I'm hoping to create a set of virtual networks within one building wide WiFi network to enable the following goals:
- Allow all users and devices access to the internet
- Give each user the ability to create virtual network to enable uses such as casting, discovery and other inter-device communication common to household WiFi
- Ensure each user and their devices remain private from each other (given caveats)
In pursuit of this I'm planning to use a set of commercial APs (likely Ubiquiti) set to use Guest Isolation. Each ap will be directly connected to a Linux router that will tag traffic with VLANs based on device and then forward traffic back through the APs to simulate a private network. To give users the ability to create "private" networks they will be able to choose (using a initial redirection on auth) to connect to either public or log in to their own network
I have experience with Linux, iptables and routing at a beginner level. From what I have read so far it seems like this may be possible.
I'm asking, does this seem possible and or make any sense? If so I am quite happy to go off an tinker and learn until I get it working (and or give up and simply offer free WiFi with no attempt at the above). I'm mostly worried that I have put together an idea based on a flawed understanding of networking.
Caveats: I understand there there will be a privacy risk in that using WPA2 PSK will allow all users the possibility to snoop on eachothers traffic. This will be warned in the TOS and in person to ensure if users require better privacy they will be able to run their own wireless router.
Thank you for any input / opinions on the above!