I have an internet circuit that I would like to protect from untrusted peers. BUT I don't want the peers in the same broadcast domain to be able to affect other peers.

(e.g. Wifi user 1 shouldn't be able to affect Wifi user 2)

What set of authentication/encryption technologies will allow for safe sharing of an internet connection?

My threat model is to prevent peers on a guest network from interfering with other peers on the same subnet. In addition, I don't want the guests to be able to access internal resources.

Ideally there is a captive portal that enforces a sign-on, but this assumes a secure data link layer.


What set of technologies is appropriate for securing and isolating a Wifi Connection from untrusted peers?

(assume that a RADIUS server can authenticate the peers to some degree, enforcing some authentication if necessary)

  • 1
    A standard WPA2 infrastructure network with a radius server should be enough. Just configure your router to disallow local network access. You need anything more?
    – Falco
    Aug 24 '16 at 7:33

As Falco already commented the solution for isolation of the hosts lies in the routing of your network: Drop all connections to other hosts in your guest and private subnet. The only attack vector which is not addressed in this setup is DOS on the physical layer but you can't do anything preventive about this except by limiting the range of the signal.


What you need to do, is to implement user isolation at the router. HOWEVER, as the network key is known, a guest 1 might be able to sniff guest 2's handshake, and thus be able to communicate even tough they shouldn't.

There is technologies for safe sharing of a Wifi connection, that bases on a router, that, upon a button press, dynamically create one wifi-network per user, which has its own keys and authentication.

For example, here is one, where you push a button and get a unique network name and password to connect to. http://www.handlink.com.tw/products_gw-1.php

For non-guests, you can use certificates or more professional solutions for authentication, but this wouldn't work for guests as such enterprise authentication solutions require specific client configuration to work.

There might be other solutions like this on the market, that I don't know of.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.