Given the following setup: 1 openWrt router emitting wifi. No ethernet cable plugged. 2 clients, A and B, not trusting each other How can I achieve client isolation, in a way that a very advanced malware on a client could not contaminate the other? I can see 2 options: Create one SSID, and add…

Thank you for that link. I had seen it, but it mainly deals with the issue of ethernet. So the discussion evolves a lot around VLANs. In my case it is not appropriate, since my scenario only has wifi. This thread also does not help me understand how option isolate actually works.

The Wi-Fi interface documentation should lead you here: [image] Clients in same WLAN can't reach each other Network and Wireless Configuration It might be worth checking how things are actually set in sysfs. As I understand things, there are 3 "isolation" settings... firs…

I do understand, that client isolation works in a network where openwrt is the gateway, so for example within the guest wifi of an openwrt ap. But would this isolate also work within the lan wifi of an openwrt access point ? I very much doubt that, as I would expect that there the clients can still…

Hmm, I do not see the difference between a guest wifi and a lan. To me they are just different network, but they could be configured exactly the same way. So I would not expect what you describe.

Isolation works in any wifi. The strange thing is, that this is a per wifi setting. So you can for example isolate clients in your 2.4ghz wifi but not in your 5ghz wifi. If they belong to the same network, funny effects happen based on whether both clients are connected to 2.4ghz or 5ghz wifi or mix…

You likely need to enable bridge firewall and restrict forwarding to isolate clients on different bands: Bridge firewall Bridge firewall This article relies on the following: * Accessing OpenWrt CLI * Managing configurations * Managing packages * Managing services Introduction …

yes, because only clients within the same wifi are isolated. So even if you have 2 different ssids on the same band in the same network, their clients cannot be isolated against the other ssid. So this isolate setting really only works within same band and same ssid.

Considering only the Wireless aspect of a network, is there any security advantage of creating a separate SSID for guest, rather than simply setting option isolate to my lan? I am not aware of any. Given that I am ok using the same dns resolver for guest and lan (I don't see much value in different…

What does the guest network do: protect all stations in the lan network from guest access protect the access point and or router from guest access separate guest login from lan login (different network keys) What you will loose by only using isolate is: protecting lan devices connected by cable …

Isolate clients on wifi

Installing and Using OpenWrt Network and Wireless Configuration

Stefan1 March 31, 2021, 8:26pm 2

See Client isolation