Can I create locked down wireless networks with usb wifi dongles?

[jerrac]

(Feel free to move this elsewhere if there's a better category.)

Previous experience has shown than I tend to mess up when I try to experiment with my firewall and network, so I thought I'd ask if any of my ideas are possible first.

Goal:

I'm looking for a way to use an old android phone as a kiosk to an app hosted on my home server. Since it's so old, I don't want it to have any internet.

And then there's my smart tv. I want to put it on a network that can't talk to anything.

USB Dongle idea
If I attached a couple usb wireless cards to my OPNSense box, could I use them to create a wireless network that didn't allow any traffic except for my app?

Router Idea
If I linked a spare wireless router to the OPNSense box using one of the open ports, could I lock down everything attached to that port? (I'm 99% sure that is possible.)

Rules Per Device Idea
Could OPNSense make sure that all traffic from a specific device is only allowed for the app I want to expose? As in my old phone would connect to my wireless network, and then OPNSense would prevent any traffic from, or to, it except for the designated app. How would that work when the wireless router has to route the traffic?

Are there any other ways to implement my goals?

Any tips on what to search for? My searches so far haven't found anything good.

Thanks!

[Patrick M. Hausen]

You can link a wifi AP that is capable of running multiple SSIDs to individual VLANs to a single port of your OPNsense and create multiple isolated networks.

Don't bother trying USB wifi. OPNsense makes a terrible AP.

[meyergru]

Patrick is right. Don't bother with USB adapters on OpnSense, use APs.

As for the router idea: I think you are mixing up concepts here. If the router really acts as a router and does NAT, OpnSense will not be able to discern between devices behind that router, so no. If it can be repurposed as a switch, then in a sense, yes. However, all devices connected to the switch can interact without OpnSense even interfering.

Also, what you can do is limited once the devices have internet access, because traffic might happen on different ports and encrypted while you cannot see what's in it. Complete control is a myth - unless you block everything.

Rules per device is possible, but then again: how do you even identify a specific device? By IP? By MAC? Good luck with either.

[connervt]

As for the router idea: I think you are mixing up concepts here. If the router really acts as a router and does NAT, OpnSense will not be able to discern between devices behind that router, so no. If it can be repurposed as a switch, then in a sense, yes. However, all devices connected to the switch can interact without OpnSense even interfering.
Rules per device is possible, but then again: how do you even identify a specific device? By IP? By MAC? Good luck with either.

To add on to this, many routers with WiFi can be configured to behave as only a WiFi AP.  Either with it's native firmware or flashed with other firmware.  I was always fond of the Tomato forks (FreshTomato being the most current).  In fact, ASUS routers use a fork of this for their routers.

Once configured as an AP, you can connect it to your network just as any AP, via Ethernet to your LAN.

[drosophila]

I'll try to answer the questions as they were posted, trying not to interpret things into them:

1) FreeBSD has drivers and support for USB / Wireless things, but the general consensus is that it's not up to snuff. Maybe with (a lot of?) tinkering it could be made to work reasonably well for a simple setup like what you have in mind, just like Realtek NICs. I don't own one so I cnever attempted it.

2) yes, you can lock down the entire (sub)net connected to that port, as a whole (assigning a different (sub)net to it is preferable to a filtering bridge both for clarity and ease of management). This would then equal one router, attached to one port, per WLAN to be separated. In this case it would not matter if the router actually NATs or not, as the restriction is per (sub)net. But if you attach your router to the Sensebox via its LAN port (which you absolutely have to do if it doesn't have an ethernet WAN link for support of an external modem, IOW, all DSL and cable routers up until the 2015s or such), then it will effectively be a switch / bridge, so its routing is disabled and all devices show up as-is on the Senseport and can therefore be handled individually. There is an option in most WLAN routers to prevent WLAN devices from talking to each other, but I don't know how well that works.

3) This depends on how well defined your traffic is. If this is the same as you saying "no internet, and access only to the specific app (=port), on the local LAN (or rather, one single address even, the one of your home server) only", then yes. You can deny / drop any traffic to non-local networks per device (=IP). This does not prevent a malicious device from assuming a different IP in hopes that won't be blocked, but if neither your phone nor the app is compromised, then this will work. You will need to see which protocols and ports the specific app actually uses, especially if it needs to send things to the connecting device (like a streaming server that has a web frontend but streams through some other protocol), and allow all of these.

What you wish to allow for your smart TV sounds doable as well, since you could to the reverse: deny / drop all traffic to / from it to every local net, while allowing it to the internet unhindered (which you will effectively have to do because of the mess of apps and cloud stuff it's using; a pihole or similar would be something to seriously consider).

[Frank886t]

(Feel free to move this elsewhere if there's a better category.)

Previous experience has shown than I tend to mess up when I try to experiment with my firewall and network, so I thought I'd ask if any of my ideas are possible first.

Goal:

I'm looking for a way to use an old android phone as a kiosk to an app hosted on my home server. Since it's so old, I don't want it to have any internet.

And then there's my smart tv. I want to put it on a network that can't talk to anything.

USB Dongle idea
If I attached a couple usb wireless cards to my OPNSense box, could I use them to create a wireless network that didn't allow any traffic except for my app?

Router Idea
If I linked a spare wireless router to the OPNSense box using one of the open ports, could I lock down everything attached to that port? (I'm 99% sure that is possible.)

Rules Per Device Idea
Could OPNSense make sure that all traffic from a specific device is only allowed for the app I want to expose? As in my old phone would connect to my wireless network, and then OPNSense would prevent any traffic from, online games or to, it except for the designated app. How would that work when the wireless router has to route the traffic?

Are there any other ways to implement my goals?

Any tips on what to search for? My searches so far haven't found anything good.

Thanks!

Your ideas are definitely possible, and OPNsense is actually a good fit for this. The easiest approach would probably be to create separate VLANs or use a dedicated router/AP connected to a specific OPNsense interface, then apply firewall rules to isolate those devices. You don't need to control traffic by app itself; instead, allow only the IP/ports your server app needs and block everything else. For the old phone kiosk, a separate WiFi network with no WAN access but access only to your home server would work well. Search terms like "OPNsense VLAN firewall rules", "OPNsense captive portal", and "network isolation" should help.