I have an IoT network, connections from it to LAN are disallowed, but LAN to it are allowed. Also has mDNS repeater.
Also a guest network that is isolated.
Problem is, I'd like to have client isolation, and I tried using Isolate Clients and Isolate Bridge Port, but this only works as far as the AP is concerned. I have 3 APs, and the problem is, a client from let's say upstairs, can access clients on the downstairs and vice versa, because that option doesn't isolate other clients that aren't connected directly to the AP.
Is there a way to do it with firewall rules on the main router, or would that not be enough?
I think so, did some google and you might need package kmod-br-netfilter and some other sysctl commands
Then a rule to drop anything inputting from the iot bridge with a destination on the same network, except the routers'
A normal router firewall rule only helps if that client-to-client traffic actually crosses the router. If the APs are bridged into the same VLAN through a switch, clients on different APs can still talk at layer 2 before the IP firewall sees it. For real isolation across APs, I’d either use switch/bridge port isolation (or nft/ebtables bridge filtering on the central bridge if all AP traffic passes there), or put each AP’s guest/IoT SSID in separate VLANs and reject forwarding between those zones. The per-AP isolate checkbox is usually only half of the story.
You can't stop clients that are on the same physical network from communicating with each other directly, but yeah anything that goes via a router can be filtered. That said there is somewhat of a solution for layer3 (IP) traffic where you could just find some way to only give out peer to peer (/32) ips via dhcp or something that way even devices that could connect directly to each other will be configured to only talk to the router.