Ask HN: I want to put free WiFi in schools in my city, how do I go about it? | Hacker News Reader

Ask HN: I want to put free WiFi in schools in my city, how do I go about it?

28 pointschirau49 comments

I want to put Wifi in the schools. I wanted to know the technical and equipment requirements and the best way to approach it. I am considering 2 approaches.

1) Standalone for each school This is perhaps the simpler approach, just put a one strong setup at every school. I would need a splash login page where the student would log in with their student ID and password. The average enrollment at the schools is about 1k, and the area of each school is about a 500 meter radius.

2) Citywide approach With this one, the major difference is that the students will be able to login at any school in the city, similar to the edu network in the US

What sort of infrastructure would i need for one school with reliable strength? Any recommendations for actual equipment? What is the price estimate/range for one school in the first approach? Are there any companies that already exist that offer this solution including the login stuff as well?

What would be the extra requirements to go from standalone setups to the citywide approach?

View on HN

You didn't mention what country you're in or what level of schools you're targeting. This matters a lot.

-----

A lot of people think schools are kind of "naive" and "under-resourced" but you will quickly find at least in au/nz that even primary/intermediate schools are quite a lot more regulated / bureaucratic than you might expect. I'm guessing the US could be even worse.

Schools already have Internet. So, why do they need yours?

Why should they trust you? What kind of organisation are you? How many of you are there? I noticed you mentioned "student ID and password" for auth. Are you expecting the school to provide you with this information?

Do you like paperwork? Even if it's free, if you have equipment on their grounds and are providing a service to students you'll need a contract with the school. What's your privacy policy? What kind of SLA are you providing? Is the support free as well? You'll probably have to go through their supplier/vendor assessment process and there may be heavy restrictions around authorised suppliers. Are you going to have staff or contractors visiting the school grounds on a regular basis? Understand they'll need various background checks etc and you'll have to keep this stuff up to date.

Be prepared to learn a lot about the various standards and regulations schools and their suppliers have to comply with.

A key question is, are you going to do traffic filtering yourself or use a commercial service? You cannot provide a "raw" feed to students.

The kind of traffic filtering and monitoring available to schools is now far more advanced than what people used to do for free with netfilter/squid. For sure, when little Timmy sees a disturbing _news article_ while hooked up to your feed eventually you will get complaints about this which will go from child -> parent -> school -> you. The kind of filtering schools need now costs money, how are you providing this service for free again?

This is 100% the answer for Western countries. Most k-12 schools have decent wireless in the US today. And they also have massive restrictions on its use due to all of those reasons.

> And they also have massive restrictions on its use due to all of those reasons.

not sure if crippled institutional wifi offers any tangible benefit in the age of ubiquitous cellular internet access besides the usual incentive of researching technical workarounds to the filtering.

Technically knowledgeable parents will understand that, but what do you answer to somebody saying “I don’t buy mobile data plans for my children, and now they accessed something bad on their devices due to the network you set up”?

i agree there is a problem of differentiation among commoners, but i hope we can agree that net neutrality is a good thing and policing content should be left to clients

Aspirationally, I'm with you – but practically, there are parents that know how to set up the (much more effective, given ubiquitous encryption, VPNs/private relay etc.) on-device controls, and there are those that don't have the resources to do that.

You could say that it's a lost cause, that their kids will just find public Wi-Fi elsewhere, that their classmates with mobile data can just open unmonitored Wi-Fi hotspots from their devices etc., that the better approach is to educate kids and give them the skills to deal with the complete unfiltered internet rather than to build more guardrails, and I'd even agree with some of these arguments to an extent.

But you'll almost certainly find parents within the same school that view it differently and you will be fighting an uphill battle.

karens ruining it for everyone... maybe the best thing is laughing

Look, I hate censorship as much as the next person, but giving kids access to porn in school is a weird hill to die on when the useful parts of the Internet (at least for middle schoolers) are unblocked.

very wired, indeed; everytime i had to do it. but i think it's worth the effort because everytime someone refrains from making others responsible for their own problems, the world get's a bit better to live in for everyone.

You’re saying a world where students can sneak onto the teachers computer before class starts and put on porn and force the entire classroom to see and hear it is a better world? I can assure you that would be one of the main uses, because it was done in my classroom using sites that the filter missed.

Ridiculous opining for an idealistic world where everyone is an inclined curious student demonstrates your disconnect from the real world. Too much time on HN and the internet will do that to you.

no, i am not saying that. sorry you misunderstood

Yes. Theories are great. The execution is where these things get messy.

In theory, the responsibility for uncontrolled access to the Internet is something everyone should be responsible for, to themselves.

Expecting children to be responsible and make positive decisions, and especially when they're working in groups, is naive at best.

Teenagers aren't great at understanding consequences. And maybe open Internet access in schools isn't the best way to teach that?

> And maybe open Internet access in schools isn't the best way to teach that?

maybe not THE BEST, but pretty effective, cheap and scalable

For 2)

https://eduroam.org/how/

> eduroam is based on 802.1X* and a linked hierarchy of RADIUS servers containing users’ data (usernames and passwords). Participating institutions must have operating RADIUS infrastructure and agree to the terms of use. eduroam can be set up in three easy steps:

https://www.serverwatch.com/networking/radius-server/

> RADIUS works based on a client/server model. Users connect to a RADIUS client, which is a network access server (NAS). The NAS then verifies the user’s information through the RADIUS authentication server. The connection information can include details such as a username, a password, and an IP address.

Great answer.

I think though that this response is predicated on the school's coming from a relatively developed nation.

If the poster is not from one and is talking about getting free internet in locations that don't have it at all for their school I think the answer would be different. Because then it's mainly about the cheapest technology that can get it done, and won't be touched or bothered by anyone because it's not worth it.

Why would that only work in "relatively developed nations"? People from less "developed" nations aren't stupid savages, they just have access to fewer resources. Look at this map https://eduroam.org/where/ The countries where eduroam don't exist are mainly just countries that don't have international academic visibility, with universities that are mainly focused on teaching to local students rather than conducting bleeding-edge research. Again, not because they're idiots, but just because with fewer resources you have to prioritize. Setting up 802.1X and RADIUS servers isn't much more expensive than setting up e.g. an email server, and you can bet that they know about email even in those places you consider less "developed".

because it only works in countries that have their international relations developed enough in order to be included

Wat? It's software.

Not at all, it’s a network. A new provider joining has security implications. You get all devices with Eduroam configured to auto-connect to your access point, for one thing.

You could say that that’s no worse than providing unencrypted Wi-Fi with a common SSID that people might have configured on their devices as auto-connectable, but I think the perception of Eduroam as being better than that (due to being encrypted) does exist.

To efficiently manage that, Eduroam is set up as a “federation of federations”. To join, you’d have to work with your country’s academic/research network organization (NREN), which are often affiliated with tertiary education institutions. These have very different problem domains than primary or secondary schools. For example, most people eligible to access Eduroam will be adults.

> Setting up 802.1X and RADIUS servers isn't much more expensive than setting up e.g. an email server

Often, this implies throwing out all of your existing access point hardware in favor of something that supports 802.1X/WPA Enterprise. You also need to build out a Radius authentication backend if you don’t only want to support inbound roaming.

My comment is mainly focused on a difference in government oversight in devloping countries, I make the assumption that less developed nations have less standard procedures and regulatory requirements.

The main issue being getting the technology and setting it up. Not talking with the IT department at a school.

Of course there will be some people that the poster should talk to, but I think that hurdle is relatively lower than getting extensive network equipment delivered to places which have underdeveloped infrastructure.

Most schools have entire departments of IT people with Director level people that have job responsibilities to do what you describe. If it is a US public school they are probably restricted in dealing with specific vendors and/or a formal RFP process. Also you're dealing with the state/local government essentially with US public schools so be prepared for a lengthy process, background checks inclusive of checking the background/validity of your company as well as any people. That is even if the school would consider outsourcing this, again they have staff that do this work and support it.

If you feel that compelled to help your local school(s), a donation would be much easier logistically.

Most districts have someone in charge of technology, and they probably would love to get more resources and support. Find out who they are, call them, and start a conversation. Because even if they welcome the help with open arms, schools often already have vendors they work with, so you want to understand the status quo and then fill gaps in their existing tech.

I've got to ask...why? If the schools don't already have WiFi, they don't have curriculums that could use it. Or they have internet access that's wired and no computers that would be on the WiFi anyway, and then you're just connecting kids' phones (which already have internet).

Besides the wild amounts of red tape in the US that the other commenters mention, don't you think what you're doing is creepy? If I had kids, I 100% would NOT want some random guy to be using his own money to build a WiFi network in my kid's school. The optics of that are terrible. How do I know you're not going to be creeping on the network traffic? There's no obvious reason for you to 1) want to do this project and 2) not just give the money to the schools' existing IT staff to do it (and I'm sure most districts would gladly accept a gift like that). Seriously, why do YOU need to be the one doing it?

Who do you think actually builds out the wifi networks at schools? It's not exactly the Fine Arts teacher running CAT6 and creating subnets for the different departments. It's better to assume positive intent until proven otherwise when people want to help out their communities.

> It's better to assume positive intent until proven otherwise when people want to help out their communities.

That might work in places like Japan or Scandinavia where there's high social trust. People in other places are very suspicious when a rando wants to be around everyone's kids.

Asking "I'm an IT guy for a school district and I'm looking for guidance on WiFi" is very different from "I want to put Wifi in the schools."

Even if the op is indeed doing it from a place of good intent, I really, really struggle to read this ask as being from someone inside the schools already. They didn't say "my schools" or "our schools". They said "login at any school in the city", not something like "any of the schools I manage" or "any schools in the district". Even for someone who doesn't speak English as their first language, the word choice consistently suggests OP is an external third party.

Maybe it's a very American concern of mine, but I simply do not trust anyone who is proactively trying to do something like this as a benevolent third party. And you probably shouldn't either! Would you sleep well at night knowing that some random guy external to your kid's school (with ~no governance or accountability) has unfettered access to their WiFi?

I work in a school IT department. We have full Wi-Fi coverage of all our buildings. We definitely have filtering in place, both DNS and managed extensions on student Chromebooks. We use Cisco Meraki switches and APs for connectivity, with Cisco Umbrella for DNS filtering.

The Federal Government has programs like E-Rate that reimbursee districts for up to 90% of the cost of getting internet access for students, but like other commenters have said, paperwork. Unless you can get full support from the superintendent/board, bureaucracy will 100% be your biggest obstacle.

Sounds similar to https://www.eff.org/pages/openwirelessorg

In Germany we have https://en.wikipedia.org/wiki/Freifunk who put up network in open places and under-served areas like refugee shelters. But government also added wifi to all schools I know of (and the refugee shelters).

Huh. I am out of school for a long time now, but honestly I would be very surprised they managed to really get WLAN to all schools. They haven't even managed to get it to all train stations. Do you have reliable information, that now all schools have to have WLAN, by law or something?

> similar to the edu network in the US

Presumably you mean Eduroam? It's global, the Americans were actually (as with so many things) late to adopt, but it works just as well for a student from Edinburgh to use WiFi in Waikato (New Zealand) as for a student from Tokyo to use WiFi in Harvard (Mass).

Importantly, these are all (to my knowledge) tertiary education institutions, i.e. people eligible for Eduroam access are adults. Very different domain.

Although historically Eduroam, like Internet access itself, began at research institutions and where they do tertiary education, there's nothing stopping a K12 from having Eduroam.

They need to be able to tie all the Eduroam enabled account credentials to specific humans so that when the University of Plymouth says "This user was downloading porn videos and that's not OK by our usage policy" you can tie that to 15 year old Steve Smith in class 8F and tell him to use his WiFi network at home to watch porn.

But it's not about adulthood, universities have always had a small number of non-adult students, acting "in loco parentis" to try to keep them out of harm's way as much as real parents likely would for a teenager. Eduroam doesn't care what your country says about majority, ages of responsibility etc. it just wants to tie every user to a member institution via an NREN.

> Eduroam doesn't care what your country says about majority, ages of responsibility etc.

Oh, I'm not saying that this was an explicit design goal of Eduroam, but I strongly suspect that there would be a whole new set of challenges the organizations running it might not be prepared for if they were to extend it to K12.

Your customer base heavily influences the types of issues people might try to hold you responsible for, whether it's reasonable or not.

I think you're talking about this as a hypothetical, but it's been a reality for some time.

My understanding is that US states began rolling this out a few years ago.

I mean this kindly - I notice that this is one of many, many questionable Ask HN posts you've made, most of which end up with nearly no engagement. I get the impression from the questions you ask that you're not an engineer, in which case I don't really know that putting WiFi in schools is a good investment of your time. You're going to have a hard time finding schools interested in taking you seriously without some level of credentials.

If you're feeling inclined to help in better equipping kids with tech, donating to Kids Teach Tech or Black Girls Code etc might be a better use of your resources.

> What sort of infrastructure would i need for one school with reliable strength? Any recommendations for actual equipment? What is the price estimate/range for one school in the first approach? Are there any companies that already exist that offer this solution including the login stuff as well?

You need multiple APs and then an authentication/authorisation system that allows navigation for users once you know who they are and that they should have access to the network.

The difference between both systems relies mainly on the authentication, and in both cases, most equipment vendors provide options to set a Guest Portal up. The other option would be to host a RADIUS server (also referred to as WPA Enterprise) that does the authentication.

The regional administration where I live maintains some sort of student network for schools too, and they use RADIUS. They maintain a public website where user credentials are managed (you identify with a username/password they give you and you can change those credentials) and then connect to the wifi using those credentials

Again, how you deploy this, depends in many cases on the vendor you choose and what they support.

There's https://en.wikipedia.org/wiki/Eduroam which was founded for this use case and allows students to even roam between multiple universities. Maybe a starting point?

There might also be some legal implications by doing this - in the UK we have to log everything at student ever goes on or searches to be compliant with safeguarding regulation.

What country? If in the US, the school should be buying equipment through the E-rate program where the federal government will pay for 80% of it and installation.

Why do schools need wifi?

Surprised nobody is asking this.

In places like France this is even against the law, and personally I am of the opinion that it is for the better.

Its not against the law in France: https://skeptics.stackexchange.com/questions/55977/did-franc... I'm not really sure it matters if wifi is not allowed in schools as cellphones are so prevalent now so you aren't stopping anyone from accessing the internet if they really want to.

At my son's school (Finland) the students are loaned a laptop/chromebook for coursework, communication etc. Particularly since the Covid lockdown.

My kids' school in rural Midwest US has been giving every kid an ipad and providing wifi on the bus since ~2014. They had classroom WiFi in early 2000s at the latest.

Really not sure what OOP is talking about.

Right but what is the point of having internet in a school?

Because teachers use technology. Students use tablets/laptops. These are standard tools of modern education.

FYI, Laws require filtering and a lot more.

(This is why I love Libertarians.)

hello,

as always: imho…

idk, but at first this is an organizational problem: what do you try to solve with this?

from what i understand:

you have a problem: <which one!?>

your solution: put free wifi in schools or even "citywide" ...

again: whats the problem you are trying to solve with this!?

why i'm asking this: its 2024 ...

1. why isn't that infrastructure already available in those schools? lack of money? lack of ...?

2. where / in which country are you? every school in every at least "somewhat" developed ("western") or generally somewhat "industrialized" country should have wlan for their students by now ... why isn't that already present in yours!?

the technical approach:

you need:

* controller

* access-points

* connection-links between controller/aps/... (which would be parts of the LAN of a school for example ... but city-wide you'll need some kind of fixed lines)

* uplink(s) to "the internet"

authentification ... there are multiple possibilities, but the tried and true approach would be:

* RADIUS (which can be used by the controller(s))

* LDAP (as the backend for the RADIUS server)

equipment: do you want it to work or do you want to work on it!?

expensive, but "works" - out of my head

* cisco

* aruba

* ...

they are expensive, but they are "enterprise ready" and stable ...

costs ... depending on which company you choose, what conditions you are getting from the distributor etc. - i remember the price for schools/universities are sometimes only 2/3rds or even half of the "official" customer-prices advertised if you buy them via an "official institution" - university/school/...

so this is more an "estimate":

* access-points: a few 100 € to over 1000 €

* controller: multiple 1000 € to 10+ k € a piece - for a somewhat "larger" installation you need 2 for redundancy/availability of the network

depending on the size of the area and the size of the buildings themselves you are trying to cover, you need for example 20, 30 ... 50 or even more access-points + 2 controllers => which quickly adds up to something like 50 k or 100k € for a medium sized areal + buildings.

you have to distribute the access-points in a meaningful manner - idk. for example avoid interference from aps within your building from the floor above or beyond the one you are in, you have to "interleave" them ... not just put the aps to the same place in every floor etc. (this enhances the operational distance for an ap and therefore reduces the number of aps needed for the building)

you want to take into account the possible number of clients in certain rooms/places etc. ... the controllers need to have enough aps to be able to "balance" the number of clients on to multiple aps ... for example within a larger area or hall etc.

just my 0.02€

Reply on news.ycombinator.com