Hi,
I am already very frustrated with this situation.
I have 3 wifi SSIDs each on their specific VLAN.
SSID MY_HOME_LAN is fine, I don't need any specific restrictions
SSID MY_HOME_GUEST I only want access to the Internet without the ability to see other devices on the network or access the router settings. but when I check the wifi isolated client settings, nothing happens, normally I can see other devices on the network and I can communicate with them, why? I tried adding the option isolate '1' entry to /etc/config/network but to no avail.
3: SSID MY_HOME_IOT Network without internet communication only to another network to a specific ip address and server port without the possibility to see or communicate with other devices in the network. Again, even if I check the item in the wifi isloted client settings, nothing happens, after connecting to the network, I can see all the devices and can communicate with them.
What am I doing wrong, what do I need to set differently?
Linksys WRT1900AC Router v2
OpenWrt 21.02.3
AP TP-Link TL-WR840N v6.2
OpenWrt SNAPSHOT r14731
Isolate is a WiFi-WiFi client isolation (on the same ssid) only. It does not prevent a client from connecting to a different network or to a wired client on the same network. You need the firewall to block inter-network routing.
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Yes, I only want to isolate wifi clients so that they cannot see and communicate with each other. I don't have any wired connections in the necessary networks. and I can block the rest of the rules with a firewall. But if I set the isolate client option, after being connected to the mentioned networks, I am still able to see other wifi devices and communicate with them normally.
So what am I doing wrong?
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'XXXXXXXXX'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option device 'br-lan.1'
option ipaddr '192.168.1.1'
config device
option name 'wan'
option macaddr 'XXXXXXXXX'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan1:t'
list ports 'lan2:u*'
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'lan1:t'
list ports 'lan3'
config bridge-vlan
option device 'br-lan'
option vlan '3'
list ports 'lan1:t'
list ports 'lan4'
config bridge-vlan
option device 'br-lan'
option vlan '44'
list ports 'lan1:t'
config bridge-vlan
option device 'br-lan'
option vlan '55'
list ports 'lan1:t'
config interface 'guest'
option proto 'static'
option device 'br-lan.55'
option ipaddr '192.168.55.1'
option netmask '255.255.255.0'
option ap_isolation '1'
config interface 'iot'
option proto 'static'
option device 'br-lan.44'
option ipaddr '192.168.44.1'
option netmask '255.255.255.0'
option ap_isolation '1'
config interface 'server'
option proto 'static'
option device 'br-lan.2'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
config interface 'kamery'
option proto 'static'
option device 'br-lan.3'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
option ap_isolation '1'
config interface 'vpnwg'
option proto 'wireguard'
option private_key 'XXXXXXXXX'
option listen_port '41194'
list addresses '192.168.6.5/32'
config wireguard_vpnwg
option public_key 'xxxxxxxxxxxxx'
option endpoint_host 'XXXXXXXX'
option endpoint_port '41194'
option description 'server'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
list allowed_ips '192.168.6.0/24'
Can you give examples? For example, 192.168.44.15 can see 192.168.44.23, both wireless. (obviously that's just an example, but it would be helpful to understand the source and destination of the connection requests).
Yes for example my phone IP 192.168.44.99 and i use app PingTools scan local-area Network and see all wifi device 192.168.44.103, 192.168.44.101, 192.168.44.2 - Tasmota device and when i try connect to website of tasmota device is it posible.
are all of these devices connected to the same radio (i.e. the 2.4 or the 5G radio)? what happens if you disable one of the radios for that SSID (thus guaranteeing that they are all on a single radio)?
I'm not sure if this could affect it, but turn off masquerading on the IoT network. Masquerading is typically only used on the firewall zone that contains the upstream network and is not necessary on the zones for the local networks.
Yes i have second AP for garden.
Ok I try turn off masquerade.
I'm at work now, as soon as I get home I'll send another AP config and try to turn off masquerade.
Do you think it was by problem of masquerade?
I haven't tested turning off the second Ap as soon as I get home I'll try to turn off the whole other device.
I don't really think so, but masquerade should only be enabled on the zones related to an upstream network... so typically, it is only enabled on the wan zone, or in a 'dumb AP with guest wifi' environment, it would be enabled on the lan zone which is the effective upstream for the device. So it should be disabled and may potentially have an impact.
This is what I think the real issue might be. Wifi isolation only works for wireless clients connected to the same AP and SSID.
So, for example:
with 4 client devices (A-D), and 2 APs (1-2), isolation enabled both APs
if you have client A and client B connected to AP #1
and clients C and D connected to AP #2
--> you would find that A and B would be unable to connect to each other, but they could both connected to C and D.
--> similarly, C and D would be unable to communicate with each other, but they could reach A and B.
So to properly exercise the isolation, you need to have only a single AP.
OK, I'll turn off masquerade, it's my fault, I thought it had a different function.
is it really possible that this is the root cause of the problems that I am connected to a different AP than the device, in any case, is it possible to treat this with the help of a firewall?
Yes, it is possible. But until you run the experiment (or verify the relative connections of each device to each AP), it isn't yet guaranteed. We haven't ruled out a problem with the isolation feature, but we also haven't gotten to a point where we can attribute the problem to a bug there. I suspect that it is a function of the different APs, though -- isolation only works on the same AP... another AP will make the wifi clients connected to it appear effectively as wired connections to the network from the perspective of the first AP.
No/maybe.
The firewall generally works at L3 (routing) and this traffic is actually running at L2 (switching). But there is something called a bridge firewall0 which may be able to help, but it has limitations.
now I came home and tried to turn off the second AP after connecting I could not see any devices, after disconnecting from the network and reconnecting I could see and communicate with all devices again? (the second AP was still off) then I connected to Luci (I didn't change or set anything) then I connected to the Iot network and I can't see any device or communicate with another one (I tried disconnecting and connecting several times) it seems that you had the truth and the whole problem is in two APs. I understand correctly that it is not easy to prevent communication between devices connected to different APs and I will have to accept that
You could try the bridge firewall technique, but I'm not sure how well it will work. I've never done it myself. But yes, wifi client isolation only works locally per AP.
Meanwhile, although not completely solved, I do think we have identified the root cause of your inter-device communications in this context, and that we have determined that it is expected behavior.
With that in mind...
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Ok thanks for your help in finding the cause of my problem.
I appreciate it and will try to study the bridge firewall technique and see if I can get it working.