UniFi camera VLANs with OPNsense and FreeRADIUS

My IP cameras use a local recorder and have no need for Internet access. They’re on a separate VLAN, with firewall rules allowing the recorder access and blocking everything else they don’t need.

UniFi’s RADIUS MAC authentication lets them join the existing WiFi and still be assigned to the camera VLAN. FreeRADIUS on OPNsense holds the MAC-to-VLAN mapping. The cameras continue using the normal WiFi password.

This example uses VLAN 500 for cameras. The VLAN, DHCP scope and firewall rules need to exist on OPNsense, and VLAN 500 must be carried through the switches to the AP. The steps below cover the UniFi and FreeRADIUS configuration.

UniFi configuration

1. Add the camera network

Under Settings → Networks, add a network named Cameras, with VLAN ID 500 and the router set to Third-party Gateway. If the network already exists, use that. Routing and DHCP remain on OPNsense.

2. Create the RADIUS profile

Open Settings → Networks → RADIUS Servers and create an external RADIUS profile. Some Network versions put RADIUS under Profiles.

• Name: opnsense.
• Authentication server: the OPNsense address reachable from the AP.
• Port: 1812.
• Shared secret: a generated secret, which will also be entered against the AP in FreeRADIUS.
• RADIUS Assigned VLAN Support: enable it for wireless networks.

Save the profile. Accounting isn’t required for VLAN assignment.

3. Select the profile on the WiFi network

Under Settings → WiFi, edit the existing SSID. Keep its usual WPA2/WPA3-Personal security and password.

1. Open the advanced settings and enable RADIUS MAC Authentication.
2. Select the opnsense RADIUS profile.
3. Set MAC Address Format to lowercase without separators: aabbccddeeff.

For a new setup, apply the WiFi change after completing the FreeRADIUS configuration below, so reconnecting clients have a working RADIUS service to query. These settings follow Ubiquiti’s MAC-based VLAN guide.

OPNsense / FreeRADIUS configuration

4. Enable FreeRADIUS and VLAN assignment

If needed, install os-freeradius under System → Firmware → Plugins. Open Services → FreeRADIUS → General and enable both Enable and Enable VLAN assignment.

My configuration also uses Enable VLAN fallback assignment, visible in advanced mode, with Fallback VLAN ID set to 1. This allows devices without a matching camera entry onto the normal network. Use the VLAN appropriate to your default network. This option deliberately accepts failed MAC logins onto that VLAN; leave it off if unmatched devices should be rejected.

Save the settings. FreeRADIUS’s separate DHCP Enable option isn’t needed here; clients use the existing DHCP service on their assigned VLAN.

5. Add the AP as a RADIUS client

Open Services → FreeRADIUS → Clients and add an entry:

Field	Value
Enabled	Checked
Name	A descriptive AP name
Secret	The same shared secret entered in the UniFi profile
IP Address or Network with CIDR	The AP’s RADIUS source address, normally its management IP; use /32 for a single IPv4 address

Save the entry and repeat for each AP serving this SSID. Allow UDP 1812 from those AP addresses to OPNsense through the relevant firewall rules. The client address is the AP, not the camera or UniFi controller.

6. Add the cameras as users

Under Services → FreeRADIUS → Users, add one user for each camera. For an example wireless MAC of AA:BB:CC:DD:EE:FF:

Field	Value
Enabled	Checked
Username	aabbccddeeff
Password	aabbccddeeff
Description	A camera name or location
VLAN ID	500
IP Address / Subnetmask	Leave blank; use DHCP

The username and password are both the MAC address, in exactly the format selected in UniFi. Leave Password Encryption at its default Cleartext-Password if viewing the advanced fields. This RADIUS password is separate from the WiFi password configured on the camera.

Save each user, then apply the FreeRADIUS changes. With VLAN assignment enabled, OPNsense generates the required tunnel attributes from VLAN ID; no custom reply attributes are needed. The OPNsense FreeRADIUS guide covers the plugin settings.

Check the result

Apply the UniFi WiFi changes, then reconnect a camera. In UniFi’s client list it should still show the existing SSID, but its network should be Cameras. Check that its DHCP lease belongs to the VLAN 500 subnet, that the recorder can reach it, and that Internet access is blocked.

If it fails, check Services → FreeRADIUS → Log File. A rejected login usually warrants checking the wireless MAC, its formatting and the matching password first. No request points towards the AP client entry, shared secret, firewall or server address. If authentication succeeds but the network is wrong, check both VLAN-assignment settings and the VLAN path to the AP.

This is running here with cameras on the normal 2.4 GHz SSID and VLAN 500. Adding another camera is one more FreeRADIUS user entry. MAC addresses can be spoofed, so this is convenient segregation for devices using the WiFi password, rather than strong device authentication.