What limits VAPs/multi-ssid on hardware?

[mpa]

@fat_flying_pigs

If I could, I'd like to assign a vlan to each device, but at this moment I'm not confident that any device won't scan+spoof a mac address. I've looked into radius, but many IoT and other simple devices (printers) don't support it

Devices can be authenticated with individual PSKs (no WPA Enterprise, no RADIUS needed).

https://www.reddit.com/r/openwrt/comments/ynhyrp/comment/ivdl32u/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

It is possible to have multiple passwords for a single SSID and assign clients to VLANs based on which password they connect with using the wpa_psk_file option. This is supported by openwrt but not LuCI so you'd have to use the CLI to configure it. From the client's point of view this would be the same as any other WPA2-Personal connection and thus doesn't have any compatibility issues like WPA2-Enterprise.

Example hostapd.wpa_psk

Note that I have not tried this solution myself.

UPDATE: @takimata has tried it:

Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello *, I'm playing around with the wpa_psk_file option for wireless/hostapd because I found that it supports vlan assignment using the vlanid tag. This would be really helpful to create a segmented and client-individualised wifi network without having to spin up a dedicated RADIUS server. Extend wpa_psk_file to allow an optional VLAN ID to be specified with "vlanid=" prefix on the line. If VLAN ID is specified and the particular wpa_psk_file entry is used for a station, that station is boun…