University networks generally implement 802.1x, WPA2/EAP, MAC registration, and similar authentication schemes so that every device is tied to an authorized use

University networks generally implement 802.1x, WPA2/EAP, MAC registration, and similar authentication schemes so that every device is tied to an authorized user and malicious activity can be traced to a real person. When a network device is attached that doesn't pass this authentication requirement onto its users (i.e. by NATing, or offering a public or common-key WiFi network) the university loses its ability to see who is doing what, and to deny access to people it doesn't want on its network. IT departments don't like that. The security risk is not so much that you can now route certain internal IPs, but that IT has no way of determining who you are, or even your real MAC address, if it has questions about or objections to your traffic (whether Hopefully no one is placing sensitive services on the same network as dorm rooms with no security, but being on the LAN is often used as a front line. For one thing, sitting on the right part of the campus network gets you access to most scientific journals based on IP whitelisting. The University is contractually not allowed to provide this access to people who aren't students/faculty/staff, so it has to control who can come from those IPs. We operate separate SSIDs for guests that route to the internet through IPs not in the whitelist. We also have certain intranet-only services like Facilities work orders, printing, etc. that could be on the public internet, but don't need to be, so better to those aging, likely vulnerable applications behind a layer than not.