I am worried that there is not really a benefit of doing that, just more noise and energy consumption.
Energy consumption is essentially the same, as it’s using the same radios.
For what it’s worth, I have several SSIDs, each on a separate VLAN:
- my main one
- Guest. Has internet access but is otherwise isolated - Guest devices can’t communicate with other guest devices or with any other VLANs.
- IoT Internet: IoT and home automation devices that need internet access. Things like Ecobee thermostat, Google speakers, etc
- IoT No Internet: Home automation stuff that does not need internet access. Security cameras, Zigbee PoE dongle (SLZB-06), garage door opener, ESPHome devices, etc
(to remotely access home automation stuff, I use Home Assistant via a Tailscale VPN)
Most of these have both 2.4Ghz and 5Ghz enabled, with band steering enabled to (hopefully) convince devices to use 5Ghz when possible.
This is on a TP-Link Omada setup with 2 x EAP670 ceiling-mounted access points. You can create up to 16 SSIDs I think.
Ooh I like the idea of “no Internet.” I do trust all of those devices (open source), but they could still be pwned.
Guest devices can’t communicate with other guest devices
How do you accomplish this isolation since they’re on the same subnet/broadcast domain? Is it a feature of the hardware you’re using?
A lot of access points, even consumer-grade ones, have this option. It’s usually accomplished via predefined firewall rules on the access points themselves.
Consumer-grade access points usually let you have just one isolated guest network, whereas fancier ones (Omada, Unifi, Ruckus, Aruba, etc) usually let you enable isolation for any SSID (ie the “guest network” is no different from any other SSID)
Isolated guest networks I get, but isolating guests from other guests on the same subnet/isolated net is what I haven’t seen.
If there’s an option on the AP to not permit link local routing within a vlan/ssid, that will force all traffic up to the firewall. Then you can block intrazone traffic at the firewall level for that vlan.
I’ve seen this in Meraki hardware where it’s referred to as “client isolation”. Ubiquiti might be able to do this too.The APs know who the Wi-Fi clients are and just drops traffic between them. This is called client/station isolation. It’s often used in corporate to 1) prevent wireless clients from attacking each other (students, guests) and 2) to prevent broadcast and multicast packets from wasting all your airtime. This has the downside of breaking AirPlay, AirPrint and any other services where devices are expected to talk to each other.
I used to have a Netgear Nighthawk router/AP I bought from Costco, and if I remember correctly, its guest network automatically isolated guests from other guests. This router didn’t support VLANs so I think it was just a bunch of firewall rules.
That was an amazing read. Thank you.
What do you say is the use case for separating guest Wi-Fi with the more “private” stuff on your network?
As far as I understand… Basically all communications, even inside a network, are encrypted… So I guess you do that to avoid someone trying to exploit some vulnerability?
Remember that once you give the password out, they likely have the password from now on. They will always have access until you change the password.
No, a lot of local traffic is not encrypted, especially residential. No, residential probably doesn’t use much authentication or separation of privileges.
I think the main benefit is that Guests devices on your network can’t find and exploit your own devices.
If you don’t trust the person, why give them access to your WiFi in the first place?
You can trust the person, without trusting their technical skills, such that they haven’t inadvertently installed malware on their own devices.
Basically all communications, even inside a network, are encrypted
LOL, oh no.
Even internet traffic isn’t encrypted by default.
Sadly TCP/IP isn’t encrypted.
I’m not sure that I understand the “more noise and energy consumption” part, since we’re still talking about the same router with the same connected devices.
But I do have multiple SSIDs on my router. One is explicitly for IoT devices, and they don’t have network access, so they are isolated from my computers, NAS, etc.
The more SSIDs being broadcast the more airtime is wastes on broadcasting them. SSIDs are also broadcast at a much lower speed so even though it’s a trivial amount of data, it takes longer to send. You ideally want as few SSIDs a possible but sometimes it’s unavoidable, like if you have an open guest network, or multiple authentication types used for different SSIDs.
What benefit are you looking for? It shouldn’t affect speed unless you are really hammering it. I’m assuming your talking about two networks on the same frequency (either 2.5Ghz or 5Ghz)
Separate subsets, segregated traffic. Easy to avoid crosstalk by setting channels further apart or using 2.4ghz and 5ghz
At home I have one SSID as a main wifi, and the other is guest wifi and IoT or other random devices.
Main downside is getting it setup and maintenance.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DNS Domain Name Service/System IP Internet Protocol IoT Internet of Things for device controllers NAS Network-Attached Storage PoE Power over Ethernet TCP Transmission Control Protocol, most often over IP Unifi Ubiquiti WiFi hardware brand VPN Virtual Private Network Zigbee Wireless mesh network for low-power devices
10 acronyms in this thread; the most compressed thread commented on today has 11 acronyms.
[Thread #570 for this sub, first seen 4th Mar 2024, 09:55] [FAQ] [Full list] [Contact] [Source code]
Good bot
I am worried that there is not really a benefit of doing that, just more noise and energy consumption.
If there wasn’t a benefit, why would people (and pretty much every business) do it?
Why would you want to do this, anyway? Or, as I as a developer regularly have to ask our sales people: what do you actually want to achieve that led you to this question?
Here’s my use-case, I’m pretty sure the first 2 are pretty common (common enough to be supported by most OEM firmware):
- main LAN
- guest LAN (isolated from “main” but can access internet)
- IoT LAN (isolated from internet, can be accessed from “main”; prevents devices from phoning home)
But you don’t need several LANs for this. This can easily done with proper routing. A can access internet and internal network addresses. B can only access internet, and C can only reach internal addresses.
I’m curious. How would you identify who’s guest and who’s not in this case?
With multiple networks it’s pretty easy as they are on a different network.
That’s what MAC whitelists are for. Your DHCP server should be able to handle this.
Identify your friendly devices and give them one setting with everything (full subnet and correct default GW). Identfy your IoT devices, and give them another (full, or specially limited subnet mask, and fake default GW, maybe a different nameserver, too). Anything else is guest and gets a very limited subnet mask and a working default GW.
This is not the way to do it. The correct way would be multiple SSID’s with each tagged to their own VLAN.
Each VLAN has its own subnet. You can then use a zone based firewall, to allow the zones(subnets) to access each other.
You can also then apply QOS, to limit guest network speeds, prioritize LAN traffic etc.
And zone based firewalls are stateful, you can do rules such as LAN can reach IOT, but not the other way. Or IOT can only reach the IOT server, on specific ports.
I know that this would be the most secure way. But I seriously doubt that this level is necessary in a normal home network.
My solution is the correct way and easier way. You don’t need MAC address white-list. You just have a guest SSID with DHCP on, they get the IP from the subnet in that zone. No crazy subnet hacks etc.
Can I join your guest network, sure. Let me just grab your mac address, login to the DHCP server, create a reservation with a limited subnet mask that can still see the default gateway.
Or can I connect to you guest network, sure here is the code or scan that QR code. That’s it, they’re in the guest VLAN and subnet, zoned off on the firewall and have QOS applied to not saturate the network.
“Necessary” is a little ambiguous. You could argue that wifi is unnecessary for a normal home network.
