802.1X for Home Networks

Why Enterprise WiFi at Home?

WPA2-Personal and WPA3-Personal use a pre-shared key (PSK) - a single password that everyone on the network shares. When a guest visits, you give them the WiFi password. When a roommate moves out, you should change the password and re-enter it on every device. When a contractor finishes a job, they still have your WiFi password unless you change it.

WPA Enterprise (802.1X) solves this by giving each person their own username and password. When a guest leaves, you disable their account. When a roommate moves out, you delete their credentials. No need to change the password on every other device. No shared secret that propagates uncontrollably.

Enterprise WiFi also provides per-user encryption keys. Even though everyone connects to the same SSID, each user's traffic is encrypted with a unique key derived from their individual authentication. On a WPA-Personal network, all users share the same encryption key, which means a user who knows the PSK can theoretically decrypt other users' traffic.

For most homes, this level of control is unnecessary. But for home labs, security enthusiasts, and anyone who regularly has guests or tenants on their network, it provides real benefits.

What You Need

Running 802.1X at home requires three components.

A RADIUS server. This is the authentication server that verifies usernames and passwords. FreeRADIUS is the standard choice - it is free, well-documented, and runs on minimal hardware. A Raspberry Pi is more than sufficient.

A router that supports WPA Enterprise. Most prosumer routers support WPA2-Enterprise. Check your router's wireless security settings for options beyond WPA2-Personal. Brands like Asus, TP-Link (higher-end models), Ubiquiti, and MikroTik all support it. ISP-provided routers typically do not.

Client devices that support 802.1X. Every modern operating system supports WPA Enterprise: Windows, macOS, Linux, iOS, Android, and ChromeOS. Some IoT devices do not - smart bulbs, cheap cameras, and basic sensors often only support WPA-Personal. You may need to keep a WPA-Personal SSID for these devices.

graph TD
    subgraph "Home 802.1X Architecture"
        A[Client device] -->|EAP credentials| B[WiFi Router - Authenticator]
        B -->|RADIUS request| C[Raspberry Pi - FreeRADIUS]
        C -->|Verify credentials| D[User database - local file]
        D -->|Success/Fail| C
        C -->|RADIUS response| B
        B -->|Grant/Deny access| A
    end
    subgraph "Separate IoT Network"
        E[IoT devices] -->|WPA-Personal PSK| F[Same router - different SSID]
        F --> G[Isolated VLAN]
    end

Home 802.1X setup - the Raspberry Pi handles authentication while IoT devices stay on a separate WPA-Personal network

Setting Up FreeRADIUS on a Raspberry Pi

FreeRADIUS installation on a Raspberry Pi running Raspberry Pi OS (or any Debian-based distribution) is straightforward. Install it with sudo apt install freeradius. The package includes the server, configuration files, and utility tools.

The configuration lives in /etc/freeradius/3.0/. The key files are:

clients.conf - defines which devices can send RADIUS requests to the server. You need to add your router as a client with its IP address and a shared secret (a password used between the router and the RADIUS server, not user-facing).

users - defines user accounts. Each line specifies a username, authentication type, and password. For a home setup, simple plaintext or NT-Password entries work. A typical entry looks like: alice Cleartext-Password := "alices-strong-password"

The EAP module configuration in mods-enabled/eap controls which EAP methods the server supports. For home use, PEAP with MSCHAPv2 is the most compatible choice. It requires a server certificate - FreeRADIUS generates a self-signed one by default, which works but causes certificate warnings on client devices during initial connection.

For a cleaner experience, generate a proper certificate using a local certificate authority. Tools like easy-rsa simplify this process. Install the CA certificate on each client device, and the certificate warnings disappear.

After configuration, start the server with sudo systemctl start freeradius. Test it locally with the radtest utility before connecting your router: radtest alice alices-strong-password 127.0.0.1 0 testing123

Configuring Your Router

Router configuration varies by brand, but the required settings are the same everywhere. In your router's wireless security settings, change the security mode from WPA2-Personal to WPA2-Enterprise. The router will ask for RADIUS server settings.

RADIUS server IP. The IP address of your Raspberry Pi. Use a static IP or a DHCP reservation so it does not change.

RADIUS port. 1812 is the standard authentication port. FreeRADIUS uses this by default.

RADIUS shared secret. The password you configured in clients.conf. This authenticates the router to the RADIUS server. Use a strong, random string.

graph LR
    subgraph "Router RADIUS Configuration"
        A[Security Mode: WPA2-Enterprise] --> B[RADIUS Server IP: 192.168.1.50]
        B --> C[RADIUS Port: 1812]
        C --> D[Shared Secret: random-string-here]
    end
    subgraph "FreeRADIUS clients.conf"
        E["client router {"] --> F["  ipaddr = 192.168.1.1"]
        F --> G["  secret = random-string-here"]
        G --> H["}"]
    end
    D -.->|Must match| G

Router and RADIUS server configuration must share the same secret - a mismatch causes all authentication to fail silently

Save the settings and apply. The router will now forward all WiFi authentication requests to your RADIUS server instead of checking a local password.

Client Device Enrollment

Connecting a client device to WPA Enterprise requires entering a username and password instead of a WiFi password. The process varies by operating system.

Windows. Select the network, choose "Connect." Windows prompts for credentials. Enter the username and password from your FreeRADIUS users file. On first connection, Windows may warn about the server certificate. If you installed a proper CA certificate, verify it matches. Otherwise, accept the self-signed certificate (less secure but functional for home use).

macOS. Similar to Windows. Select the network, enter username and password. macOS will show the server certificate and ask you to trust it. If you installed the CA certificate in Keychain Access, it will be trusted automatically.

iOS. Select the network, enter credentials. iOS shows the certificate and asks for confirmation. Tap "Trust" to proceed. For a smoother experience, distribute the CA certificate via a configuration profile.

Android. Select the network. Set EAP method to PEAP, Phase 2 to MSCHAPv2. Enter the identity (username) and password. Some Android versions require you to specify the CA certificate or explicitly choose "Do not validate" (not recommended but sometimes necessary with self-signed certs).

Linux. Network Manager supports WPA Enterprise. Select the network, choose WPA Enterprise, set authentication to PEAP, inner authentication to MSCHAPv2, enter username and password. Optionally specify the CA certificate file.

Is It Worth the Complexity?

Honesty matters here. For a household of two people with a dozen devices and occasional guests, WPA3-Personal with a strong passphrase (20+ random characters) provides excellent security with zero ongoing management. The PSK never needs to change because you control who has it, and the number of people is small enough to manage informally.

The complexity of 802.1X at home is real. You are running a server that must stay online for WiFi to work. If the Raspberry Pi crashes, reboots, or loses network connectivity, no one can connect to WiFi until it is back. You need to manage user accounts, certificates, and server updates. Every new device requires enrollment instead of just typing a password.

The failure mode is also more disruptive. If a WPA-Personal password stops working, you re-enter it. If a RADIUS server is unreachable, debugging involves checking the Pi, examining FreeRADIUS logs, testing RADIUS connectivity, and potentially restarting services. This is not difficult, but it is more involved than consumer WiFi troubleshooting.

When It Makes Sense

802.1X at home makes sense in specific scenarios.

Home lab environments. If you run a home lab for professional development, 802.1X is a valuable skill to practice. Enterprise networks run it everywhere, and hands-on experience with RADIUS, EAP, and certificate management translates directly to workplace skills.

Shared housing with turnover. If you regularly have roommates, tenants, or long-term guests, per-user credentials eliminate the password-change cascade. Create an account when they move in, delete it when they leave.

Privacy-sensitive environments. If you want per-user encryption keys so that one user's traffic is cryptographically isolated from another's, 802.1X provides this. WPA-Personal does not.

Security researchers and enthusiasts. If you want to test 802.1X attack scenarios (credential harvesting with hostapd-wpe, certificate spoofing, EAP downgrade attacks), you need a working Enterprise setup to attack. Building one at home gives you a safe, legal test environment.

For everyone else, WPA3-Personal with a strong passphrase remains the pragmatic choice. It is simple, robust, and secure enough for residential use. The effort of running 802.1X at home is justified by specific needs, not by a general belief that "enterprise is always better."