How I re–over-engineered my home network for privacy and security

Re:How I re–over-engineered my home network for privacy and ... by EvanAnderson on Wednesday September 01, 2021 @12:27PM (#28381963)

You don't want "unlimited" SSIDs-- you want a RADIUS-assigned VLAN and a single SSID. The credentials used to associate determine which VLAN the traffic dumps into. Your UniFi gear will do it.

Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons).

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by Johnny555 on Wednesday September 01, 2021 @12:34PM (#28382077)

Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons)

Yes, that's why I want more SSID's. My internal network does use 802.1x, but as you said, few devices outside of laptops support it.

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by egberts1 on Wednesday September 01, 2021 @12:50PM (#28382329)

You probably shouldn’t deploy an one-SSID model for your home network.

Not many kernel can separate traffic within a single SSID (even if you did use VLAN, tcpdump on a malicious IoT can still view the traffic.

Better to have four to seven SSID, each mapped to a subnet. Make one subnet/SSID for encrypted MAC with laptops.

Cable TV, Smart TV, power-line LAN adapters, smart lightbulbs and webcams should go on separate SSID/subnet.

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by megous on Wednesday September 01, 2021 @01:59PM (#28383399)

Or just one SSID, where you directly put all the Androids, iPhones, IoTs, and similar garbage in addition to your trusted devices connected via a overlay wireguard network on top in full mesh configuration.

You will not have to trust the potentially outdated wifi firmware, that is quite likely vulnerable to all the latest holes in wifi security.

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by privacyking on Wednesday September 01, 2021 @08:08PM (#28387142)

Wait so does enterprise wifi just send all VLAN traffic to every device despite a login being assigned to a single VLAN?

[ Parent | on HN ]