hostapd.conf

# "physical" device (although its still virtual)
# idk, this is a bit weird. hostapd will use this as a base (ensure MAC block boundaries are correct)
# and will create virtual interfaces based on this one.
# also: this interface *must* be in managed mode (and will be turned into AP mode by hostapd)
# if it's already in AP mode, hostapd will fail for some reason.
interface=wlv_iot
# Set hostapd driver (nl80211 is used with all Linux mac80211 (in-kernel) and modern Realtek drivers)
driver=nl80211
# Set allowed frequency ranges and transmit power levels
country_code=DE
# Advertises the country_code and the set of allowed channels and transmit power levels
ieee80211d=1
# Band: a = 5GHz & 6GHz (a/n/ac/ax), g = 2Ghz (b/g/n)
hw_mode=g
# Channel
channel=11
# IEEE 802.11n
ieee80211n=1
macaddr_acl=0
# adapter/driver high throughput capabilities (iw list)
# it's honestly a bit of a pain to figure out which ones are available, so happy hunting.
ht_capab=[HT40+][HT40-][GF][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC2]
# Wi-Fi Multimedia (WMM) QoS support
wmm_enabled=1
# WAP is visible in SSID broadcast
ignore_broadcast_ssid=0
# isolate all clients connected to the AP from each other 
# (TODO: ensure your upstream components also know about your isolation policies) 
ap_isolate=1
# Warning messages only
logger_syslog_level=4

### IoT SSID
ssid=ap.iot.home.arpa
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=a_very_secret_passphrase

### Guest SSID
bss=wlv_guest
ssid=ap.guest.home.arpa
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=also_very_secret_passphrase

### External IoT SSID
bss=wlv_external
ssid=ap.external.home.arpa
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=yet_another_secret_passphrase

### Mobile SSID
bss=wlv_mobile
ssid=ap.mobile.home.arpa
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=you_know_the_drill