One WiFi, Multiple Networks! Segment your WiFi Network with Private Pre-Shared-Keys

Do you love segmenting your network into as many subnets and VLANs as possible? Do you have too many Wifi networks for all of your special flower IoT devices that can barely speak IP, let alone fend for themselves on the wild internet? You could use WPA EAP Enterprise Authentication, but good luck getting your smart toaster to log in. The solution I'm playing with is called Private Pre-Shared Keys, where each client can potentially have their own passphrase and VLAN assignment for the same SSID, and the client just has to support normal passphrase authentication.

Using this method, along with a RADIUS server to manage clients, we can individually assign settings per-client such as their own PSK, VLAN ID, and more!

For this video, I'm using a Mikrotik wAP AC with RouterOS 7.8. I'd like to try OpenWRT in the future, but as of the making of this video it's not quite ready.

Copies of my FreeRADIUS and RouterOS configurations can be found on my blog:

Feel free to chat with me more on my Discord server:

Timestamps:
00:00 - Introduction
01:19 - RouterOS WiFi Setup
04:15 - FreeRADIUS and RouterOS
08:28 - RADIUS Acceptance
12:02 - Per Client Settings
15:24 - Match by MAC OUI
17:12 - Privacy MAC Addresses
19:26 - AP Filtering
21:35 - Guest Wifi Client Isolation
22:50 - OpenWRT?

#wifi #security #networking

[Techintx]

Just when I though I finally had my network all ironed out, with some compromises to avoid a bunch of IOT ssid’s, you make this video. Now I have to reevaluate my layout and decide if I want to spend my weekend on this.

[irvinekinny]

Thank you so much, good sir. You are truly helping the IT world with your videos and manuals. All I could wish for is just that I've found your channel much, much earlier

[georgH]

That's quite neat solution.
For years, I've had my main network, with the main SSID across all wifi access points (the AP are interconnected using CAT5 1Gbps, I hate wireless bridges) and a second SSID for guests and other devices.
The guests SSIDs use a different VLAN on each router, not routable through the main LAN, and with clients isolation. They get internet using SNAT.
All of this is configured through ddWRT using really low-end routers released in 2013, but hey, they have been working well enough for many years :)

[robertopontone]

Great video # not easy but super interesting # Let me reiterate how you manage with your channel to cover topics not touched by many other tech channels, also you network knowledge is quite impressive.

[ErkinOrdulu]

Congratulations, great project! It's inspiring and I'd love to try it myself. However, watching this makes me feel excited and a little overwhelmed at the same time.

[TheTekkster]

Fantastic video. You showed all the things I search on the internet. You're great! Thanks.

[nezu_cc]

Mikrotik now supports running docker containers directly on arm and arm64 devices. you could probably install the radius server on the Mikrotik itself and then you would have a self-contained system that works even if your proxmox box goes down.

[calebjpryor]

Oh man this was so refreshingly good. They say if you can explain complicated things simply you know them well. You my sir know them well. Thank you keep it up and I do hope this works with wave2 radios

[phsouzabr]

Very thorough tutorial, I'll try it soon! Thanks!

[mihumono]

I started playing with this in openwrt vm with usb wifi card and it works great so far. It wasn't that complicated to setup.

[hoover]

Not a single legacy IP in sight. It's beautiful! 🤩
Would you say it's secure to just allow any Mac address and completely rely on password based authentication?

[zekicay]

It works in OpenWRT 23.05.0-rc1 using wpa_psk_file. Previous versions have bugs.

[deltax-ray]

Man, I didn't know you could do this. Thank you so much for sharing!

Now to work out if unifi / tplink actually supports it. Probably not, maybe time to go AP shopping 😅

[ziozzot]

really cool now i have to figure out how to do this on my AP

[xoredG]

Did you ever look back at OpenWRT and whether that’s supported now? I’d love to have this kind of setup for non WPA3 clients without committing to an old radio

[patrickweggler]

Great tutorial! Could you show this with the omada stuff, too?

[thestreamreader]

How are you making sure all this configuration is backed up. My Problem is i got so many things like this running cloud vps projects that I wont remember how to get them back up cause its normally 1 and done and never touch it again.

[alexaka]

Wireless Access Point was not my first guess on why it was called WAP.

[pcmke]

Can you match clients based on the PSK they supply? For example, use one SSID and allow anyone to connect… but based on the PSK supplied throw them into a certain VLAN? password1 = VLAN1, password2 = VLAN2, no password given = walled off VLAN with client isolation and limited bandwidth?

This seems like a more elegant approach then worrying about max addresses. Is this possible maybe with multiple default rules and fall-through yes arguments?

I guess I should have mentioned I’m coming from a UniFi environment and I guess this is called PPSK and isn’t something that would work with UniFi. Shame.

[himiko_pl]

Why not use buildin Radius server? "User Manager is RADIUS server implementation in RouterOS"