Firewall separation inside same SSID

[gystein]

Dear OpenWrt users,

I would like to create a LAN, Guest, IoT network separation on the same SSID. Is it possible? I guess based on the MAC address I could make the separation. Could you help me with this? Are there any guides, which do the same?

Thank you!

[slh]

The easy (and only reasonable) answer is no, you can't.

All devices sharing the same ESSID are inside a single L2 network, ethernet is a p2p network and every peer can talk any peer within the same broadcast domain.

The sensible solution would be not giving untrusted devices access to the main network/ ESSID, but to segregate networks and route between them (with your desired firewall policies).

Yes, there are more complex answer available for a subset of environment, but those are rarely sensible.

[13en]

You can create vlans for each subnet, then create 3 SSID's with the same name and attach a different vlan to each with it's own password, when you connect just use the password you set for each network, e.g. guest and the devices will connect to its respective network. just forget the network from the device if you want to switch networks.

[Phoenix]

There are multiple ways to kind of solve your problem, but as slh pointed out, they will neither be elegant nor a whole lot stable.

I had the same problem where multiple Essids was not an option so I dabbled with various options starting from dynamic vlans with radius to ppsks with config files. Eventually I settled on ppsk with radius. This allows me to move devices across vlans through radius auth file without having to modify wifi configurations on the device itself.

If you could share your requirements, perhaps I can share a couple of configs and how-tos suiting your particular requirements.

[Mijzelf]

Individual per-passphrase/per-MAC Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello *, I'm playing around with the wpa_psk_file option for wireless/hostapd because I found that it supports vlan assignment using the vlanid tag. This would be really helpful to create a segmented and client-individualised wifi network without having to spin up a dedicated RADIUS server. Extend wpa_psk_file to allow an optional VLAN ID to be specified with "vlanid=" prefix on the line. If VLAN ID is specified and the particular wpa_psk_file entry is used for a station, that station is boun…

[gystein]

Thank you for your answers! To be honest, creating an IoT SSID is not a problem, but for the LAN... I am afraid of the following usecase: if someone comes over, I am sure my wife will share our LAN SSID with password. Maybe I should create separate LAN for my wife...

[psherman]

Or make a guest and/or IoT network and put some QR codes around the house so that your wife and your guests can easily scan and join.