I am worried that there is not really a benefit of doing that, just more noise and energy consumption.

  • @danA
    link
    English
    47
    edit-2
    3 months ago

    Energy consumption is essentially the same, as it’s using the same radios.

    For what it’s worth, I have several SSIDs, each on a separate VLAN:

    • my main one
    • Guest. Has internet access but is otherwise isolated - Guest devices can’t communicate with other guest devices or with any other VLANs.
    • IoT Internet: IoT and home automation devices that need internet access. Things like Ecobee thermostat, Google speakers, etc
    • IoT No Internet: Home automation stuff that does not need internet access. Security cameras, Zigbee PoE dongle (SLZB-06), garage door opener, ESPHome devices, etc

    (to remotely access home automation stuff, I use Home Assistant via a Tailscale VPN)

    Most of these have both 2.4Ghz and 5Ghz enabled, with band steering enabled to (hopefully) convince devices to use 5Ghz when possible.

    This is on a TP-Link Omada setup with 2 x EAP670 ceiling-mounted access points. You can create up to 16 SSIDs I think.

    • @BearOfaTime@lemm.ee
      link
      fedilink
      English
      53 months ago

      Guest devices can’t communicate with other guest devices

      How do you accomplish this isolation since they’re on the same subnet/broadcast domain? Is it a feature of the hardware you’re using?

      • @danA
        link
        English
        93 months ago

        A lot of access points, even consumer-grade ones, have this option. It’s usually accomplished via predefined firewall rules on the access points themselves.

        Consumer-grade access points usually let you have just one isolated guest network, whereas fancier ones (Omada, Unifi, Ruckus, Aruba, etc) usually let you enable isolation for any SSID (ie the “guest network” is no different from any other SSID)

        • @BearOfaTime@lemm.ee
          link
          fedilink
          English
          1
          edit-2
          3 months ago

          Isolated guest networks I get, but isolating guests from other guests on the same subnet/isolated net is what I haven’t seen.

          • @conorab@lemmy.conorab.com
            link
            fedilink
            English
            23 months ago

            The APs know who the Wi-Fi clients are and just drops traffic between them. This is called client/station isolation. It’s often used in corporate to 1) prevent wireless clients from attacking each other (students, guests) and 2) to prevent broadcast and multicast packets from wasting all your airtime. This has the downside of breaking AirPlay, AirPrint and any other services where devices are expected to talk to each other.

          • @jemikwa@lemmy.blahaj.zone
            link
            fedilink
            English
            23 months ago

            If there’s an option on the AP to not permit link local routing within a vlan/ssid, that will force all traffic up to the firewall. Then you can block intrazone traffic at the firewall level for that vlan.
            I’ve seen this in Meraki hardware where it’s referred to as “client isolation”. Ubiquiti might be able to do this too.

          • @danA
            link
            English
            13 months ago

            I used to have a Netgear Nighthawk router/AP I bought from Costco, and if I remember correctly, its guest network automatically isolated guests from other guests. This router didn’t support VLANs so I think it was just a bunch of firewall rules.

        • @BearOfaTime@lemm.ee
          link
          fedilink
          English
          03 months ago

          I’m not seeing anything there that says guests can’t see other guests - quite the opposite.

          guests connected to your Hotspot Portal will be isolated from all other networks except the one they are assigned to.

          Guests on this network are able to access the internet, and communicate with the UniFi gateway to obtain a DHCP lease and resolve names using DNS

          I suppose a switch could be configured to prevent traffic going to other ports, which is how I would assume this would have to be done. This functionality would have to exist in the access point, I guess?

          Does UniFi have a feature to isolate devices from each other on the same subnet? Seems like it would require some kind of Layer 2 routing?

    • @unknowing8343@discuss.tchncs.deOP
      link
      fedilink
      English
      23 months ago

      That was an amazing read. Thank you.

      What do you say is the use case for separating guest Wi-Fi with the more “private” stuff on your network?

      As far as I understand… Basically all communications, even inside a network, are encrypted… So I guess you do that to avoid someone trying to exploit some vulnerability?

      • @BearOfaTime@lemm.ee
        link
        fedilink
        English
        12
        edit-2
        3 months ago

        Basically all communications, even inside a network, are encrypted

        LOL, oh no.

        Even internet traffic isn’t encrypted by default.

        Sadly TCP/IP isn’t encrypted.

      • Strit
        link
        fedilink
        English
        63 months ago

        I think the main benefit is that Guests devices on your network can’t find and exploit your own devices.

          • @osprior@lemmy.world
            link
            fedilink
            English
            83 months ago

            You can trust the person, without trusting their technical skills, such that they haven’t inadvertently installed malware on their own devices.

      • @AA5B@lemmy.world
        link
        fedilink
        English
        33 months ago

        Remember that once you give the password out, they likely have the password from now on. They will always have access until you change the password.

        No, a lot of local traffic is not encrypted, especially residential. No, residential probably doesn’t use much authentication or separation of privileges.

      • @danA
        link
        English
        2
        edit-2
        3 months ago

        I don’t want my guests to be able to access my home server or Omada controller for example, or spread malware (their phone may have malware without them even knowing). Also, I give the guest wifi to people other than friends, like contractors. Phone reception is horrible at my house so I give them the wifi so they can use wifi calling.

    • @excitingburp@lemmy.world
      link
      fedilink
      English
      23 months ago

      Ooh I like the idea of “no Internet.” I do trust all of those devices (open source), but they could still be pwned.