News for hackers. Stuff that matters.
Re:How I re–over-engineered my home network for privacy and ... by Johnny555 on Wednesday September 01, 2021 @12:00PM (#28381505)
Does anyone make an AP that allows unlimited (or at least a lot) of SSID's tied to separate VLANs? My Unifi's only support 4, so I have my private network (for my own laptops, etc), guest network, camera network and IoT network.

But I'd love to be able to separate IoT devices across multiple networks, so I could have one for smart switches, one for TV/media players, etc.

Re:How I re–over-engineered my home network for privacy and ... by EvanAnderson on Wednesday September 01, 2021 @12:27PM (#28381963)
You don't want "unlimited" SSIDs-- you want a RADIUS-assigned VLAN and a single SSID. The credentials used to associate determine which VLAN the traffic dumps into. Your UniFi gear will do it.

Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons).

Re:How I re–over-engineered my home network for privacy and ... by Johnny555 on Wednesday September 01, 2021 @12:34PM (#28382077)
Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons)

Yes, that's why I want more SSID's. My internal network does use 802.1x, but as you said, few devices outside of laptops support it.

Re:How I re–over-engineered my home network for privacy and ... by egberts1 on Wednesday September 01, 2021 @12:50PM (#28382329)
You probably shouldn’t deploy an one-SSID model for your home network.

Not many kernel can separate traffic within a single SSID (even if you did use VLAN, tcpdump on a malicious IoT can still view the traffic.

Better to have four to seven SSID, each mapped to a subnet. Make one subnet/SSID for encrypted MAC with laptops.

Cable TV, Smart TV, power-line LAN adapters, smart lightbulbs and webcams should go on separate SSID/subnet.

Re:How I re–over-engineered my home network for privacy and ... by megous on Wednesday September 01, 2021 @01:59PM (#28383399)
Or just one SSID, where you directly put all the Androids, iPhones, IoTs, and similar garbage in addition to your trusted devices connected via a overlay wireguard network on top in full mesh configuration.

You will not have to trust the potentially outdated wifi firmware, that is quite likely vulnerable to all the latest holes in wifi security.

Re:How I re–over-engineered my home network for privacy and ... by privacyking on Wednesday September 01, 2021 @08:08PM (#28387142)
Wait so does enterprise wifi just send all VLAN traffic to every device despite a login being assigned to a single VLAN?
Re:How I re–over-engineered my home network for privacy and ... by rand49an on Wednesday September 01, 2021 @12:04PM (#28381584)
All enterprise gear should allow you to have multiple SSIDs on different or dynamic VLANs. You won't have that issue on Meraki, Ruckus, Cisco or Aruba gear.

It's worth noting though that more than 3 SSIDs brings with it radio overhead which can degrade performance of your wireless network.

Re:How I re–over-engineered my home network for privacy and ... by Johnny555 on Wednesday September 01, 2021 @12:24PM (#28381905)
I'm fine with losing Wifi performance if I can improve my home network security. When I'm sitting at my desk, my laptop is hardwired, and my only 4K TV is hardwired, so I don't have any great bandwidth needs, and even with 4 SSID's broadcast, I'm maxing out my 500mbit internet connection, so I even if I lost half that to overhead, I'd be ok with that.

I've also thought about just setting up multiple nodes, one set for secure devices, one for insecure devices.

Cisco "only" supports 16 SSID's, which is probably more than I'd even need.

Re:How I re–over-engineered my home network for privacy and ... by pyther24 on Wednesday September 01, 2021 @02:37PM (#28383918)
The Aruba Instant-On AP22 might do the trick. It uses the same hardware as the Aruba AP-505 which support 16 BSSIDS. I couldn't find a documented limit for the AP22. Note, the instant-on series uses a cloud controller and can't be managed locally, however it is a fraction of the price, $180 (Instant On AP22) vs $460 (AP-505).
Re:How I re–over-engineered my home network for privacy and ... by superbaconman on Wednesday September 01, 2021 @12:36PM (#28382096)
Yeah this is what I'd like. I don't think I'd ever feel comfortable putting these shady devices on the same LAN as my PCs.
Re:How I re–over-engineered my home network for privacy and ... by second--shift on Wednesday September 01, 2021 @02:56PM (#28384138)
Mikrotik. I have 5 'virtual' APs broadcasting wifi links for 5 different vlans / subnets.