Radius Mac Authentication

[Michal2]

Hello, I would like to configure my Wi-Fi network to assign end devices to specific VLANs based on their MAC addresses. I want to avoid creating four separate SSIDs (personal, admin, guest, IoT) because it's inefficient. Is there a way to achieve this without using WPA-Enterprise (802.1X) and a RADIUS server? Perhaps there's another solution?

[_bernd]

Long thread is long but tldr yes.

Individual per-passphrase/per-MAC Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello *, I'm playing around with the wpa_psk_file option for wireless/hostapd because I found that it supports vlan assignment using the vlanid tag. This would be really helpful to create a segmented and client-individualised wifi network without having to spin up a dedicated RADIUS server. Extend wpa_psk_file to allow an optional VLAN ID to be specified with "vlanid=" prefix on the line. If VLAN ID is specified and the particular wpa_psk_file entry is used for a station, that station is boun…

[Michal2]

Thank you. I'm trying to configure this, but I am unable to connect to configured wifi. Could you take a look at my config files?

/etc/network/wireless

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Testing'
	option encryption 'sae-mixed'
	option ocv '0'
	option wpa_psk_file '/etc/hostapd.wpa_psk'
	option vlan_file '/etc/hostapd.vlan'
    option vlan_tagged_interface 'br-lan'
    option vlan_bridge 'br-vlanaaaa'
    option dynamic_vlan '1'
	option vlan_naming '1'

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option ula_prefix 'fdf6:faab:224a::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'admin'
	option device 'br-lan.183'
	option proto 'static'
	option ip6assign '60'
	list dns '8.8.8.8'
	list ipaddr '10.203.32.1/24'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'
	list dns '8.8.8.8'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option norelease '1'
	option peerdns '0'
	list dns '8.8.8.8'

config interface 'vpn'
	option proto 'static'
	list ipaddr '10.203.33.1/24'
	option device 'br-lan.184'

config interface 'DMZExternal'
	option proto 'static'
	list ipaddr '10.203.34.1/24'
	option device 'br-lan.185'

config interface 'users'
	option proto 'static'
	list ipaddr '10.203.35.1/24'
	option device 'br-lan.186'

config interface 'guests'
	option proto 'static'
	list ipaddr '10.203.36.1/24'
	option device 'br-lan.187'

config interface 'iot'
	option proto 'static'
	list ipaddr '10.203.37.1/24'
	option device 'br-lan.188'

config interface 'iotStrict'
	option proto 'static'
	list ipaddr '10.203.38.1/24'
	option device 'br-lan.189'

config bridge-vlan
	option device 'br-lan'
	option vlan '183'
	list ports 'lan1:u*'
	list ports 'lan3:t*'
	list ports 'lan4:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '184'

config bridge-vlan
	option device 'br-lan'
	option vlan '185'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '186'

config bridge-vlan
	option device 'br-lan'
	option vlan '187'

config bridge-vlan
	option device 'br-lan'
	option vlan '188'
	list ports 'lan2:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '189'

[Michal2]

I found a solution: WPA3 doesn't support this feature, so I finally use WPA2.