UniFi camera VLANs with OPNsense and FreeRADIUS

My IP cameras record locally, so they don’t need Internet access. I keep them on a separate VLAN, with firewall rules that let the recorder reach them and block everything else they don’t need.

I also wanted them to use the existing WiFi. UniFi’s RADIUS MAC authentication handles that: the cameras join with the normal WiFi password, then FreeRADIUS on OPNsense supplies the VLAN for each camera’s MAC address.

I’m using VLAN 500 for the cameras here. Before starting the UniFi and FreeRADIUS setup below, make sure the VLAN, DHCP scope and firewall rules exist on OPNsense, and that VLAN 500 is carried through the switches to the AP.

UniFi configuration

1. Add the camera network

Under Settings → Networks, add a network named Cameras, with VLAN ID 500 and the router set to Third-party Gateway. If you’ve already added it, use the existing network. OPNsense still handles routing and DHCP.

2. Create the RADIUS profile

Open Settings → Networks → RADIUS Servers and create an external RADIUS profile. Depending on your Network version, you may find RADIUS under Profiles instead.

• Name: opnsense.
• Authentication server: the OPNsense address reachable from the AP.
• Port: 1812.
• Shared secret: a generated secret, which will also be entered against the AP in FreeRADIUS.
• RADIUS Assigned VLAN Support: enable it for wireless networks.

Save the profile. You don’t need accounting for VLAN assignment.

3. Select the profile on the WiFi network

Under Settings → WiFi, edit the existing SSID. Keep its usual WPA2/WPA3-Personal security and password.

1. Open the advanced settings and enable RADIUS MAC Authentication.
2. Select the opnsense RADIUS profile.
3. Set MAC Address Format to lowercase without separators: aabbccddeeff.

If you’re setting this up from scratch, finish the FreeRADIUS configuration below before applying the WiFi change. That way, reconnecting clients have a working RADIUS service to query. These settings follow Ubiquiti’s MAC-based VLAN guide.

OPNsense / FreeRADIUS configuration

4. Enable FreeRADIUS and VLAN assignment

If needed, install os-freeradius under System → Firmware → Plugins. Open Services → FreeRADIUS → General and enable both Enable and Enable VLAN assignment.

I also use Enable VLAN fallback assignment, which appears in advanced mode, with Fallback VLAN ID set to 1. That lets devices without a matching camera entry join my normal network. Choose the VLAN for your own default network here. This setting deliberately accepts failed MAC logins onto that VLAN, so leave it off if you want unmatched devices rejected.

Save the settings and leave FreeRADIUS’s separate DHCP Enable option alone; you don’t need it here. Clients use the existing DHCP service on whichever VLAN they’re assigned.

5. Add the AP as a RADIUS client

Open Services → FreeRADIUS → Clients and add an entry:

Field	Value
Enabled	Checked
Name	A descriptive AP name
Secret	The same shared secret entered in the UniFi profile
IP Address or Network with CIDR	The AP’s RADIUS source address, normally its management IP; use /32 for a single IPv4 address

Save the entry and repeat for each AP serving this SSID. Allow UDP 1812 from those AP addresses to OPNsense through the relevant firewall rules. The address to use here is the AP’s: it’s the AP that talks to RADIUS, rather than the camera or UniFi controller.

6. Add the cameras as users

Under Services → FreeRADIUS → Users, add one user for each camera. For an example wireless MAC of AA:BB:CC:DD:EE:FF:

Field	Value
Enabled	Checked
Username	aabbccddeeff
Password	aabbccddeeff
Description	A camera name or location
VLAN ID	500
IP Address / Subnetmask	Leave blank; use DHCP

The username and password are both the MAC address, in exactly the format selected in UniFi. Leave Password Encryption at its default Cleartext-Password if viewing the advanced fields. This RADIUS password is separate from the WiFi password configured on the camera.

Save each user, then apply the FreeRADIUS changes. With VLAN assignment enabled, OPNsense generates the required tunnel attributes from VLAN ID; no custom reply attributes are needed. The OPNsense FreeRADIUS guide covers the plugin settings.

Check the result

Apply the UniFi WiFi changes, then reconnect a camera. In UniFi’s client list it should still show the existing SSID, but its network should be Cameras. Check that its DHCP lease belongs to the VLAN 500 subnet, that the recorder can reach it, and that Internet access is blocked.

If it fails, check Services → FreeRADIUS → Log File. If a login is rejected, start with the camera’s wireless MAC, its formatting and the matching password. If there’s no request at all, look at the AP client entry, shared secret, firewall and server address. If authentication succeeds but the network is wrong, check both VLAN-assignment settings and the VLAN path to the AP.

My cameras are running on the normal 2.4 GHz SSID, assigned to VLAN 500. Adding another camera just means adding another FreeRADIUS user entry. Bear in mind that MAC addresses can be spoofed: this is a convenient way to segregate devices using the WiFi password, rather than strong device authentication.