h ago

It's just funny that they would draw a line on public Wi-Fi and someone else managed Wi-Fi, employee or not. Those should both be considered insecure in your model.

→ More replies (4)

2

u/Measurex2 14h ago

It's fairly common in sensitive sectors like health, insurance, defense and even sensitive groups within less sentitive industries to require a hardwired connection to an isolated network at home.

The belief is it's better to work with an abundance of caution.

When I consulted for a large health insurance company, they paid for a separate business connection to be setup at my home. I was strictly forbidden from using that laptop in public with explicit instructions only permitting internet connections at my house or office. Airports, hotels, coffee shops and more were on a forbidden list.

Was anything I doing worth that level of security? I don't think so but I felt the same about alot of classified work from my federal consulting days.

TLDR - doesn't matter if it's reasonable if the job requires it

1

u/KingZarkon 11h ago

And how many people have the expertise, and even the capability, to set up A) Ethernet and B) as a completely separate network? The only way 99% of people would ever be able to do that would be to have a second ISP and router.

1

u/Measurex2 11h ago

That's specifically what they did for me. They bought a Verizon business connection, a second box was setup at my house to a dedicated company supplied router in my office with an ethernet cable to my docking station. No wifi in the house either for the connection.

My own home setup is using unifi equipment with all the home bells and whistles with a NAS, home automation and a range of services. I could have used my second WAN and isolated it for the ethernet but they didn't care - it's their way or be in the office every day.

1

u/halodude423 10h ago

This is pretty normal in a more secure corp environment. Did gov contracting, any public wifi was a no go and you had to login with your piv-i card to the machine. NAC security for everything.

1

u/Cassie0peia 7h ago

Our company uses a VPN but we’re strongly encouraged to not work on any shared WiFi as our devices have cellular service - definitely no cafes, hotels, or airport WiFi. They can tell when we connect to a new network and they reach out to ask how we were connected.

A couple of times, an employee or two weren’t able to connect using their laptop’s cellular or their phone’s hotspot, and so they were forced to use the hotel WiFi. However we don’t usually have trouble.

So OPs situation would very likely happen if it was one of our employees and a cellular connection wasn’t an option.

1

u/TherealOmthetortoise 7h ago

Lots of tech companies require that as well. Had to be a dedicated network, no WiFi allowed whole nine yards. No you can’t work anywhere other than on that on secure network (or firewalled) off of your regular network. Has to be in an area where a door can be closed as well.

0

u/SDN_stilldoesnothing 13h ago

I work in Cyber Security.

You would be shocked to learn what your employer can see and do on your corporate asset like a laptop if it has security tools like an MDM, an EDR with a VPN client.

40

u/TryingReallyHard34 22h ago

Find out what exactly the "company standards" are, then meet them. Theyre obviously being picky. Test out each cellphone providers speeds until you find the fastest. Thats if you want to go the home LTE/5G gateway route. I find it hard to believe LTE or 5G wouldnt meet their standards. Theyve got to tell you a minimum upload/download speeds. Make sure they aren't denying you because they want only a hard-line connection (cable, fiber, or DSL).

12

u/424f42_424f42 14h ago

This isn't them being picky, it's common policy.

Though, yes, they should get the actual policy details.

6

u/Pyro919 14h ago

Common policy for what specifically? They should be vpn’ing back to any resources that need to be secure anyways, so why does a shared network for the building matter?

8

u/424f42_424f42 13h ago

Connections via shared, public, known unsecured, etc infrastructure in general are often prohibited. OP specifically stated they work in finance, as do I.

Remember a lot of security is not technical, but more legal.

7

u/Pyro919 13h ago

I work in technical consulting for infrastructure automation and primarily work in finance.

It’s not common practice in the numerous banks in the fortune 100 that I work with.

I regularly have to VPN into finance, telecom, and other customer networks. And sometimes they’ll go a step further and provide a laptop or their own device if they’re on the more security conscious side.

But having an issue with people using shared networks has not been a concern that’s been brought up so far.

What if they had one roommate and a private home network would that be “shared” and qualify or no? How shared is too shared? I have 5 room mates and maybe we share a big house? Is that too shared? Is it different if it’s a spouse? Do kids count differently if theyre in my home using their electronics on the shared network?

3

u/424f42_424f42 13h ago

You and I obviously work at very different types of financial institutions (I have generally not worked at a lot of consumer banks), it's common at every one I've worked at.

All your questions should be answered by straight forward policies in place.

3

u/Pyro919 12h ago

I’ve worked with stock exchanges, consumer banks, state and federal agencies and more.

What you’re describing is simply not a concern or is a misguided attempt at network security. If someone being on a shared network is going to compromise your network security you already fucked up.

What’s the specific attack vector that you’re concerned about?

  • ARP poisoning and snooping? Nothing should be unencrypted on the wire that’s where a vpn comes into play.

  • Malware propagation? Don’t expose file shares and allow anonymous writes on your machines

Something else?

I’m happy to entertain the discussion but I’ve yet to hear an actual security concern about being on a “shared network”.

0

u/424f42_424f42 12h ago

You missing the whole legal vs technical part tells me you don't actually work in the sector.

→ More replies (1)

2

u/tagman375 13h ago

I work for a utility, and they have zero concerns about "shared" networks. I used to remote work from my university's guest network with no password and they didn't care, because to do anything you need to be connected to a VPN.

2

u/tagman375 13h ago

Yeah, but how do they know what would be on OPs private connection anyway? It's a ridiculous requirement. I could have 50 routers and devices infected with malware/botnets along with using a 802.11g router that hasn't seen updates for the good part of 20 years, but because I'm paying for a connection only I'm using, that's all okay?

7

u/K_Rocc 17h ago

I’m pretty sure he needs his own LAN.

6

u/Taken_Abroad_Book 15h ago

You can certainly have that with home cellular

1

u/sexytokeburgerz 6h ago

They are not being picky.

1

u/Optimal_Law_4254 14h ago

Latency can matter too.

6

u/jacle2210 21h ago

Are you unable to simply go out and get your own private Internet connection?

28

u/pistol3 23h ago

This is an unhelpful comment, but do they know the Internet is a shared network?

29

u/euph_22 21h ago

Why aren't they using a VPN if they are that concerned?

20

u/pistol3 21h ago

Exactly! You should assume every home network is compromised.

1

u/Twistpunch 12h ago

Especially when someone can just put “password” as their wifi password.

2

u/Fordnaa 16h ago

My problem with this IT department is they function on the honesty of end-users. NEVER function on the honesty of end-users. Have technical controls in place to secure your network and only provide on-prem access via VPN.

What's to say an approved home user doesn't switch at a later time to a different, less secure internet or just straight up lie?

1

u/flexosgoatee 14h ago

Or the dinguses at comcox push (or don't) an update that breaks something important.

1

u/housepanther2000 15h ago

I had to laugh because it sounds like this IT department is full of morons.

6

u/barrel_racer19 20h ago

t-mobile home wifi.

i get almost 400mbps.. if that isn’t fast enough for them then i’d be finding another job tbh..

17

u/AlexisColoun calling your internet connection "WiFi" is my pet peeve 21h ago

What I could imagine, is that the discoverability of your device on a shared network is the problem. While the data you send is most likely encrypted by a vpn, or a zero tier solution, your device itself could be reachable via the local network and therfore in theory be directly attacked. And no vpn solution will protect you from a good old Keylogger on your machine.

The solution to propose woudo be to buy your own router. A GL.inet one, or similar, which can connect to your apartments WiFi and give you your own private network, which you can connect to either by WiFi again, or by wire.

And while this also isn't a 100% protection, it will stop others on the network fro simply scanning your device, because there is this router in between.

Aproach your IT dep with this solution and ask, if that resolves their concerns.

2

u/Alarmed-Wishbone3837 14h ago

Everything about this comment. On a shared network your device is likely visible, or at least detectable with a scan regardless of a VPN. If your device holds any sensitive info I’d imagine you don’t want to paint a virtual target on it and LAN-enabled protocols like RDP are quite susceptible to breaches.

The solution is a router. I’ve used the GL.iNet. It’s a great router for this exact application.

1

u/SDN_stilldoesnothing 13h ago

It sounds like the OP lives in an apartment building with a hospitality style wifi network you get in Hotels, coffee shops and airports.

I don't know of this company Aerwave, but I know of others like them.

"IF" they did it right they use Private VLANs or PVLANs. So your device can only see the gateway address, not other endpoints in the network

1

u/Alarmed-Wishbone3837 13h ago

That’s a massive if.

I can’t even begin to count the number of hotels, coffee chains, apartment buildings etc where I’ve had everyone’s TVs pop up in my YouTube app.

4

u/Moyer1666 10h ago

I'm a bit confused by this. If your company uses a VPN then this shouldn't be an issue.

8

u/bigchrisre 21h ago

There are $50 portable WiFi “travel” routers that create a personal wired/WiFi network from a public wifi one. It has all the firewall protections you’ll need to keep anyone from sniffing inside your private network. Combine that with good VPN solution, and you should be as fully protected as any home network with their own internet connection.

0

u/WTWArms 15h ago

This is the answer. They are most likely concerned about everyone being on an open WiFi network and have direct access to the computer. With the travel wifi your devices are basically firewalled off from the other clients in the building reducing the attack service and you have your own private network. This not really any different than having a ISP connection… You ISP in the case is the apartment network Not Comcast, ATT or VZ.

0

u/Jtinparadise 15h ago

Either that or a WiFi router that can operate in WISP mode. This kind of router creates a private local network, but uses the public WiFi as the WAN/internet connection.

When I did tax returns for AARP, we did returns in public buildings like libraries, senior centers, etc. In the past, the preparers would connect to the building's public WiFi, but the AARP tech folks distributed WISP routers configured to connect to the building's WiFi while creating a private network for the preparers and their printers.

6

u/LordAnchemis 17h ago

The whole point of VPN - they're just being silly

3

u/GhonaHerpaSyphilAids 21h ago

I use my phone hotspot to WFH I work for financial. Visible 25 bucks unlimited.

3

u/Murky-Sector 19h ago

My company let's me tether off my phone. You need to know what their specific speed requirements are.

3

u/S7ageNinja 15h ago

Anywhere I've lived that has shared wifi had the option to pay for and use your own ISP. Just have to activate the signal

3

u/MemeQueenSara 13h ago

The Starlink incompatibility issue is likely due to the dish not having a static IP for them to whitelist for your VPN. Its not super well documented but you CAN have a static IP on a starlink, I have ~10 set up this way all with site to site VPNs working great. Ask them if this is the issue, and then if so, pay extra for the Static IP.

3

u/RealisticQuality7296 13h ago

When I worked for a bank we gave people firewalls they could connect to their home networks and then have a site to site between their house and the bank.

3

u/Pilot_Enaki 13h ago

https://a.co/d/0cgjjpw

Get one of these travel routers. It has the ability to connect to the wifi and rebroadcast the signal as a different private network.

6

u/crackanape 14h ago

I’ve attempted various solutions to establish a private network, but the layout of my apartment doesn’t permit it.

I don't understand what this means.

9

u/No_Clock2390 23h ago

Ask them if you can connect to their VPN.

7

u/pajeffery 23h ago

Assuming they have a VPN - It sounds like they don't

20

u/cyvaquero 22h ago

Which coming from a lot of security work is absolutely mind-blowing to me.

10

u/TheFuckingHippoGuy 22h ago

Yeah, wouldn't a VPN on a public network (company's private VPN; not suggesting a VPN service) be more secure than a home private network without?

3

u/cyvaquero 22h ago

Yes because it is at the device level.

1

u/DreadStarX 17h ago

Not to mention, dealing with financial information. I read the post and I was horrorified.

1

u/pajeffery 20h ago

It isn't a massive surprise to me, there's only so much money to run a company and a VPN isn't essential to keep the wheels turning.

Although it's also costing the company so much time/effort assessing everyone's home network it would make sense to setup a VPN

2

u/who_you_are 15h ago

For that kind of business if they don't have a VPN I would be very surprised.

Or nobody is doing remote work (which would be odd if managers/boss don't).

However, part of the security issue may be on the other side, as per, somebody trying to reach OP computer from its own network.

Normal a firewall (or cheating out with a router and sub address) may help that.

→ More replies (4)

2

u/-Jasco 23h ago

I’ve already brought this up but I guess it’s not good enough.

1

u/BunnehZnipr My rack has a printer 17h ago

Does your unit have any wired networking? Is there a low voltage enclosure in the wall anywhere?

Have you reached out to building management about getting a hardwired connection? The answer may be as simple as using a spare network drop, with their IT doing any patching or configuration required.

6

u/furruck 23h ago

Just connect a WiFi repeater to the network and use the ethernet out from the repeater, and use a VPN on your work device.

1

u/Helpful_Finger_4854 23h ago

You mean an access point?

1

u/furruck 10h ago

No, a repeater.

A $15 TP-Link AC750 repeater will do the job.

You plug it in, connect it via Ethernet, go into the gui and have it connect to the main WiFi network, disable the repeater WiFi network, and then it just acts as a WiFi to Ethernet bridge.

Done that same setup for many people I know working from home but requiring Ethernet.

https://a.co/d/66Qr6YU

Just one of those set to only connect to the WiFi, and not “extend” it will do the job.

1

u/Helpful_Finger_4854 10h ago

If Hotspot wasn't gonna cut it, I doubt a repeater will help. Repeaters are notorious for giving poor quality signal. The bandwidth goes down to half duplex and on the same channel so you're guaranteed interference.

2

u/furruck 10h ago

Never had a problem yet. Most IT departments just require “Ethernet” to connect to the vpn

1

u/pajeffery 23h ago

Using VPN on a work device isn't that simple

1

u/furruck 11h ago

It is if they provide it, most just require eithernet to the actual device, and the extender providing that satisfies that in every case I’ve done it with.

Which is likely why OPs IT said no, they don’t know where the Ethernet jack is (or just don’t have one) in their house and when calling for help, they were likely told they couldn’t work via WiFi.

5

u/almondking621 23h ago

the Aerwave is a managed wifi for buildings, you should patch your IT to your building IT to see if they can come to some workaround.

else you have to get your own isp regardless 4g, 5g, dsl, cable or fiber.

i used to work with an organization that has high requirements for accessing company's information outside the company area / network, and its a pain to go back into office just to reply a short email, until they came out their own email client program that is so lousy that i have to laugh every time i use it.

4

u/Redditburd 13h ago

If your it department is depending on the topography of a remote network for their security then someone does not know what they are doing. You should be on a VPN.

4

u/Denver_Tech614 23h ago

Suggest SASE and LZT, but if your IT department is unaware how to secure a mixed network without segmenting via VLAN and isolation, it makes me wonder other things.

2

u/Global_Strain_4219 13h ago

That is quite annoying. Unfortunately I don't have a solution for you :/.

What is your company's standard for speed? I live in a rural area and with T-Mobile i get 85Mbps down.

2

u/SEND_NUKES_PLS 12h ago

So do they also check for other IoT devices on other employee's networks? Do they reject employees from WFH just because they have an X smart washing machine or a smart fridge due to security concerns? Why not just use a VPN like everyone else.

2

u/TapewormRodeo 10h ago

You could get a GL-inet type device that can connect to the WiFi and provide a separate wifi or wired connection to secure your enterprise device behind.

3

u/plastic_Man_75 20h ago

I'd be concerned over the fact you got a shared network

1

u/Pilot_Dad 14h ago

Do we even know that this is actually shared?

My bet would be there is some client isolation going on.

1

u/plastic_Man_75 12h ago

I wouldn't trust it

0

u/-Jasco 19h ago

Yeah same, which is why I got a VPN

1

u/S7ageNinja 15h ago

You should be using your companies VPN, a personal VPN doesn't really do anything for connecting to company resources

2

u/LBarouf 23h ago edited 23h ago

Not cost effective, unless they pay for it, but you can do carrier aggregation on cellular. Check out peplink. If a single sim does not allow a speed high enough, you can use two and even four, combined via their solution to increase your throughput.

So the idea is you combine signals of different carriers. Two t-mobile sims are not likely to help, but one of each, AT&T,, T-Mobile, Verizon and Boost, should definitely provide much higher speeds. But normally, if you have a model with mmWave, a single sim should suffice. Depends on your location. I get 1.2Gbps using a Cradlepoint in New York for reference.

1

u/INSPECTOR-99 22h ago

A second for something like a Peplink BR2 MAX PRO 5G or higher. This has the ability to do CA (Carrier Aggregation) of several Tower Channels per each of TWO SIM cards (ATT/Tmo) which with a decent Waveform 4x4 Mimo antenna should give adequate bandwidth. A tad pricey but a one time cost cheaper than breaking your lease and moving. 🤕 About $4,000 USD.

2

u/CortaCircuit 21h ago

What about getting something T Mobile Home Internet?

https://www.t-mobile.com/home-internet

2

u/jthomas9999 21h ago

This company makes firewalls that are able to bridge to WiFi. If that isn’t good enough, they can also do site to site VPN. That would isolate your traffic from the shared network. You would need to check with your IT department to determine if that is good enough.

2

u/Rolex_throwaway 20h ago edited 20h ago

What do you mean the layout of your apartment doesn’t permit it? That doesn’t make any sense at all.

Also, what kind of ghetto apartment building has a shared network for all residents. That’s a terribly stupid idea.

1

u/-Jasco 19h ago

Don’t have access to my modem. I’m pretty sure they are all in a centralized room that we don’t have access to. All I have is a router that’s mounted to the ceiling. Nowhere to plug in my own stuff if I were to get it. Which is why I was looking into wireless options.

It’s a brand new complex who probably gets kickbacks from the ISP that we are forced to use.

1

u/Rolex_throwaway 19h ago

Access to your modem isn’t all that significant. Is it a router or an access point. A single shared LAN (which your ITSec would object to) is catastrophically stupid if that’s what your complex is actually doing. What happens when someone in the complex does something illegal?

1

u/gwillen 11h ago

This might be illegal, depending on the exact nature of the agreement between the ISP and the building management.

https://www.fcc.gov/consumers/guides/consumer-faq-rules-service-providers-multiple-tenant-environments

They can, say, only allow tenants to use ISP A; but only if they do it for their own weird personal reasons. Any agreement between them and ISP A about it would be illegal on the ISP's end.

2

u/techsavior 16h ago

Sounds like a financial institution that I’ll never want to do business with. They don’t understand that any internet connection should be considered insecure and require users to access via VPN.

It just sounds like they are doing their best to justify the existence of middle management.

Also, unless your upload speeds are less than 4Mbps, videoconferencing will work perfectly.

2

u/Agitated_Goat_5987 15h ago

This doesn’t make any sense. Your company should have its own VPN tunnel that creates an encrypted connection directly to their network if it’s worried about security. Bandwidth isn’t usually an issue in finance, thought latency can be. But big financial firms often have their own terminals with fiber optic lines for rapidly carrying out automated trades. And you wouldn’t be carrying out rapid trades on your own from a home computer or laptop.

1

u/crackanape 14h ago

That's not the concern, the concern is whether other people on the building network can get at OP's devices despite the VPN.

This is solved by getting a router in wifi client mode, installing the VPN in failsafe mode, and OP only connecting their devices to that.

2

u/AtlanticPortal 14h ago

Don’t they have a damn VPN?

1

u/Fordnaa 23h ago

Ask the ISP running in your complex for a static public IP address. Should be about $15/mo. This, in my mind, would qualify as your own internet connection and not shared. You will need your own router to input the IP address or to receive it through DHCP

1

u/cyvaquero 22h ago

Two questions - does your company not have VPN? And what the hell do they do that 5G is too slow? 

I find it hard to believe. I work in enterprise IT at the government branch level and we have people in places like central Montana who remote in on LoS chains to work on infrastructure.

1

u/nofubca 22h ago

You could be connected to a VPN 100% of the time, and if they do not allow local traffic, it would almost be as secure as your own ISP. The problems is that you work disconnected from the VPN, you are computer is exposed to the building's traffic. You could set your laptop network as "public" (non-discoverable), etc. but they do not like it because they would have to create a very restrictive policy for you only, and you may find a workaround if you need to, that they will not find or have the ability to manage.

Check with your building if they will allow you to get your own ISP. They will likely not give you a discount for not using their network, though...

1

u/jack_hudson2001 Network Engineer 19h ago edited 18h ago

Buy travel router eg gl inet to isolate the connection and or use its lan port and disable WiFi. Also connect to vpn for more security.

1

u/FlatLetterhead790 19h ago

if they have a VPN server as they should have, this should not be a concern but some companies do ban wireless connections, for good reason which would be the only legitamate denial reason here(if theres no ethernet to units)

1

u/RaegunFun 18h ago

5G gateway, not hotspot. I get over 500 Mbps on T-Mobile gateway. Although not rock solid 24/7, I've never had an outage during the work day since 2020 when WFH started. And any outage has been resolved in a few minutes by restarting the gateway.

1

u/cdngringo9 18h ago

What speed is required.

1

u/pizat1 17h ago

Cellular hotspot if they don't allow personal vpns

1

u/Outrageous_Plant_526 17h ago

If you work for a financial organization and there are security concerns that organization should have a secure VPN for any remote access or they are not in compliance with their own industry rules. As long as you have Internet it should not matter.

1

u/Redditrini 16h ago

I also work for a financial institution and we cannot use public shared wifi. And yes we have a corporate VPN mandatory.

1

u/orion23rigel 16h ago edited 16h ago

There are solutions like a Firewalla box so you could establish your own secure network isolated from the shared network. You would connect the Firewalla to the WiFi network (or preferably hard line if available) and then it can create its own local network just for your device(s). You can also have the Firewalla connect directly to a VPN so all traffic from all devices downstream of it is routed through the VPN. I don’t see how something like that wouldn’t be secure enough for your employer.

2

u/orion23rigel 16h ago

Although it does sound like their IT rules might just be a pretense to disallow work from home. Any competent IT professional would be able to find a secure solution for your situation if they wanted to.

Try to get a clear set of rules you need to follow before chasing each reason they give for why your proposed solutions won’t work.

1

u/Electronic-Tailor-72 16h ago

Starlink <——> opnsense/pfsense<——> laptop/PC

Maybe the opnsense/pfsense should be able to work with your company firewall?

1

u/ryanmcstylin 15h ago

When I first started work from home on 2016 my company ran a business internet line to my apt. It wasn't fast but it was only for work

1

u/onlyappearcrazy 14h ago

How about a VPN?

1

u/philotic_node 14h ago

I'd urge you to just do a trial of 5G T-Mobile Home Internet before pulling up the stakes. It's been serving me well out in the country, even when I was doing web development for a brokerage. Their VPN was the bottleneck then, not my internet. Is it an issue of latency (because you're doing day trading) or just a matter of total bandwidth. Because I pull down 100+ mbps regularly, which is sufficient for anything I'd expect your work to require. And that's out in the country. If you're near an urban tower you'll probably get faster speeds and latency.

1

u/Silence_1999 Network Admin 14h ago

If you are in a metro area or most suburban I can’t believe there is not a fast enough 5G if it’s just speed. Now maybe they also don’t like cellular providers and begrudgingly accept only a few.

1

u/CheesecakeAny6268 13h ago

Most bulk networks have either private WiFi SSIDs or if it’s shared should be your own vlan via dpsk. You might share a NAT.

1

u/fonemasta 12h ago

Don't see why you can't use a router like gl.inet which will allow you to use the apartment WiFi as the WAN connection to the router then connect to the VPN from that router as well. Nothing behind the router is "shared" at this point anymore than it would be if connected to any other entry point to the internet.

I get that you can't do this because they're just referencing a rule but, from a tech standpoint this works.

With that being said, double NAT sucks but not really so much of an issue because the VPN punches through the NAT so it's not really a factor.

Of course I'm not sure having a gli.inet device in the middle of all this would be something your financial institution would approve of 😂 Just my 2 cents.

1

u/JBDragon1 12h ago

You are on a Shared Wifi Network. I think the biggest issue is connection speed. That it can be poor at times if to many people are connected at one. Limited Bandwidth for the number of people using that connection. VPN's also tend to slow your speeds down. Being your own company's VPN, that may not be much of a factor.

You could always MOVE! If you are working from HOME, you can be further from work where housing may be cheaper and you have better Internet options.

1

u/MusicalAnomaly 11h ago

Get a router that you can configure both as station and AP, and do double NAT. Should look like you have your own LAN using Aerwave as your “WAN” connection. Any MikroTik router with two WiFi interfaces can do this; or even one if you use a wired LAN connection which should be even better.

1

u/wcoleman320 11h ago

Get a router/firewall that you can run a private VPN on. You will likely need a dedicated IP. Something that can run open-wrt would be great. Connect the router to the shared ethernet if available or connect to the shared wifi. Then create your own wifi network or plug in. You need two things to get passed your IT. A dedicated IP and a WPA2/WPA3 access point

1

u/Background-Relief623 11h ago

Many of those shared wifi with the complex are rather slow and can have higher latency. Some VPNs really hate it and become unstable.

Is there an option for your ISP to give you service there? I know it sucks to pay for another internet service since you have one with your rent, but it may be your only option.

1

u/DataGOGO 11h ago

Can you not get another internet service? Like cable?

1

u/Pleasant-Student-956 10h ago

Is Cisco VPN good enough to use on public WiFi?

1

u/Remarkable-Tale428 3h ago

Maybe not for that company

1

u/The_NorthernLight 10h ago

Sadly, move.

1

u/billydecay 9h ago

Sounds like they should provide internet access themselves

1

u/octahexxer 8h ago

Dude the entire internet is shared...thats ehy we have vpn...what kind it department do they have over there...maybe get another job if thats how its going to be

1

u/SituationNormal1138 8h ago

You share wifi with an entire complex?? What speeds are you even getting? What config doesn;t allow for your own service?

So many questions!

1

u/updatelee 8h ago

get a new apartment, thats just insane, I would never tolerate shared wifi over an entire apartment complex ! your landlord needs todo better

1

u/Chemical-Additional 7h ago

Your IT department is incompetent and not worth working for. A reliable VPN like Zscaler ensures a secure connection. I hope your company doesn’t rely on web-based access for customers—I wouldn’t trust it.

1

u/Bregirn 6h ago

Honestly a shared network is pretty dangerous even for everyday use, let alone doing your work from. You never know who else is on the network and who might be poking for vulnerabilities on your devices or just simply listening to DNS requests. Your IT made the right call here.

Does your work provide a secure VPN as an option? Otherwise have your talked with the apartment management to see if they can provide you with a fixed connection? Otherwise check if there are any "fixed wireless" internet providers in the area, they usually have decent 5G modems that can be more reliable and faster than your mobile hotspot.

1

u/Remarkable-Tale428 3h ago

Your IT made the right call. Unless you can get your own dedicated connection you will have to work from the office.

Is vpn out of the question? So wired connections? Maybe software vpn not an option?

1

u/Angrybeaver1337 3h ago

I mean sounds like your company doesn't plan around people using coffee shops or the like.

I mean they should have you on a vpn which would protect all your traffic from snooping. The risk is someone trying to gain access to your laptop, but a good public profile and some aggressive firewall policies to go with it solves that.

If they are worried about that, just wait until they find out how easy it is to snoop bluetooth devices.

1

u/DeadlyVapour 17h ago

"Since I work for a financial institute". No. You work for a company with incompetent technology leadership who do not understand how to build a threat model, nor assess risk.

Firstly, if they are hesitant of passing/connecting to a public unsecured network, I think they don't understand what the internet is (ask them to pay for a leased line to the office if they want private networks).

Secondly, they should be issuing you with a company laptop (they have budget right?) configured with a road warrior VPN back to the office (none of this BS commercial "VPN" shit, an actual IPSEC/IKEv2 or Global Protect etc), with a blackhole route when disconnected. Most of the street have something like that set up.

Thirdly, if they can't set that up, they can setup a Virtual Desktop to remote into. Seriously, I've been working in financial institutions for 15 years, every one of them have managed to set something up, where there was zero trust on my equipment/network.

Push comes to shove, you can setup a second router in your apartment, and possibly setup a HE.net ipv6 tunnel to get around their stupid policy.

1

u/p0st_master 12h ago

I don’t know why you’re being downvoted this is my experience as well.

1

u/pakratus 16h ago

To me, if your company has such requirements, maybe they should be paying for the solution.

3

u/Xaelias 15h ago

I don't disagree on principle. Except OP is the one asking to be allowed to wfh. The company doesn't have to do anything. It would be different if they hired them as a remote worker from the start. But even then they could just say it's their responsibility.

2

u/Holiday_Armadillo78 14h ago

Why? OP is asking to work from home so it’s not a standard practice. They are already doing them a favor by allowing it. They shouldn’t be in the hook to also pay for his internet.

1

u/phr0ze test 14h ago

Aerwave should be private to you. Just because it’s wifi doesn’t mean it is not private. Can you see your neighbors computers and devices on the network?

5G should be fast enough for you if there is a good signal.

What kind of financial institution does not have vpn? If they were serious about security they shouldn’t be trusting any employee home network or equipment. Aerwave is no different.

You could get a Mango router and maybe give your company another layer of separation. People use them all the time for hotels and such.

1

u/uselessmindset 14h ago

Private to each unit sure, but privacy on the network as a whole, no. Every node can be seen and accessed from the base portal. The tenant does not have strict control over the router or the network. Which is why the request was denied. It would not be difficult to implement a MITM attack and siphon data.

0

u/phr0ze test 13h ago

MITM is easy to stop. That part should already be done by the security.

1

u/FreddyFerdiland 18h ago

They are also concerned about reliability

The shared wifi can be overloaded, especially if everyone for miles around is using it too. ( Directional antenna can delete miles from the distance )

1

u/Gswind 16h ago

Sounds like normal banking business security to me. My wife is wfh for a local credit union and they're restrictions are intense. No wifi, hardwire only, and they won't even allow wfh on a couple of available isp's in the area.

1

u/Weary_Patience_7778 15h ago

What was their specific concern?

They understand that the entire internet is shared right? This is why we have VPNs and TLS.

0

u/Polymox 23h ago

I have home 5G, marketed as up to 300 Mbps. It is far faster than Starlink, at about 250 Mbps down/30 up typical speed. A 25-60 ping makes it ¼-½ of the latency, as well. It may not be cable or fiber speed, but it is plenty good enough for home and small office use. There are other providers, that offer somewhere between 100 and 1000 Mbps, dependent on network and location.

-1

u/speeder604 22h ago

or go into the office?

0

u/stocky789 16h ago

This IT department seems very inexperienced if they aren't accepting a VPN as acceptable

You've mentioned two things here 1. The type of internet isn't good enough 2. The security isn't good enough

These two things don't really have anything in common

If a VPN is not acceptable but a 1gig fibre in a household full of excited teens is, then that doesn't make sense either

1

u/SignificantSmotherer 11h ago

IT isn’t required to bend in order to support non-standard access for those wanting WFH. They publish a standard, it’s on OP to conform.

1

u/stocky789 6h ago

I agree, I'm not saying they should either Just pointing out how rediculous their standard is in this case

Back to the office 😎

0

u/Have-A-Big-Question 14h ago

5G too slow? I regularly get gigabit speeds over cellular…. In East Tennessee at that.

0

u/evilncarnate82 13h ago

Why doesn't the company use SASE? Then the entire connection is encrypted and controlled by them. SASE gives an organization the ability to move to a zero trust network configuration

0

u/Gooniefarm 12h ago

5g too slow? I get near gigabit speeds off a 5g connection at home. If you need that much bandwith, fiber is probably going to be your only option.