Creating "private" networks for users within a single wireless network

Question

I'm hoping to create a set of virtual networks within one building wide WiFi network to enable the following goals:

1. Allow all users and devices access to the internet
2. Give each user the ability to create virtual network to enable uses such as casting, discovery and other inter-device communication common to household WiFi
3. Ensure each user and their devices remain private from each other (given caveats)

In pursuit of this I'm planning to use a set of commercial APs (likely Ubiquiti) set to use Guest Isolation. Each ap will be directly connected to a Linux router that will tag traffic with VLANs based on device and then forward traffic back through the APs to simulate a private network. To give users the ability to create "private" networks they will be able to choose (using a initial redirection on auth) to connect to either public or log in to their own network

I have experience with Linux, iptables and routing at a beginner level. From what I have read so far it seems like this may be possible.

I'm asking, does this seem possible and or make any sense? If so I am quite happy to go off an tinker and learn until I get it working (and or give up and simply offer free WiFi with no attempt at the above). I'm mostly worried that I have put together an idea based on a flawed understanding of networking.

Caveats: I understand there there will be a privacy risk in that using WPA2 PSK will allow all users the possibility to snoop on eachothers traffic. This will be warned in the TOS and in person to ensure if users require better privacy they will be able to run their own wireless router.

Thank you for any input / opinions on the above!

Answer 1

Yeah, it's rather common when using wireless kiosk devices as well as office computers on the same wifi "fabric".

You'll need to use an AP that supports VLAN tagging its wireless interfaces and binding authenticated users and / or separate SSIDs to a given VLAN. Tomato can do this. Some commercial APs can do this.

Answer 2

Re. the WPA2 PSK issue: it is possible to configure per-MAC PSKs in hostapd.

You could have a setup where a default PSK was in place for new users, and have your authentication portal generate a new PSK on registration (that may however require reloading or even restarting hostapd, and/or having your clients re-authenticate).

How users would later connect with other devices to 'their' network is a little more complicated, unless you were willing to have users register their device's MAC (although one method could be having your auth portal offer two options: create new network, and join my network with new device).