Can I create locked down wireless networks with usb wifi dongles?

[jerrac]

(Feel free to move this elsewhere if there's a better category.)

Previous experience has shown than I tend to mess up when I try to experiment with my firewall and network, so I thought I'd ask if any of my ideas are possible first.

Goal:

I'm looking for a way to use an old android phone as a kiosk to an app hosted on my home server. Since it's so old, I don't want it to have any internet.

And then there's my smart tv. I want to put it on a network that can't talk to anything.

USB Dongle idea
If I attached a couple usb wireless cards to my OPNSense box, could I use them to create a wireless network that didn't allow any traffic except for my app?

Router Idea
If I linked a spare wireless router to the OPNSense box using one of the open ports, could I lock down everything attached to that port? (I'm 99% sure that is possible.)

Rules Per Device Idea
Could OPNSense make sure that all traffic from a specific device is only allowed for the app I want to expose? As in my old phone would connect to my wireless network, and then OPNSense would prevent any traffic from, or to, it except for the designated app. How would that work when the wireless router has to route the traffic?

Are there any other ways to implement my goals?

Any tips on what to search for? My searches so far haven't found anything good.

Thanks!

[Patrick M. Hausen]

You can link a wifi AP that is capable of running multiple SSIDs to individual VLANs to a single port of your OPNsense and create multiple isolated networks.

Don't bother trying USB wifi. OPNsense makes a terrible AP.

[meyergru]

Patrick is right. Don't bother with USB adapters on OpnSense, use APs.

As for the router idea: I think you are mixing up concepts here. If the router really acts as a router and does NAT, OpnSense will not be able to discern between devices behind that router, so no. If it can be repurposed as a switch, then in a sense, yes. However, all devices connected to the switch can interact without OpnSense even interfering.

Also, what you can do is limited once the devices have internet access, because traffic might happen on different ports and encrypted while you cannot see what's in it. Complete control is a myth - unless you block everything.

Rules per device is possible, but then again: how do you even identify a specific device? By IP? By MAC? Good luck with either.

[connervt]

As for the router idea: I think you are mixing up concepts here. If the router really acts as a router and does NAT, OpnSense will not be able to discern between devices behind that router, so no. If it can be repurposed as a switch, then in a sense, yes. However, all devices connected to the switch can interact without OpnSense even interfering.
Rules per device is possible, but then again: how do you even identify a specific device? By IP? By MAC? Good luck with either.

To add on to this, many routers with WiFi can be configured to behave as only a WiFi AP.  Either with it's native firmware or flashed with other firmware.  I was always fond of the Tomato forks (FreshTomato being the most current).  In fact, ASUS routers use a fork of this for their routers.

Once configured as an AP, you can connect it to your network just as any AP, via Ethernet to your LAN.