Let only trusted devices onto your Wi-Fi. Each device signs in with its own certificate (802.1X, EAP-TLS), and Korthveil itself is the RADIUS server that checks it.

You need:

• a Korthveil firewall with a Wi-Fi card, or an 802.1X-capable access point or switch;
• about 15 minutes;
• the devices you want to admit.

You don't need: a separate RADIUS server, a domain, or any software on the devices. Windows, macOS, iOS, Android and Linux all have the 802.1X client built in.

How it works

 laptop / phone                     Korthveil firewall
 ┌──────────────┐  802.1X (EAP-TLS)  ┌──────────────────────────────┐
 │ device cert  │ ─────────────────▶ │ Wi-Fi access point           │
 │ (laptop-1)   │                    │        │ RADIUS              │
 │ trusts       │                    │        ▼                     │
 │ nac-ca       │ ◀── server cert ── │ NAC add-in (RADIUS server)   │
 └──────────────┘    (nac-radius)    │  admits devices whose        │
                                     │  certificate nac-ca signed   │
                                     │  and is still in the store   │
                                     └──────────────────────────────┘

Three certificates do the work, all made on the firewall:

• nac-ca is your own certificate authority, the root of trust for this network;
• nac-radius proves to devices that they are talking to your RADIUS server;
• laptop-1 (one per device) proves to the firewall that this device may join.

A device gets on only with a certificate from nac-ca that is still in the firewall's certificate store (System › Certificates). The store is the list of allowed devices: delete a device's certificate there and it is locked out at once and disconnected from the firewall's Wi-Fi. A certificate copied from elsewhere, or one you deleted, never gets on. There's no shared Wi-Fi password to leak.

How a device is checked, step by step:

1. The device joins korthveil and starts 802.1X. The access point passes the exchange to the NAC add-in (RADIUS).
2. The device checks the firewall: the server certificate nac-radius must be signed by nac-ca, which the device trusts (Step 9).
3. The firewall checks the device: - its certificate is signed by nac-ca; - it is within its validity dates; - it proves it holds the private key; - its serial number belongs to a certificate still in the store.
4. All checks pass: the device is admitted and the session is logged with the certificate's name. Any check fails: rejected, and the log says why (for example not in the store).

Quicker: System › Wizards › Enterprise Wi-Fi with NAC does steps 1 to 8 for the firewall's own Wi-Fi: it creates the CA, the RADIUS server certificate, and the first devices' certificates, makes the access point a RADIUS client with a random shared secret, and switches the Wi-Fi to Enterprise. Then continue with step 9. The steps below do the same by hand and explain each part.

Step 1: Turn on the NAC add-in

Go to System › Add-ins, find Network access control, and switch it On. Then open its page with Settings, or through Identity › Network access control.

Step 2: Create your certificate authority

Go to System › Certificates, and under Add a certificate choose Create a local CA:

• Name in the store: nac-ca
• Common name: Korthveil NAC CA (any name your users will recognise)
• Organization: optional

Click Create. The CA's private key is made on the firewall and never leaves it.

Step 3: Issue the RADIUS server certificate

Still under Add a certificate, choose Issue from a local CA:

• Name in the store: nac-radius
• Issuing CA: nac-ca
• Use: Server
• Common name and DNS names: a name for the RADIUS server, e.g. radius.korthveil.lan. It doesn't have to be in DNS: devices check it against the CA.

Keep Renew automatically on. Click Create.

Step 4: Issue a certificate for each device

Again Issue from a local CA, once per laptop or phone:

• Name in the store: the device, e.g. laptop-1
• Issuing CA: nac-ca
• Use: Client (VPN users, devices)
• Common name: the same, laptop-1. This name appears in the sign-in log.

Click Create.

The Store now lists the three certificates. Device certificates have a .p12 button.

Step 5: Download the device certificate

Click .p12 on the device's row:

• The file: laptop-1.p12 downloads. It holds the certificate, its private key, and the CA, protected with AES-256.
• The password: shown once, at the top of the Store. Write it down for the device.
• The audit: the download is recorded in the Audit log.

Also download the CA certificate (the download icon on the nac-ca row, nac-ca.pem). Devices use it to check that they are talking to your server.

Only device (Client) certificates can be downloaded with their key. Server certificates, CAs, and the web console's certificate cannot.

Step 6: Add the access point as a RADIUS client

Open the Network access control page. Under RADIUS clients:

• Zones: tick the zone where the access point is. For the firewall's own Wi-Fi, that's the Wi-Fi zone (here WIFI).
• Name: e.g. firewall-wifi
• Addresses: the access point's address. For the firewall's own Wi-Fi it's the Wi-Fi interface's address, e.g. 192.168.20.1.
• Shared secret: a long random string (16 or more characters). You'll type the same secret on the access point in Step 8.

Step 7: Choose EAP-TLS and the certificates

Under Authentication methods:

• tick EAP-TLS;
• RADIUS server certificate: nac-radius;
• CA of the devices' certificates: nac-ca;
• Only devices with a certificate in the store: keep it ticked (the default). Untick it only for a CA outside Korthveil whose device certificates are not in the store; then any certificate that CA signed gets on.
• Highest TLS version: keep TLS 1.2 unless all your devices are recent. TLS 1.3 works with Windows 11, macOS, and Android 10+.

Click Save to pending changes.

These certificates now show "the nac add-in" under Used by, and can't be deleted while NAC uses them.

Step 8: Switch the Wi-Fi to Enterprise

Go to Network › Interfaces, zones & routes, and edit the Wi-Fi interface with the pencil (or use Add Wi-Fi access point):

• Security: WPA2/WPA3-Enterprise (recommended)
• Country: where the firewall is
• Channel: Automatic (Korthveil picks the least busy one) or a fixed channel
• RADIUS (802.1X), Server address: the same address as in Step 6, e.g. 192.168.20.1
• Shared secret: the same secret as in Step 6

The interface also needs:

• an address (e.g. 192.168.20.1/24) with no gateway;
• a zone;
• DHCP for its clients (DHCP add-in);
• a rule such as WIFI → WAN, allow, and source NAT on the uplink, so clients reach the internet.

Save, then Commit the pending changes (the bar at the top).

Step 9: Set up a device

On each device, install the two files, then join the Wi-Fi.

Always choose the CA certificate, never "Do not validate". Otherwise the device would trust any access point with the same name. Delete the .p12 file once it is installed.

Step 10: Check it works

On the NAC page, Recent authentications lists every sign-in:

• accepted: a device with a valid certificate (laptop-1, method EAP-TLS);
• rejected: a device whose certificate came from another CA (rogue in this example).

Using your directory: Active Directory, Samba AD, FreeIPA, or LDAP

NAC can check users and computers against your directory instead of local users only.

Know this before you deploy

• Group names must match exactly, including upper and lower case. NAC compares a VLAN group's name with the directory's spelling letter for letter: Staff does not match staff. Run Test on System › Directories with a real user: it lists that user's groups exactly as the directory spells them. Copy those names into VLAN assignment › By group.
• PEAP-MSCHAPv2 does not work with the directory yet. That is the method Windows uses by default with a user name and password. It needs the firewall to join the Active Directory domain, which is planned but not built. Today, use one of these:
• EAP-TTLS with PAP inside for directory passwords (supported by Windows 10/11, macOS, iOS, Android, and Linux; set the inner method to PAP in the device's Wi-Fi profile);
• EAP-TLS with certificates.
• The computer check is basic. With "EAP-TLS devices need an enabled computer account", a device's certificate common name must name an enabled computer account (host/pc01.corp.example or pc01.corp.example). Not yet available:
• matching on the certificate's alternative names (SAN);
• requiring the computer to be in a group or OU;
• choosing a VLAN by computer group. EAP-TLS devices get the EAP-TLS VLAN.
• Only encrypted directory connections are used: LDAPS (636), or StartTLS on 389. Import the directory's CA under System › Certificates.

Steps

1. Open System › Directories. Press Find directories: enter your domain, or a subnet to scan. Press Use on your domain controller or directory server.
2. Fill in Service account (bind DN) and Service account password. Use a read-only account. If TLS shows "CA to import", import that CA and choose it under Server CA.
3. Under Test, enter a real user name and password, and a computer name. Press Test: every step should show OK. Note the group names it lists.
4. Press Save to pending changes and commit.
5. Open Identity › NAC. Under Users and directory, choose the directory under Directory.
6. For laptops with domain certificates (AD Certificate Services, FreeIPA certmonger), tick EAP-TLS devices need an enabled computer account. A device whose computer account is disabled is then refused at its next sign-in.
7. Under VLAN assignment › By group, add the groups with the exact names from step 3.
8. Tick EAP-TTLS under Authentication methods if users sign in with directory passwords. Save and commit.

Managing devices: Identity › NAC devices

Identity › NAC devices is the list of machines allowed on the network and the Wi-Fi. Each device signs in with its certificate (Wi-Fi korthveil, 802.1X switch ports), with its MAC address (printers and TVs on switch ports, with MAC Authentication Bypass on), or both.

Add a device: click Add device:

Click Add device. With a new certificate, click .p12 in its row to download it, and set up the device as in Step 9.

When changes take effect:

• Block, allow, add, remove: applied at once. Korthveil commits the change by itself when nothing else is waiting in the pending changes; otherwise it saves it and asks you to commit.
• Blocked device: its sign-in is refused, by certificate and by MAC address, and it is disconnected: from the firewall's own Wi-Fi within about 15 seconds, and from other access points and switches with a RADIUS Disconnect.
• Expiry and hours: checked every 30 seconds, without a commit.
• Letting it back: turn the switch on. The device keeps its certificate, so nothing changes on the device.

Seen on the network, not on the list shows recent sign-ins of devices you haven't listed; Add puts one on the list.

Troubleshooting

More:

• Certificates: CSRs, registrar bundles, renewals.
• adr/0057: how the firewall hands certificates to the NAC add-in.