Isolate Wifi client not working

Hi,
I am already very frustrated with this situation.
I have 3 wifi SSIDs each on their specific VLAN.

  1. SSID MY_HOME_LAN is fine, I don't need any specific restrictions
  2. SSID MY_HOME_GUEST I only want access to the Internet without the ability to see other devices on the network or access the router settings. but when I check the wifi isolated client settings, nothing happens, normally I can see other devices on the network and I can communicate with them, why? I tried adding the option isolate '1' entry to /etc/config/network but to no avail.
    3: SSID MY_HOME_IOT Network without internet communication only to another network to a specific ip address and server port without the possibility to see or communicate with other devices in the network. Again, even if I check the item in the wifi isloted client settings, nothing happens, after connecting to the network, I can see all the devices and can communicate with them.

What am I doing wrong, what do I need to set differently?
Linksys WRT1900AC Router v2
OpenWrt 21.02.3
AP TP-Link TL-WR840N v6.2
OpenWrt SNAPSHOT r14731

Isolate is a WiFi-WiFi client isolation (on the same ssid) only. It does not prevent a client from connecting to a different network or to a wired client on the same network. You need the firewall to block inter-network routing.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Yes, I only want to isolate wifi clients so that they cannot see and communicate with each other. I don't have any wired connections in the necessary networks. and I can block the rest of the rules with a firewall. But if I set the isolate client option, after being connected to the mentioned networks, I am still able to see other wifi devices and communicate with them normally.

So what am I doing wrong?

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'XXXXXXXXX'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'br-lan.1'
        option ipaddr '192.168.1.1'

config device
        option name 'wan'
        option macaddr 'XXXXXXXXX'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:t'
        list ports 'lan2:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'lan1:t'
        list ports 'lan3'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:t'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '44'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '55'
        list ports 'lan1:t'

config interface 'guest'
        option proto 'static'
        option device 'br-lan.55'
        option ipaddr '192.168.55.1'
        option netmask '255.255.255.0'
        option ap_isolation '1'

config interface 'iot'
        option proto 'static'
        option device 'br-lan.44'
        option ipaddr '192.168.44.1'
        option netmask '255.255.255.0'
        option ap_isolation '1'

config interface 'server'
        option proto 'static'
        option device 'br-lan.2'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'kamery'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'
        option ap_isolation '1'

config interface 'vpnwg'
        option proto 'wireguard'
        option private_key 'XXXXXXXXX'
        option listen_port '41194'
        list addresses '192.168.6.5/32'

config wireguard_vpnwg
        option public_key 'xxxxxxxxxxxxx'
        option endpoint_host 'XXXXXXXX'
        option endpoint_port '41194'
        option description 'server'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        list allowed_ips '192.168.6.0/24'

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11a'
        option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
        option htmode 'VHT80'
        option country 'CZ'
        option cell_density '0'
        option channel 'auto'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option macaddr 'xxxxxxx'
        option encryption 'psk2'
        option disassoc_low_ack '0'
        option wpa_disable_eapol_key_retries '1'
        option ssid 'Brabo-Wi-Fi'
        option key 'xxxxxxxxx'
        option isolate '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option hwmode '11g'
        option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
        option htmode 'HT20'
        option cell_density '0'
        option country 'CZ'
        option channel '6'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option macaddr 'xxxxxx'
        option encryption 'psk2'
        option disassoc_low_ack '0'
        option wpa_disable_eapol_key_retries '1'
        option ssid 'Brabo-Wi-Fi'
        option key 'xxxxxxx'
        option isolate '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Brabo-Guest'
        option encryption 'psk2'
        option key 'xxxxxxxxxx'
        option network 'guest'
        option isolate '1'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Brabo-Guest'
        option encryption 'psk2'
        option key 'XXXXXXX'
        option network 'guest'
        option isolate '1'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Brabo-IOT'
        option encryption 'psk2'
        option network 'iot'
        option key 'XXXXXXXXX'
        option isolate '1'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Brabo-IOT'
        option encryption 'psk2'
        option network 'iot'
        option key 'XXXXXXXX'
        option isolate '1'
config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option dhcpv4 'server'
        option leasetime '2m'
        option force '1'
        option limit '20'
        option master '1'
        list ra_flags 'none'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option leasetime '2m'
        option force '1'
        option limit '20'
        list ra_flags 'none'

config dhcp 'iot'
        option interface 'iot'
        option force '1'
        option start '1'
        option limit '253'
        option leasetime '12h'
        list ra_flags 'none'

config dhcp 'kamery'
        option interface 'kamery'
        option start '100'
        option limit '10'
        option leasetime '2m'
        option force '1'
        list ra_flags 'none'

config host
        option mac 'XXXXXXXXXX'
        option ip '192.168.1.105'

config dhcp 'server'
        option interface 'server'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list ra_flags 'none'

config host
        option name 'BraboAP'
        option dns '1'
        option mac 'XXXXXXX'
        option ip '192.168.1.100'

config host
        option mac 'XXXXXXXX'
        option ip '192.168.44.102'
        option name 'Xiaomi-Ventilator'
        option dns '1'

config host
        option mac 'XXXXXXX'
        option dns '1'
        option ip '192.168.44.101'
        option name 'Xiomi-Vysavac'

config host
        option mac 'XXXXXXXX'
        option ip '192.168.44.2'
        option name 'Kotelna'
        option dns '1'

config host
        option name 'Slepice'
        option mac 'XXXXXX'
        option ip '192.168.44.3'


config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config zone
        option name 'guest'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'
        option input 'REJECT'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option src 'guest'
        option dest_port '53 67 68'
        option target 'ACCEPT'
        option name 'DHCP GUEST'

config rule
        option name 'DHCP LAN '
        option src 'lan'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config zone
        option name 'iot'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'
        option input 'REJECT'
        option masq '1'

config rule
        option name 'DHCP IOT'
        option src 'iot'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config zone
        option name 'server'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'server'
        option input 'REJECT'
        option masq '1'

config zone
        option name 'kamery'
        option output 'ACCEPT'
        list network 'kamery'
        option forward 'ACCEPT'
        option mtu_fix '1'
        option masq '1'
        option input 'REJECT'

config rule
        option name 'DHCP Kamery'
        option src 'kamery'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option masq '1'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'vpnwg'

config forwarding
        option src 'vpn'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'vpn'

config forwarding
        option src 'vpn'
        option dest 'kamery'

config forwarding
        option src 'lan'
        option dest 'kamery'

config rule
        option src 'lan'
        option dest 'server'
        option target 'ACCEPT'
        list proto 'all'
        list src_mac 'XXXXXX'

config forwarding
        option src 'server'
        option dest 'wan'

config forwarding
        option src 'server'
        option dest 'lan'

config rule
        option name 'Tf '
        option src '*'
        list src_mac 'XXXXXXX'
        option dest 'server'
        option target 'ACCEPT'

config rule
        option name 'Server DHCP'
        option src 'server'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config rule
        option name 'Printer_allow'
        option src 'lan'
        option dest 'server'
        option dest_port '631'
        option target 'ACCEPT'
        list dest_ip '192.168.2.109'

config rule
        option name 'Samba_Allow'
        option src 'lan'
        option dest 'server'
        option dest_port '137 138 139 445'
        option target 'ACCEPT'
        list dest_ip '192.168.2.109'

config rule
        option name 'Ping_Srv'
        list proto 'icmp'
        option src 'iot'
        option dest 'server'
        option target 'ACCEPT'

config rule
        option name 'test-VPN-ping'
        list proto 'icmp'
        option src 'vpn'
        option dest 'lan'
        option target 'ACCEPT'

config rule
        option name 'Admin Přístup do IOT '
        option src '*'
        list src_mac 'XXXXXXX'
        option dest 'iot'
        option target 'ACCEPT'

config rule
        option name 'Xiaomi '
        option src 'iot'
        list src_ip '192.168.44.102'
        option src_port '54321'
        option dest 'wan'
        option target 'ACCEPT'

config rule
        option name 'Xiaomi '
        option src 'iot'
        list src_ip '192.168.44.101'
        option dest 'wan'
        option target 'ACCEPT'

config rule
        option name 'Server Kamery'
        option src 'server'
        list src_ip '192.168.2.109'
        option dest 'kamery'
        option dest_port '80'
        option target 'ACCEPT'

config forwarding
        option src 'server'
        option dest 'kamery'

config forwarding
        option src 'lan'
        option dest 'iot'

config forwarding
        option src 'server'
        option dest 'iot'

config forwarding
        option src 'iot'
        option dest 'server'

config forwarding
        option src 'vpn'
        option dest 'lan'

config redirect
        option target 'DNAT'
        option src 'vpn'
        option src_dport '8123'
        option dest 'server'
        option dest_ip '192.168.2.109'
        option dest_port '8123'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        list proto 'udp'
        list proto 'icmp'
        option src 'vpn'
        option src_dport '1-8888'
        option dest 'server'

config rule
        option src 'vpn'
        option dest 'server'
        option target 'ACCEPT'

config forwarding
        option src 'vpn'
        option dest 'server'

Can you give examples? For example, 192.168.44.15 can see 192.168.44.23, both wireless. (obviously that's just an example, but it would be helpful to understand the source and destination of the connection requests).

Yes for example my phone IP 192.168.44.99 and i use app PingTools scan local-area Network and see all wifi device 192.168.44.103, 192.168.44.101, 192.168.44.2 - Tasmota device and when i try connect to website of tasmota device is it posible.

are all of these devices connected to the same radio (i.e. the 2.4 or the 5G radio)? what happens if you disable one of the radios for that SSID (thus guaranteeing that they are all on a single radio)?

Yes they is on same radio a try to disable 5ghz and it same

do you have multiple APs, or is this the only one?

I'm not sure if this could affect it, but turn off masquerading on the IoT network. Masquerading is typically only used on the firewall zone that contains the upstream network and is not necessary on the zones for the local networks.

Yes i have second AP for garden.
Ok I try turn off masquerade.
I'm at work now, as soon as I get home I'll send another AP config and try to turn off masquerade.
Do you think it was by problem of masquerade?
I haven't tested turning off the second Ap as soon as I get home I'll try to turn off the whole other device.

I don't really think so, but masquerade should only be enabled on the zones related to an upstream network... so typically, it is only enabled on the wan zone, or in a 'dumb AP with guest wifi' environment, it would be enabled on the lan zone which is the effective upstream for the device. So it should be disabled and may potentially have an impact.

This is what I think the real issue might be. Wifi isolation only works for wireless clients connected to the same AP and SSID.

So, for example:

  • with 4 client devices (A-D), and 2 APs (1-2), isolation enabled both APs
  • if you have client A and client B connected to AP #1
  • and clients C and D connected to AP #2

--> you would find that A and B would be unable to connect to each other, but they could both connected to C and D.
--> similarly, C and D would be unable to communicate with each other, but they could reach A and B.

So to properly exercise the isolation, you need to have only a single AP.

OK, I'll turn off masquerade, it's my fault, I thought it had a different function.

is it really possible that this is the root cause of the problems that I am connected to a different AP than the device, in any case, is it possible to treat this with the help of a firewall?

Yes, it is possible. But until you run the experiment (or verify the relative connections of each device to each AP), it isn't yet guaranteed. We haven't ruled out a problem with the isolation feature, but we also haven't gotten to a point where we can attribute the problem to a bug there. I suspect that it is a function of the different APs, though -- isolation only works on the same AP... another AP will make the wifi clients connected to it appear effectively as wired connections to the network from the perspective of the first AP.

No/maybe.

The firewall generally works at L3 (routing) and this traffic is actually running at L2 (switching). But there is something called a bridge firewall0 which may be able to help, but it has limitations.

now I came home and tried to turn off the second AP after connecting I could not see any devices, after disconnecting from the network and reconnecting I could see and communicate with all devices again? (the second AP was still off) then I connected to Luci (I didn't change or set anything) then I connected to the Iot network and I can't see any device or communicate with another one (I tried disconnecting and connecting several times) it seems that you had the truth and the whole problem is in two APs. I understand correctly that it is not easy to prevent communication between devices connected to different APs and I will have to accept that

You could try the bridge firewall technique, but I'm not sure how well it will work. I've never done it myself. But yes, wifi client isolation only works locally per AP.

Meanwhile, although not completely solved, I do think we have identified the root cause of your inter-device communications in this context, and that we have determined that it is expected behavior.

With that in mind...

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

Ok thanks for your help in finding the cause of my problem.
I appreciate it and will try to study the bridge firewall technique and see if I can get it working.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.