Mac Address Based VLAN Project -- Success!

[J24]

Hoping this is helpful to those of you looking to implement a VLAN scheme in your home networks without the benefit of a WiFi access point with proper VLAN tagging.

I wanted to setup some VLANs to segregate my trusted devices from general wifi, IOT and WiFi AV (appleTVs, etc). I didn't want to replace my Netgear Orbi mesh system (which works GREAT) with a pro-level wifi access point. That's usually how wifi VLANs are tagged.

Instead I got a Netgear smart pro switch capable of mac-based VLAN tagging. It works great. It's a bit more admin because you have to take time to enter the mac addresses of the devices you want associated with specific VLANs. But it is a good way to tackle this problem without having to go to higher-end pro wifi gear.

VLAN 1 -- is just the pfsense box
VLAN 10 -- is trusted devices (not my wife and kids who don't care about security or privacy :-). Wired devices pickup the PVID tag but wifi devices have their mac address associated with the VLAN tag. It is a mix of wired and wifi devices.
VLAN 20 -- is general WiFi (guest and others). I don't bother entering Mac addresses for this VLAN I just let the PVID assign them. All wifi devices.
VLAN 30 -- is IoT and those I have to enter the Mac addresses for. All wifi devices.
VLAN 40 -- are speakers and appleTVs. All wifi devices.

The Orbi (in access point mode) comes into switch port 8. Switch port 1 is the trunk to the pfsense box.

Here is the switch I used:
https://www.netgear.com/support/product/gs308t.aspx

Here are the VLANs as represented in pfSense

Here are the VLANs in the switch:

Here is how you enter the mac address association with the VLAN tag

Fun project!

[netblues]

@J24 Nice one.
In todays net there is a trend on devices to randomise mac's so as not to be identified.
Windows does that. The trend is also followed by mobile manufacturers.

Also, you have to administer mac's on a hardware device. Very error prone if you have more than a few. And it seems that the mac to vlan feature is not in all cheap managed switches too. (just checked my dling dgs1100-08).

Doesn't the orbi mesh support Wifi eap auth?