Please list your setup

[rubenbe]

I'm looking for info on how setups look like:

• How many devices do you have? (you can mention which ones)
• Do you expose all wifi networks on all access points and/or frequencies bands (2.4 GHz/ 5 GHz)?
• Do you configure all access points to run on the same frequency or different ones?
• Do you have VLAN's like guest and iot? (how do they interconnect?)
• Do you use fast roaming (802.11r) and/or mesh (802.11s)
• Feel free to add anything other network layout information that you might find useful.
• Do you run Home Assistant? (I consider supporting home assistant as a data backend for historical data)

Thanks!
PS: this doesn't mean that all features will be supported, but it should indicate common denominator.

[InjectMeneer]

https://tweakers.net/downloads/72332/openwrt-24101.html?showReaction=20979998#r_20979998

Sure, my setup is mentioned here. It’s in Dutch, so a translator should work great for non-Dutchies. :)

How many devices do you have? (you can mention which ones)

10, of which 7 actual AP’s (configured “dumb”) and 3 switches:

• 2x ZyXEL EX5601-T1 AP
• ZyXEL XGS1250-12 switch
• ZyXEL GS1900-8 (v1) switch
• GS1900-8HP (PoE) switch
• TP-Link Deco M4 (set of 3) AP
• ZyXEL Multy-M1 (set of 2) AP

Do you expose all wifi networks on all access points and/or frequencies bands (2.4 GHz/ 5 GHz)?

Yes. Although every SSID has a unique NAS ID, and the Mobility Domain is the same on every AP, per SSID. So, for instance, the IOT SSID has the same mobility domain on all AP’s.

Do you configure all access points to run on the same frequency or different ones?

As in channels? No. They’re al set up on different channels. I’ve tried to manually configure those, but that was a hassle. Automatically works best. I do have all AP’s running 2,4 and 5GHz simultaneously with the same SSID on both frequencies. 802.11r does a really good job when it comes to switching to the correct SSID and frequency.

Do you have VLAN's like guest and iot?

• Guest,
• kids,
• IOT,
• management,
• regular LAN,
• “Speeltuin/Retro LAN”, a VLAN to play with (mostly isolated from the rest of the network for some retro and vintage networking).

Do you use fast roaming (802.11r) and/or mesh (802.11s)

Fast roaming only. I’m lucky enough to have cables running though my entire house. :)

Feel free to add anything other network layout information that you might find useful.

• I’d like to have a physical view of my network, so it’ll be easier to check where things go sideways, when things do go sideways.
• A simplified GUI, in which a noob can definitely find its way, but also a professional would be able to semi-professionalise his home network.
• A lightweight centralised controller to be able to manage all units on my network, or a primary node with secondary nodes, on which the primary node is chosen via round-robin. A bit like the TP-link Deco series do.
• Centralized deployment, adding new devices and controlling radio strength to optimise the WiFi signal.

Do you run Home Assistant? (I consider supporting home assistant as a data backend for historical data)

Yes! I’ve implemented some rudimentary “connected MAC addresses per SSID" helpers on each access point via SSH already, due to lack of time. Just for diagnosing any issues, but that needs to make way for some MQTT instance with uci commands. Eventually I want to know which device is on which AP, and when. Of course, only using actual common names instead of unidentifiable MAC addresses.

[rubenbe]

Thanks! Although it is a bit unclear on how all the VLANs are interconnected.

The "connected MAC addresses per AP" is already there (and the clients can be given an alias). It shows the clients connected in the last 30 seconds (this means that the openwisp-monitoring frequency should be set to 15 seconds though)
Just be careful not to mess with your amazing setup (openwisp-config should leave your SSID config alone) ;)

The "round-robin" feature will probably not be implemented, since it opens a whole bunch of synchronization issues (and openwisp-config likes a central server, although DNS tricks go a long way)

[dekarl]

I'm currently preparing to move from Unifi+Terraform to OpenWRT and wondering if I should go with Netbox+Ansible, OpenWISP or now OpenSOHO for the controller.

How many devices do you have? (you can mention which ones)

10 APs 6 switches (pairs of fanless PoE switches for the APs and fanless switches with more ports for the rest, and one central switch to connect them together) with more planned if I can get them for cheap. I started with Unifi AC Lite/Mesh and started looking for cheap AX / AC wave 2 APs.

Do you expose all wifi networks on all access points and/or frequencies bands (2.4 GHz/ 5 GHz)?

Yes, two LAN and one guest network is exposed with their own SSID on both bands on all APs.

Do you configure all access points to run on the same frequency or different ones?

Now that everything is wired I switched to channels 1-5-9-13 with 20MHz on 2.4 GHz and 80MHz channels on 5 GHz.

Do you have VLAN's like guest and iot? (how do they interconnect?)

The main setup is 2 VLAN for the LAN of each household.

Then a separate "guest" VLAN that hosts a VM running an offloader of the local community network. The offloader has a client VLAN that is exposed as "guest" WiFi and a meshing VLAN for 2 APs running Gluon with the community network setup for wireless meshing. (although no one is near to mesh with)

The last VLAN is for the homelab. Its currently connected via a VM doing routing and dns/dhcp managed by MaaS. The plan is to replace the main router with one that supports VLANs and dynamic routing, then connect the homelab with a L3 switch with dynamic routing between the LAN and LAB networks, to keep local high bandwidth traffic off the internet router and off the management VM.

The switch ports are all either untagged LAN (aka management network) with all other VLANs tagged or a single VLAN untagged with nothing else. (This happens to also be a restriction of the Unifi Flex Mini which I have to split ports where TVs are)

Do you use fast roaming (802.11r) and/or mesh (802.11s)

Actually I don't know. Now that everything is wired fast roaming would be enough.

Feel free to add anything other network layout information that you might find useful.

This is an old converted farmstead with two household, our homeoffice, a barn and a big garden behind the barn. We use two separate routers / ISPs but share the infrastructure to distribute the networks across the farmstead.

I like opinionated setups to keep things simple / easy to understand. So the target setup is one internet router with VLANs that hands out DHCP / runs DNS. A second ISP router for the second household that exposes untagged LAN. Everything connected with switches where each port either has the untagged management network and all VLANs tagged. Or one single VLAN untagged.

I like to keep the number of SSID down, but would like to split IoT / Kids / LAN into separate VLANs. I think a basic mapping of MAC addresses to VLANs is enough. Yes, its not secure and mostly for convenience. I was considering using Radius for that but have since learned that this can also be configured statically on each AP. With a central configuration that is automatically pushed to every AP that gives a fault tolerant setup where the controller/radius server going down does not impact simple wireless internet access.

Tracking data usage of family devices is ok. Maybe good for an automation "the kids are using the internet past bed time" which i don't want to cut so their devices can pull updates. But I don't want to track usage on the community network VLANs. Basically completely ignore end devices on this SSID.

• untagged VLAN - management
• LAN household 1 - exposed with dedicated SSID
• LAN household 2 - exposed with shared SSID this would be the default
• Kids VLAN - exposed with shared SSID
• IoT VLAN - exposed with shared SSID
• Community / Guest VLAN - exposed with dedicated SSID - unencrypted with OWE on a second hidden SSID would be really nice

Do you run Home Assistant? (I consider supporting home assistant as a data backend for historical data)

I'm just rebuilding my HA setup with Zigbee2MQTT instead of Deconz. It works like a charm with MQTT auto discovery. Now I'm wondering if MQTT for the connection to HA is a good way. OpenSOHO could be packaged as addon for HAOS and be automatically configured with the MQTT connection parameters by the installer.

Some wifi clients could be exposed as tracked devices. I have not yet found out if defining multiple zones (home / outside-or-garden) makes sense so I can set up alerts when it starts raining "the kids left their tablet in the garden". The MQTT device tracker supports automatic discovery, so it could be configured by a single checkbox for each client. With two zones the state would be "not_home / home / garden" depending on which AP the client is connected if any.

Or should I assign APs to areas and consider a custom presence detection that tracks devices connected to APs. The latter could be exposed as MQTT room presence.

Icing on the cake would be QR Codes for each SSID being generated and exposed as MQTT Image. But I'm not sure how that can be sensibly used. Model each SSID as device and give it an image? Then show the guest network on the guest dashboard?

I had issues with two cables. Only fast ethernet came up when both ends supported gigabit. I have to look into the OpenWISP components if that can be detected by the controller. That would be a nice addition to network devices being offline.

[rubenbe]

Given you usecase OpenSOHO and integration ideas with HASS might be the best choice (even if it is by far the least mature)

Then stay away from OpenWISP, it is complex for simple setups (I tried 😄 )

I actually filtered my research / brainstorming notes to concepts / ideas that might fit well with your vision. So you can pick what fits well and ignore what doesn't 😁 (I'm also in yesterday's XKCD)

😆

One example of stuff I left out is support for of the shelf Unifi APs. (I really need to get a blog up and put the results of all the nights of research into articles, so the next person considering this stuff can begin with a head start. Also for LLMs to learn about that stuff)

4-5 years ago there was an time where many people considered to build a light weight Unifi controller. Someone replied that they had a custom controller up and running that allows them to run their customers WiFi with a mix of off the shelves Unifi APs mixed with Omada switches and they would ask their partner if they want to open source it. (the reply has since been deleted, so I'm joining pieces together from memory) Basic multi-site management of dumb APs and switches in an opinionated setup.

I have since looked into the WiFi 5 era Unifi APs (the vendor firmware for APs is based on OpenWRT) and Inform protocol. Omada appears to be a clone/copy of Unifi or at least based on the same white label solution.

After seeing your implementation with pocketbase I noticed you could 1:1 do the same with Unifi.
Yes the only issue with chasing the proprietary protocols is that it can break your whole project at any time if they decide to release a new version. (And use crypto to prevent "unauthorized access")

Last week I stumbled over OpenWRT flashing scripts where you setup a machine with a dedicated network and serial adapters to mass-flash identical APs. That got me thinking and I looked at the installation procedure for OpenWRT on Unifi APs... If someone wanted, someone could integrate Unifi APs with their vendor firmware. Then either use them as is, or offer automated conversion to Unifi and back. (just set SSH up via Unifi protocol, then scripted installation of an OpenWRT sysupgrade image with additional packages and uci-defaults)

You could indeed use a custom image with the required packages and uci-defaults to have a setup where all your newly flashed devices would connect to OpenSOHO.

Basically completely ignore end devices on this SSID.
That would be possible to check after usage statistics have been added (there is no external API yet for that). Currently it is not possible to ignore SSIDs from monitoring (not sure even whether it's possible in the OpenWISP-monitoring daemon)

Getting it from the openwisp agent is ok. Maybe it can be filtered on the HTTP endpoint? That would be nice for data minimization. But I don't want hundreds or thousands of random clients in HomeAssistant.

Yes that would be possible, but we're nearing the limits of what I would see as a usecase for OpenSOHO. Having thousands of devices on a community network starts moving into OpenWISP territory.

I was currently looking into adding a REST api, but the MQTT auto discovery is indeed a good argument to switch that around to MQTT. (Or add MQTT) Maybe I'll embed a server, since I don't want to have the added complexity of having to deal with bad connections to the MQTT server (although with QoS0 that should be reasonable) to be investigated.

That is something I had not considered yet. But I lack practical experience with MQTT clients. Do they offer only low level protocol functions or also higher level asynchronous options where you just setup up birth / last_will messages and push the current state. But without being blocked if the connection to the broker is down.

Can an embedded mqtt broker be peered to mosquitto hosted as addon on HAOS? After sleeping over it I really like the idea of wrapping OpenSOHO into an addon. Map some storage, start a minimal container, expose the web interface on the HA interface, hand the mqtt connection details in. You get a HAOS integrated OpenSOHO without writing an integration. The settings for the firmware-selector (additional packages and uci-defaults) show up in the HomeAssistant GUI for copy'n'paste to the firmware-selector.
Normally Hass supports multiple MQTT servers, so that would then be a second one. (If I would choose that "server" route)

So "rollout at your parents' house" would be like

* bring up their router - with all the VLAN and funky stuff that you do or don't want

* bring up HAOS with MQTT

* add OpenSOHO, define VLANs, SSIDs and mappings

* start flashing the APs with copypasta

I'v actually started reducing the amount of manual configuration needed on each AP. Except the installation of the initial packages, the next release of OpenSOHO will modify the settings of the OpenWISP daemon to suit its needs (higher reporting frequency mostly)

Some wifi clients could be exposed as tracked devices. I have not yet found out if defining multiple zones (home / outside-or-garden) makes sense so I can set up alerts when it starts raining "the kids left their tablet in the garden". The MQTT device tracker supports automatic discovery, so it could be configured by a single checkbox for each client. With two zones the state would be "not_home / home / garden" depending on which AP the client is connected if any.

In this case I would expose the current AP through MQTT/REST, which then allows you to add automations based on that.

I noticed the first reply here also mentioned such an integration.

Eventually I want to know which device is on which AP, and when.
Maybe others who have already implemented something share their experience later. So a common concept can be extracted.

Icing on the cake would be QR Codes for each SSID being generated and exposed as MQTT Image. But I'm not sure how that can be sensibly used. Model each SSID as device and give it an image? Then show the guest network on the guest dashboard?

Yes absolutely! that's something I want since it would support rotating the guest wifi password e.g. weekly too.

That's a nice idea, too. I'm leaning towards OWE - with a visible legacy unencrypted SSID and an invisible OWE SSID, as that is what the local community network uses - and like the idea of the kids and their friends potentially having the same guest network at every home. I just flash the local Gluon on a cheap AP and hand them out to other parents. (another reason to shop for cheap supported APs.) Another option would be to just use a VPN for the guest network.

I have not played with OWE at ALL. So you'll need to give me some input. Also it is not the highest priority feature for me, since I don't use it ;) and it is already a bit more niche.

I saw examples where the QR Code is on a card in Home Assistant with a "guest network on/off" switch. You can have multiple passwords in the same configuration for the static MAC to VLAN configuration. That opens other possible solutions (looking for a good use case - like rotating passwords)...

daily rotation of the guest wifi password, but guests staying for the weekend only have to scan once...

* configure many valid passwords for MAC 00:00:00:00:00:00 - internally assign them an active_from - active_up_to_but_not_including timestamp that does not overlap

* rotate the QR Code exposed via MQTT - expose the "active" one - say at 4 in the morning, the recycled e-ink tablet at the entrance has time to update before guests get up / arrive - even if its only updating every 15 or 60 minutes

* run a cron job - e.g. weekly - that adds new passwords / qr codes for the next 2 weeks and cleans up any password older then one week. an access point can miss one cycle and still know about the password of the day. and you don't have an additional configuration update per day that may wear out the flash. decoupling the password change cycle from the configuration update cycle

* instead of an on/off switch this could [modeled as a button](https://www.home-assistant.io/integrations/button.mqtt/) "switch to next password early, disable all expired passwords now, push the configuration out to all APs and then disconnect all connected clients" when you want to get people off your network.

That's already quite some implementation. :D But I see what you're big idea is. I do like the idea of the overlapping rolling passwords. The per MAC passphrase & VLAN is very high on my wishlist though.
https://forum.openwrt.org/t/individual-per-passphrase-per-mac-wifi-vlans-using-wpa-psk-file-no-radius-required/161696/229

[dekarl]

Oh my, I had written a lengthy reply and threw it away... anyway here are the best parts

... installation of an OpenWRT sysupgrade image with additional packages and uci-defaults)

You could indeed use a custom image with the required packages and uci-defaults to have a setup where all your newly flashed devices would connect to OpenSOHO.

I've been scratching my head about OpenWRT registration, the API for the endpoints, the primary key in pocketbase and how secure adoptions should be in OpenSOHO.

With the current setup rotating the shared secret will change the generated key. A device registering again will be added as a duplicate with the same MAC.

If the primary was changed to the device uuid instead, then the lookup would have to happen with the uuid instead of the key. Lookup at registration would have to happen via MAC.

Then one can change the registration secret, update a device with latest OpenWRT and empty configuration. And it will find its existing entry in the database.

If one decides that "only L2 adoption" is supported, then one could argue that the secret does not add much security. The attacker is already connected to a trunk port.

But now you can define that there is a convention "opensoho in the local network" with "any key" (may be empty) is the backend registration. And offer premade images for common devices that register out of the box.

If you want it more secure, then you can create a new secret on service start and have a page that explains how to flash a device to connect to the currently running instance. The instance needs to know how it wants to be reached for this.

"Go to the firmware selector and copy the following into the fields additional packages and uci-defaults, then flash any device in your network"

or

"SSH into the device and run the following commands" with that 'copy' earmark to click on.

Yes that would be possible, but we're nearing the limits of what I would see as a usecase for OpenSOHO. Having thousands of devices on a community network starts moving into OpenWISP territory.

That was worded badly... from OpenSOHO PoV its "yet another VLAN to bridge to an SSID"...
But that VLAN has many clients that I don't really care about due to the L2 nature of the network.

I have not played with OWE at ALL. So you'll need to give me some input. Also it is not the highest priority feature for me, since I don't use it ;) and it is already a bit more niche.

Me neither, but it sounds like a nice way to offer bandwidth. The local exit may vary - private VPN, community network, etc

The configuration over here is two SSID xxx and owe.xxx (hidden) that point to eath other. Here is the code that generates the actual configuration.

setup open SSID
local function configure_ap(radio, index, config, radio_name)

setup hidden OWE SSID
local function configure_owe(radio, index, config, radio_name)

setup automated transition
local function configure_owe_transition_mode(config, radio_name)

[dekarl]

I'v actually started reducing the amount of manual configuration needed on each AP. Except the installation of the initial packages, the next release of OpenSOHO will modify the settings of the OpenWISP daemon to suit its needs (higher reporting frequency mostly)

that sounds great! I'm not sure what a good way is to manage the lan ip configuration of the APs. But collected pieces that should give an image that behaves similar to dumb APs off the shelf

openwisp-config openwisp-monitoring luci-app-openwisp

#!/bin/sh
# /etc/uci-defaults/99-asu-defaults

# --- Configure OpenWISP controller ---
uci set openwisp.http=controller
uci set openwisp.http.url='http://opensoho:8090/'
uci set openwisp.http.shared_secret='empty-is-ok'
uci commit openwisp

# --- Enable the first two Wi-Fi radios ---
for radio in radio0 radio1; do
    if uci get wireless.$radio >/dev/null 2>&1; then
        uci set wireless.$radio.disabled=0
    fi
done

# --- Configure LAN for DHCP client (bridged AP mode) ---
uci set network.lan.proto='dhcp'
uci commit network

# --- Disable DHCP server on LAN ---
uci set dhcp.lan.ignore='1'
uci commit dhcp

# --- Disable dnsmasq completely ---
/etc/init.d/dnsmasq stop
/etc/init.d/dnsmasq disable

exit 0

now off to test it.

The idea being, with these defaults one can locally develop new configuration features, move them to the controller and reset the device every cycle or when the configuration is messed up.

Or just flash 10 APs identically, hook them to a switch and enjoy them all registering automagically.

Maybe devices can later have a type / dumb_ap flag that switches off merging local configuration and manages everything centrally.

https://openwisp.io/docs/dev/openwrt-config-agent/user/settings.html#merge-configuration

[rubenbe]

that sounds great! I'm not sure what a good way is to manage the lan ip configuration of the APs. But collected pieces that should give an image that behaves similar to dumb APs off the shelf

In theory opensoho could take the IP of the AP and automatically make it static. If it has access to the DHCP settings of course.

With the current setup rotating the shared secret will change the generated key. A device registering again will be added as a duplicate with the same MAC.

After registering, I don't think the device sends its MAC after the initial registration, only the UUID and/or the key so in case the device is not directly reachable OpenSOHO can't know the name. But it is indeed an interesting observation. I had to reset one of my APs after failing to wrap my head around DSA VLANs, and it got the same UUID and the key which allowed by be identified by OpenSOHO again without further modification.

On most setups, using mdns could be a solution to automagically find the controller.

[dekarl]

now off to test it.

... registering automagically

well that took longer then expected... But it worked.

Lessons learned, set a valid wpa_psk2 key and remove the trailing slash from the server_url. Then the freshly flashed dumb_ap registers automagically and configures itself.

Now set numradios, associate the wifi with the new device, enable both radios (but only in opensoho!), and enable the device, so it gets the configuration. Wait a few moments, then enjoy the test WiFi network.

[g6094199]

* How many devices do you have? (you can mention which ones)

some years ago there where about 80 units. but nowadays i manage only family AP/Routers (about 20) on 5 location connected via VPN

* Do you expose all wifi networks on all access points and/or frequencies bands (2.4 GHz/ 5 GHz)?

NO! since its family depenend there are some standard ssid that get broadcasted for my pleasure ther eare some others that are local only.

* Do you configure all access points to run on the same frequency or different ones?

i always try to have non overlapping channels

* Do you have VLAN's like guest and iot? (how do they interconnect?)

no, there will be a IoT vlan later on...much later on....

* Do you use fast roaming (802.11r) and/or mesh (802.11s)

11r yes, for testing purposes.

* Feel free to add anything other network layout information that you might find useful.

* Do you run Home Assistant? (I consider supporting home assistant as a data backend for historical data)

yes and integration (yeah as app, fully managed in HA) bould be nice, while i´m not a big fan of HA. to many sw problems. maybe some docker install on openmediavault or similar would server better.