Completely Isolating WiFi clients

[lanorwan]

Hello!

My setup is as follows:

• Router WAN port connected to ISP modem
• 1x Router LAN port connected to a self-hosted server
• 2.5G WiFi AP point enabled with SSID "okayokay"
• 5G WiFi AP point enabled with SSID "fastfast"

(Isolate clients checkbox is checked/enabled for both AP)

What I want happening:

1. Completely isolate all WiFi clients (inter and intra AP/SSID and every other way) so that a compromise/malware of one client cannot infect other clients
2. Allow all WiFi clients to access the self-hosted server (via the wireguard server on it) (could the clients end up communicating inside server when they are connected to the server?)

I mostly have a default out-of-box config (only changed root password and set up WiFi APs through the web interface only). How can I achieve what I want happening? My router has enough RAM, Flash, and CPU power for mostly anything.

I really appreciate any inputs.
Thank you in advance!!

[psherman]

@lanorwan

Completely isolate all WiFi clients (inter and intra AP/SSID and every other way) so that a compromise/malware of one client cannot infect other clients

As you mentioned, you have the isolate clients option enabled. This will prevent all wifi devices from talking to each other provided that there is only a single access point. It will not isolate wifi from ethernet and vice versa. Where multiple APs are in use, wifi client devices connected to one AP 'appear' to be ethernet connected from the perspective of the other AP.

@lanorwan

1. Allow all WiFi clients to access the self-hosted server (via the wireguard server on it) (could the clients end up communicating inside server when they are connected to the server?)

Wireguard isn't necessary for devices already on your network to access your server, unless there is some other purpose for Wireguard. (I'm assuming the server is on the same network).

[lanorwan]

Thank you for your response!

@psherman

Where multiple APs are in use, wifi client devices connected to one AP 'appear' to be ethernet connected from the perspective of the other AP.

So that means for instance all clients on fastfast are completely isolated from each other, but clients on fastfast can talk to clients on okayokay; is that correct? If so, how can I also isolate them?

Also, how easy is it for clients on fastfast to bypass isolation and end up talking to each other?

@psherman

unless there is some other purpose for Wireguard. (I'm assuming the server is on the same network).

Yeah, they are on same network as described in my setup in original post. I implemented wireguard as I also want to sometime soon allow accessing my server remotely and wanted to reduce leak and open ports attack surface.

[lleachii]

@lanorwan

If so, how can I also isolate them?

Place the SSIDs on different networks that are firewalled from one another.

[lanorwan]

Hi, thank you for your response!

I did not really understand what you meant by "different networks." I would really appreciate if you are able to guide me a bit with it or point me to a guide/docs!

[lleachii]

@lanorwan

I did not really understand what you meant by "different networks."

I assume you have the SSIDs connected to LAN. Create a LAN2 and move a SSID to it.

[lanorwan]

Ah, got it. That is what a VLAN is right? I'll look into it.

Thank you!

[lleachii]

@lanorwan

That is what a VLAN is right?

Yes, on some devices (and older versions of OpenWrt) an additional step of creating a VLAN is needed. Some others (DSA-based), you just hit "Add" on the network interfaces web GUI page.