Before we start, I have finally realized that I am lacking on these blogs and I should probably write more due to myself falling behind. Anyhow, here’s a topic that I found interesting enough for me to write about, hope you enjoy.
For the past few years, the WiFi solution at my home was pretty mundane, our internet service provider sent us a Fiber Optic ONT/modem and a Router unit which provides internet access to both our wired devices (office phones, server, etc.) and wireless devices (laptops, computers, phones, printers, TV, etc.). The router we received is typical as for a household, it’s a router which routes traffic through our network and manages our connection to our internet. It also has a Wireless Access Point built in, which is a device which transmits a WiFi signal. It was basically a WiFi Router combo unit, very common among homes and small businesses. To connect to our network, you would simply select our network from the selection box, then type in a very simple password which was letters and a single digit. Not very secure. Not only that as the network was very easy to crack and gain access to all the devices, we also lacked a guest network. If a guest is over, for example our cousins, we would just have them connect to the single WiFi network. This allowed anybody, including guests to access sensitive resources on the network.
A few weeks ago, I decided to take a look into getting a dedicated Wireless Access Point, instead of using the one built-in to our router. A wireless access point is a dedicated device responsible for transmitting WiFi network signal(s) for clients such as computers and phones to connect to. There are multiple benefits to this, for one, it could expand the wireless coverage of our home making our connections to WiFi more stable and faster in certain conditions, it would allow for more clients to connect to the access point without it exploding under pressure (previously, when a large amount of guests are over and connected to the WiFi browsing simultaneously, the internet would slow down by a noticeable chunk), and certain business-oriented access points have added security and functionality built in. After doing some research on it and wanting to up the game with networking at my house, I decided to get a “Ubiquiti UAP AC-PRO Access Point”. Ubiquiti, also known as “UniFi” is a company in the IT space dedicated to ‘revolutionizing’ the space for information technology, and in a license-free manner, meaning you do not need to pay for a license or key to use the enterprise equipment you purchase, a fairly common practice with long standing IT companies such as Aruba (by HP) and Cisco Networks.
After the UniFi Access Point finally arrived to my house after being shipped from California, I got to work setting up and preparing it for operation. I installed “UniFi Network Server” on my home lab (a sandbox mimicking an enterprise/corporate IT’s environment) server which will be responsible for managing the WiFi access point. I did run into some road blocks such as a faulty ethernet cable causing turtle-slow speeds and figuring out how to “adopt” or connect the AP to the network server, however I managed to figure it out in the end and was able to get the access point connected to the network. After 1-2 days of tinkering with the UniFi access point and getting the wireless networks up and running, then disabling the WiFi network on my router to retire it after I migrated all the devices, the new WiFi setup was complete and fully operational. The UniFi access point is also mounted fairly nicely and seems professional as I screwed it into an existing screw hole previously used for an accordion-style sliding door (removed due to installation of larger washing machines that did not fit in the doorway). The wire is hidden above the door frame behind and cannot be seen unless you bend over inside and look up to see the cable running down into the network closet.
Now, I will be describing what changes I made to at least my wireless network infrastructure following the new installation of my WiFi access point. First and foremost, the most important change to the internet is that we now have three wireless (WiFi) networks available at home. The first network and main network where mostly everyone will connect to is simply named “[Name] Wireless Network”, the special thing with this network is that instead of using a single password that is shared with everyone trying to connect to the network (this is called WPA2-Personal authentication), the network is now secured by WPA2-Enterprise Protected EAP and MSCHAPv2 authentication. That was a mouthful. In simple terms, instead of using a simple shared password, each person connecting to the network will now have their own unique credentials. For my setup, I am using a username/password authentication, however, WPA2-Enterprise also supports authentication via device certificates (basically a fingerprint for a device), fingerprint authentication, smart card authentication (use a security card to connect), and other methods to log in. For me, username and password works well as long as the passwords are secure and follow the best practices, and are not as complicated. For example, when I connect to the network I will type my username as “myusername281.blahblahblah”, and then type in my password. My sister, would instead use a username that is different and unique to her only such as “sisteraccount915.something” and type in her password. Each person connecting will have their own credentials, eliminating password sharing (it’s prohibited, no longer allowed) and is more secure than a simple password that is used for everyone on the network. The authentication is also verified not on the access point, but on the server. WPA2-Enterprise uses something called “RADIUS” to authenticate. I will try and make this as simple for you all to understand. Typically, when you connect to a normal WPA2-Personal WiFi network in a home, the access point will ask you “Please enter your password”, if it sees the password is right, ding ding ding you are granted access. Now, with WPA2-Enterprise, the access point will now instead prompt you with “Please enter your blehhhhhh”. That “blehhhhh” can be anything, such as a smart card or fingerprint as stated above, or a username and password which is what I am using. When the access point receives the credentials you provided, it will go over to the RADIUS server, provide a password that the RADIUS server uses to prove the access point is authorized to ask it these questions, the RADIUS server checks the credentials, ding ding ding it’s approved, and the access point turns around and drags you into the network. Very cool stuff. This network which asks for a username and password is the main network, this is what most devices will connect to such as my laptop computer, my sisters laptop, my dads phone, and my mothers tablet. However, not all devices support WPA2-Enterprise such as my sisters Nintendo Switch, the downstairs office printer, the living room TV, and the smart garage door opener.
Now, I can’t just leave these devices to rot without internet and face the horrors of watching media or using them with a USB flash drive, so this is where the second network comes to play, which I named it as “[Name] IoT Network”. Now, what does “IoT” mean? IoT basically stands for Internet of Things and refers to devices that are smart, such as smart light bulbs, smart TV’s, printers, etc. This network uses WPA2-Personal, which means yes, it only requires one password and you are in. However, there is a catch. It is not like this network has a single password shared by the TV, printer, and Nintendo switch to connect, that would be insecure and defeat the point of setting up the first secure network. Instead, this network uses multiple passwords, or multiple pre-shared keys. Basically, each device that connects (or a group of devices if applicable) will have their own, unique password to connect to the network. On top of that, even if you manage to get a hold of a password and attempt to connect your computer to the IoT network for some free WiFi and internet browsing, you will be denied from accessing it due to the fact that the WiFi has a “MAC Address Filter”. Basically, each device on the internet will have a “Mac Address”, basically a unique network identifier. Before a device can connect to the network, I must add them to the IoT network MAC address whitelist, and then they may connect with the appropriate credentials. However there is a caveat with this setup. The password system and MAC address filter system work independently, so a MAC address cannot be tied to a single unique password. Furthermore, MAC address spoofing is not unheard of and can be done fairly easily, meaning it is still possible for a determined person with technical skills to gain access. In the future, I may be locking down this network so it is on a separate VLAN, or virtual network away from the main network while allowing basic communication for things such as printing and screensharing to the TV.
Finally, we have the last network, named the “[Name] Guest Hotspot”. The name is self-explanatory, this network is for guests to connect. This network does not have any authentication security on it, rather than it is set to “Open”, which means there is no password, no nothing. Typically found in airports and cafes. However, just because you can connect to it without authenticating does not mean you can access the internet. When a client, for example lets say a laptop connects to this network, all attempted traffic will be intercepted by the access point and redirected to a captive portal, a web page prompting them to access the agreement for the internet (basic rules), and to provide a voucher/authorization code that was printed out before hand. Guests connecting to the internet will need to visit an authorized person on the network who has the ability to print out WiFi vouchers which give them temporary access to the network, expiring after they leave. Once they are connected, their network connection speed will be limited to prevent abuse and to balance the network when a large amount of people are congregating on the WiFi. Not only that, but their connection will be isolated, meaning they cannot communicate with ANY other clients, including ones on the main network, IoT network, and guest network. For the folks who still play Minecraft, sorry to break it to you, but you can’t play Minecraft on the WiFi together here anymore, what a bummer.
In the end, I am pretty satisfied with this setup for the internet at my home. I will be revamping the IoT network in the future defenitely to make it more secure, but it will have to do for now until I find the time for it. Thanks for reading this blog, and if you are interested as a family member in setting something like this up, maybe talk to me the next time I visit and I can help make it happen. Again, thanks for reading and see you again next time!