Is there any reason not to do this if I want to have a separate PSK for each client and can't use a RADIUS server for that? Other than maybe the slight performance decrease that is intrinsic to VAP and the increase in beacon transmission, would there be any downside if my AP supports more VAPs than I have clients?

The reason I want to do this is that I would like to isolate each client from each other so one client can't monitor traffic from the other clients (and they could monitor traffic if they knew each other's PSK). There is a feature in hostapd called client isolation, but all that does is disable hairpin mode and enable multicast-to-unicast. It is not enough to protect from a rogue device with the PSK

The STA and AP connect using a PSK. The PSK is shared among all clients unless WPA2-Enterprise like EAP-TLS is used (which I cannot do due to lack of client support). Knowledge of the PSK and the ability to capture the 4WH (which includes the ANonce, SNonce, and STA and AP MAC) is sufficient to derive the per-client PTK.

  • hostapd (isn't that used by OpenWRT?) can use a different PSK per client MAC address. So your premise can be averted as long as clients stick to their MAC address (or else they get no service) and are given a different PSK.
    – A.B
    Jul 18, 2022 at 10:17
  • It's actually a different PTK, not a PSK. The 4WH includes the two MAC addresses which means if you capture the 4WH and know the PSK, you can determine the PTK.
    – owrtbro
    Jul 18, 2022 at 19:10
  • You wrote in the question "If you know the PSK" which you won't: you'll know your own PSK which can be made different from an other client's PSK. Now you're writing "It's actually a different PTK, not a PSK." what where? I'm stating hostapd can provide different PSKs.
    – A.B
    Jul 18, 2022 at 20:38
  • @A.B If there is a way to specify a custom PSK for a specific client, I would love to know how. en.wikipedia.org/wiki/IEEE_802.11i-2004#Protocol_operation explains how the PSK (derived from the password itself) is used to generate the per-client PTK. "Client isolation" does not have anything to do with that. The one and only thing that it does is forward traffic through the router's WLAN interface so that the firewall can act on it as if it wasn't L2.
    – owrtbro
    Jul 18, 2022 at 21:12
  • Next time you ask a question, don't discourage people to help you. Because I give up (and I'm using one PSK per client in my setup).
    – A.B
    Jul 18, 2022 at 21:55

1 Answer 1


I found a better solution to using VAPs. The hostapd wpa_psk_file can be used to select a custom PSK for each station.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .