From a freshly installed Korthveil to a working, protected wireless network. The screenshots are from a GMKtec M5 Pro with these ports:

The result:

• The network: Wi-Fi korthveil on 5 GHz with WPA2/WPA3-Enterprise. Each device signs in with its own certificate, checked by the firewall's own RADIUS server (NAC).
• For clients: addresses from DHCP (IPv4) and router advertisements (IPv6), a rule to the Internet, and NAT on the uplink.
• Protection: intrusion prevention on the traffic, and the web application firewall ready for published sites.

Every change below goes into pending changes until you Commit. Commit with Safety rollback on (the default): if a change cuts you off, it undoes itself after five minutes unless you confirm it.

Step 1: Certificates for NAC

Go to System › Certificates › Add a certificate and make three certificates:

The device certificate has a .p12 button. It downloads the certificate and its key, protected by a password that is shown once. That is what you install on the laptop or phone (Step 8).

Step 2: Turn on the add-ins

In System › Add-ins, switch on:

• DHCP server;
• Network access control;
• Intrusion prevention;
• Web application firewall.

Each add-in then has its own page (shown in the steps below).

Step 3: Make the Wi-Fi card an access point

Go to Network › Interfaces, zones & routes. Click Add Wi-Fi access point, or the pencil on the Wi-Fi interface (wlp3s0).

Personal Wi-Fi instead: choose WPA2/WPA3-Personal and type a passphrase of 8 to 63 characters. Then skip Steps 1, 6, and 8.

Click Save to pending changes.

Step 4: A zone for the wireless clients

In Zones, click Add zone:

• Name: WIFI
• Interfaces: wlp3s0
• Ping: on
• Management: off (wireless clients should not reach the firewall's web UI)

After the commit, the interface table shows the access point On air with the channel it chose:

Step 5: Addresses for the clients (DHCP)

Open Network › DHCP server and add a network on wlp3s0:

Step 6: Let the clients out, and NAT

The rule: go to Firewall › Rules, click Add rule:

• Name: Wi-Fi to Internet
• From: WIFI
• To: WAN
• Service: any
• Action: Allow

Everything else stays denied.

NAT: in Firewall › NAT › Add source NAT:

• Name: Internet via WAN
• Type: Masquerade
• Out interface: enp2s0
• Family: IPv4 + IPv6

The clients' private addresses leave as the uplink's address.

Step 7: The RADIUS server (NAC)

Open Identity › Network access control.

RADIUS clients:

• Zones: tick WIFI;
• Add RADIUS client:
• Name: firewall-wifi
• Addresses: 192.168.20.1
• Shared secret: the same as in Step 3

Authentication methods:

• tick EAP-TLS;
• RADIUS server certificate: nac-radius;
• CA of the devices' certificates: nac-ca;
• Highest TLS version: TLS 1.2. Choose 1.3 only when all devices are recent.

Device owners can tie a certificate to a person (laptop-1 → admin), so the log names them.

Step 8: Protection: IPS and WAF

Intrusion prevention (Security › Intrusion prevention):

• Mode: Prevention (drop rules block traffic);
• When the engine is unavailable: Fail open, so a restart never cuts the network;
• Rules tab: turn on ET Open (daily updates).

The Engine card then shows Running and the rules loaded (here 46,872).

Web application firewall (Security › Web application firewall): switch it on now. It protects sites you publish with the Reverse proxy add-in. Until a site is published, it waits, as shown.

Step 9: Commit and check

Click Commit (Safety rollback on), with a note such as Wi-Fi with NAC, DHCP, rule and NAT, IPS, WAF. Within a minute, check:

Then confirm the commit (the banner at the top) so it stays.

Step 10: Join a device

Install the device certificate (laptop-1.p12, with the password from Step 1) and the CA (nac-ca.pem), then join korthveil. The settings per system (Windows, macOS, iPhone, Android, Linux) are in the guide NAC and Enterprise Wi-Fi, Step 9.

On Identity › Network access control › Recent authentications:

• a device with a certificate from nac-ca shows accepted;
• any other device shows rejected.

Troubleshooting

More: the guides NAC and Enterprise Wi-Fi (device setup in detail), Certificates, and Amazon S3 archive (keeping the logs).