Radius for home use reddit / selfhosted ---------------------------------------------------------------------- legendary_footy · 2023-12-23 20:43 TLDR: Is it possible to do a radius setup for a single device (laptop) in a home network and not do anything with any other device? Hi all....I work from home and I would like to isolate my work laptop on a guest vlan away from everything else. The Study area has a dock which I use for both personal & work laptop so uses a single port connected back to primary switch. Ultimate goal is to have the vlan determined when the device is connected to the dock/port or wifi without having to play with port settings on the switch or select the specific ssid linked to the guest vlan. I have never used radius previously so unsure if this approach is an all or nothing, or can be limited to be used for a specific device. Any advice or guidance would be much appreciated Network: Opnsense > Unifi switch > Unifi AP x 3 Segregation: LAN, Guest VLAN, Kids VLAN, IOT, Cameras Happy Xmas everyone! ---------------------------------------------------------------------- adamshand · 2023-12-23 21:04 Not an expert on this, but since both laptops will share a MAC address (determined by the dock) and a cable/switch port ... I think your options are limited. You might be able to setup a tagged vlan for your personal laptop? Or otherwise I think you'll have to do this with 802.1x (which seems like overkill for a homelab, but ...). ---------------------------------------------------------------------- Specific-Action-8993 · 2023-12-23 21:42 Do you really need the work laptop to be connected to Ethernet? Why not just stick to WiFi and have it on the guest vlan? ---------------------------------------------------------------------- legendary_footy · 2023-12-23 21:43 Cheers......since when was overkill a bad thing on this sub ;) ---------------------------------------------------------------------- legendary_footy · 2023-12-23 22:06 Just trying to remove a hassle and have it assign automatically plus maybe learn something new at the same time. My work say they have no monitoring installed but I would prefer that they don't get any opportunity to see what else is on my network. ---------------------------------------------------------------------- GrumpyCat79 · 2023-12-23 23:14 >Just trying to remove a hassle What hassle exactly? Why disabling the wired NIC and sticking to Wifi is an hassle? > have it assign automatically Like adamshand said, if the NIC is on the dock itself, it will probably have the same MAC for both computers and they won't be differentiated easily by the router. Maybe you could override the MAC on your personal computer and assign that MAC to a trusted VLAN? Or like he also suggested, using a tagged VLAN on your personal PC > My work say they have no monitoring installed but I would prefer that they don't get any opportunity to see what else is on my network. I wouldn't trust them either. I put my work provided device on my guest VLAN for that reason > Is it possible to do a radius setup for a single device (laptop) in a home network and not do anything with any other device? Yes, but I'm not sure how RADIUS will help you there ---------------------------------------------------------------------- speculatrix · 2023-12-23 23:48 I'm vague because it's been a long time since I looked at this. I think it's possible to set up some switches to "assign a port to a vlan on seeing a specific mac address. But, alternatively, it may be necessary to use 802.1x supplicant in the client to authenticate, the switch talks to a radius server, and that checks the creds and tells the switch what to do. The radius server can talk to ldap if you like. Adding 802.1x to WiFi is similar if your AP supports it. ---------------------------------------------------------------------- shoesli_ · 2023-12-24 00:20 If you are looking for overkill, RADIUS is definitely a step in the right direction. If you are going to use NPS for RADIUS you need a domain. Integrate it with Azure for MFA while you are at it :) RADIUS probably isn't what you need, it is only used for authentication. Sounds like you are more interested in segmenting it. Don't bother with untagged vlans and cables. WiFi is so stable now adays, you don't really need any cable backup anymore. ---------------------------------------------------------------------- legendary_footy · 2023-12-24 00:25 Thanks all for the feedback....looks like some fun as part of post- Xmas recovery ---------------------------------------------------------------------- redditorforthemoment · 2023-12-24 05:25 For WiFi, you should be able to setup your Ubiquiti stuff to connect to a FreeRadius server and use iPSK to set the VLAN based on device. I do this for my network to separate traffic while having one SSID (although I use Cisco the concept should apply to Ubiquiti). As for the dock, if it appears to the downstream switch as a single MAC address (which it probably will as docks usually have NIC’s in them, usually Realtek from what I’ve seen) then I’m not sure of what option you have there ---------------------------------------------------------------------- adamshand · 2023-12-24 19:57 Haha, go hard! ---------------------------------------------------------------------- legendary_footy · 2023-12-24 21:47 This looks an interesting approach.....thanks. ---------------------------------------------------------------------- asantos6 · 2023-12-27 01:11 802.1x with radius will assign you a vlan Switch needs to support vlan assignment upon authentication