Forcing selected WiFi devices to use IoT firewall zone via a single SSID

[sct898]

Hi, I want to place all my IoT wifi devices within a separate firewall zone - separating them from trusted LAN devices - but all the tutorials i find online accomplish this using multiple WiFi SSIDs.

Through openwrt, is there a way I can select which of the connected WiFi devices (e.g. by their mac address) should be forced to use the IoT firewall zone which I have setup? And therefore all other devices will default to use the standard LAN firewall

Do I need to setup a new interface, a new bridge/device, a vlan? Any advice, instructions/tutorials would be most welcome

[egc]

See: https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_webinterface

[frollic]

That's exactly what OP didn't want ?

@sct898 check if PBR can do what you need.

[OpenWrt Wiki] PBR (Policy-Based Routing)

[slh]

The short answer is: no, you can't do that.

Once a device has physical access to a network, be it plugged into the same switch (VLAN group) or using the same ESSID/ PSK, they have access to 'everything' within that network, without any filtering (and from there also beyond, to the internet). Yes, there are some 'advisory' (voluntary, if the client devices choose to follow) things that can be applied on a per-MAC/ IP base, but there's nothing preventing the client from ignoring these (and using another MAC/ IP). If you want to enforce your policies, you need to segregate your topology into multiple -physically distinct- networks (VLAN groups/ access ports filtering access of multiple ESSIDs) and give the clients only access to their network, without any shortcuts to circumvent the policies set by your router and enforced by (managed-) switches and APs.

[psherman]

You can setup multiple subnets, all linked to a single SSID. Then, the password used will connect each device to the relevant subnet.

Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello *, I'm playing around with the wpa_psk_file option for wireless/hostapd because I found that it supports vlan assignment using the vlanid tag. This would be really helpful to create a segmented and client-individualised wifi network without having to spin up a dedicated RADIUS server. Extend wpa_psk_file to allow an optional VLAN ID to be specified with "vlanid=" prefix on the line. If VLAN ID is specified and the particular wpa_psk_file entry is used for a station, that station is boun…

[slh]

At that point, multiple distinct ESSIDs is a better approach (the requirements on the hardware, the valid interface combinations) are the same.

[takimata]

@psherman

You can setup multiple subnets, all linked to a single SSID. Then, the password used will connect each device to the relevant subnet.

I titled the forum thread "per-passphrase VLANs". But it doesn't actually have to be "per-passphrase", it can also be "per-MAC" (and I just fixed the thread title accordingly). Each line in the wpa_psk file, or each UCI wifi-station section respetively, can be specific to a MAC address, even with the same PSK. Which is probably most in line with what the OP intends to do.

I never tried distinguishing by MAC, though. Most importantly I never tried what happens when one wpa_psk line is specific to one MAC, and one isn't (and uses the wildcard "00:00:00:00:00:00"). I feel it's worth investigating if the latter will be the fall-through if the PSKs are identical, and whether the (wpa_psk/UCI entries') order matters.

@slh

At that point, multiple distinct ESSIDs is a better approach

I don't agree. The wpa_psk approach allows one to move devices between VLANs without having to reconfigure the devices' wifi settings. Which can be a real hassle especially with "smart" IOT devices.