Eero for university students

VPN
1

Hi, I have a child heading off to university soon. The university accommodation provides internet services via an ethernet cable as well as wifi. I have a spare gen 2 eero, and my thinking is if they set up a new network using the spare eero connected to the ethernet cable, they will get their own subnet, own wifi SSID and also have some protection from other students sniffing around their devices. Does that make sense? Will the eero provide firewall protection against traffic from the university network, or does the firewall only work on a gateway eero connected directly to the internet?

2

Your assumption is mostly correct — but with some caveats. It may be the case that they’ll experience the problems of double NAT no matter what they do, if they want to be firewalled from the University (some universities provide globally addressable IPs if they have the allocation). A few things worth noting:

  1. The university may prohibit running your own WAP. They probably won’t get your kid in trouble but it is worth knowing.
  2. The Eero will struggle to find a clear channel — the university will have multiple WAPs in range for coverage, and they’ll have designed a coverage map to avoid overlapping channels
    3.No matter what, you won’t have as good reception as the university network provides
    You may not need all of this, many universities segment their wireless network per-client or per-student IS. They’ll likely make your kid sign in to use every device using 802.1X
3

Might be better off with a travel router.

4

If you’ve got an extra it’s worth a try but as mentioned they’ll be fighting for a free channel. I think better wifi would be the main reason for adding the eero but university wifi (and internet in general) is usually pretty excellent.

5

It entirely depends on the uni. Where I work, students w/ their own WAPs are hunted down like rabid dogs.

6

I just set one up in my sons dorm room. No issues at all.

7

The university probably won’t allow this. They will more than likely be able to track it down and may disable your child’s access.

8

Only issue is double nat will limited your online gaming experience. Upnp might not working with double but overall it’s ok. And enjoy your College life

9

Good points. I’ve run my eeros in double NAT mode before and not come across any issues, but definitely one to bear in mind.

I guess the other points will depend on the exact nature of the service provided. I’ll send them off with the spare eero and see what they can achieve with it.

10

I’ve also got a GL.inet shadow but it isn’t really spare. It does add the ability to WireGuard VPN back to my Firewalla Purple. What other reasons would you recommend a travel router?

11

Agreed, at the university I went to I had to fight just to get ethernet…routers were a straight up no

12

Same with my university. My university has to specifically have the Mac address of some devices via Ethernet and they block router Mac addresses that are not theirs. They allow unmanaged dumb switchs but all the devices on it have to be registered with he university.

13

There’s a few reasons I’d go with travel router like Gl.Inet versus an Eero for this scenario.

  • eero cannot connect to VPN at router level, so any traffic may be visible unless devices are protected

  • eero cannot do common campus port authentications like 802.1x or portal authentications so probably non-starter anyways

  • eero cannot use wifi as WAN, in case there is no physical Ethernet

  • eero does not allow manual channel selection so you are stuck with the ACS algorithm - assume campus is quite busy RF wise

  • travel router will support all of those plus LTE backup, tether to phone, battery backup etc

14

Thanks - much appreciated.