I'm using a snapshot version (
r15172-af07c6de9c) because my device (ASUS RT-AC65P) is not supported by a release.
I'm trying to do rather common thing, a guest wifi network with clients isolation. Because my device has 2 radios, I created 2 networks with same SSID and bridged them to have same IP-range.
config interface 'guest' option type 'bridge' option proto 'static'
config wifi-iface 'wifinet3' option device 'radio0' option mode 'ap' option isolate '1' option network 'guest' config wifi-iface 'wifinet4' option device 'radio1' option mode 'ap' option isolate '1' option network 'guest'
That isolates clients within same band, but clients from one band may talk to clients of the second band. According to various topics here further isolation may be done via
ebtables. Unfortunately that is tricky because of "WLAN interface names may be dynamic or unpredictable".
Newer kernels (4.18+) support a better way — port isolation. I've tried that by
echo 1 >brport/isolated and it worked fine.
It seems tha
netifd also somehow supports that feature.
But I can't make it work.
Am I right that
netifd applies that only to non-bridged devices or bridges themselves, but not to bridged interfaces?
Is there a way to configure
netifd to set that for bridged
Should that maybe a default behavior for
netifd to mark wireless-isolated interfaces as