Best way to prevent people using my wifi with shared password?

[bahtsiz_bedevi]

I have less than 20 clients on my network, and they frequently share the wifi password with their friends, which I don't want. What are my options?

So far I tried

1. FreeRADIUS with Simultaneous-Use:= "1" : I can't get it to work
2. Captive Portal: OpenWrt Setup on raspberrypi 4B using as a router for OpenNDS captive portal - #14 by bahtsiz_bedevi
3. (I'm using now) Whitelisted MAC filter: Clients with dynamic MAC address is a problem

[Dante]

Kick people out? Or:

Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello *, I'm playing around with the wpa_psk_file option for wireless/hostapd because I found that it supports vlan assignment using the vlanid tag. This would be really helpful to create a segmented and client-individualised wifi network without having to spin up a dedicated RADIUS server. Extend wpa_psk_file to allow an optional VLAN ID to be specified with "vlanid=" prefix on the line. If VLAN ID is specified and the particular wpa_psk_file entry is used for a station, that station is boun…

And then kick people out who misbehave.

[bahtsiz_bedevi]

Unfortunately it does not limit the concurrent use of a psk key. Multiple devices can use wifi with the same psk key,

[Dante]

You can limit by MAC, and ask people to set a static MAC, or not let them in. Or:

@Dante

Kick people out?

Is there a reason why you're letting people abuse your network and then making it your problem and not their?

[bahtsiz_bedevi]

I don't know why some people on this forum keep posting suggestions with no knowledge. Is it for the user badges?

The problems with your suggestion:

1. There's no way to know which client(s) is sharing the password
2. Probably you'll suggest wpa_psk_file option again for unique password for each client. Hint: hostapd doesn't reveal the psk key client used

[lleachii]

@bahtsiz_bedevi

The problems with your suggestion:

1. There's no way to know which client(s) is sharing the password

Before you bash the poster (again), please realize you just added this requirement.

[psherman]

You can use 802.1x authentication. This means using a radius server and deploying credentials on a per-device basis, but should meet your needs to prevent sharing.

[lleachii]

@bahtsiz_bedevi

FreeRADIUS with Simultaneous-Use:= "1" : I can't get it to work

He said that part.

[bahtsiz_bedevi]

He said kick the client who is sharing the password

[lleachii]

While a good idea, I agree it was quite an obtuse solution to your problem given your list of examples. Albeit, you proved little context as to why your use case requires you to admit people to your network, who subsequently compromise it.

Best wishes with getting RADIUS fixed.

[psherman]

Right. But despite the “can’t get it to work” statement from earlier, this is the way to achieve the goal, so working to resolve the problem(s) the op experienced would be the best path.

[bahtsiz_bedevi]

@lleachii

Best wishes with getting RADIUS fixed.

Yeah, it seems the best way. I just wanted know the alternatives. Thanks

[iamyangyi]

The simplest way is to write a script to restart when idle. Each time you restart, the MAC or the end of the SSID will be a random number. The shared WIFI is determined by the consistency of these two values ​​to determine whether it is the same WIFI signal.

[sfx2000]

@bahtsiz_bedevi

I have less than 20 clients on my network, and they frequently share the wifi password with their friends, which I don't want. What are my options?

Outside of the technical issues - I'm curious about the use case...

Most folks make assumptions, but I'm open to what you're trying to do here...