Yet another guest wifi problem

[vgaetera]

@mox74345346

Guest devices cannot see my lan zone, which is desired.

Network discovery typically relies on multicast traffic which scope is limited.
However, according to your current settings, accessing LAN hosts by IP should be possible.

@mox74345346

Guests can see each other right now. What do I need to change to isolate them?

https://openwrt.org/docs/guide-user/network/wifi/guestwifi/extras#isolating_clients

[mox74345346]

@vgaetera

@mox74345346

Guest devices cannot see my lan zone, which is desired.

Network discovery typically relies on multicast traffic which is limited to a specific subnet.
However, you should be able to access LAN hosts by IP.

Maybe I was unclear. Of course guest devices shall not see my LAN devices. It is a guest network .

When connected to my guest wifi, Fing does see only other guests, no hosts on the LAN. Will confirm by explicitly pinging one.

[mox74345346]

When connected to my guest wifi, Fing does see only other guests, no hosts on the LAN. Will confirm by explicitly pinging one.

Indeed, knowing the address, it is possible to access a host on my LAN. So I guesst what I said above is true, that I need to define firewall rules to block guest access to hosts on 192.168.234.*.

[vgaetera]

uci set firewall.@forwarding[0].enabled="0"
uci -q delete firewall.guest_fwd
uci set firewall.guest_fwd="rule"
uci set firewall.guest_fwd.name="Allow-Guest-Forward"
uci set firewall.guest_fwd.src="guest"
uci set firewall.guest_fwd.dest="lan"
uci set firewall.guest_fwd.dest_ip="!192.168.234.0/24"
uci set firewall.guest_fwd.proto="all"
uci set firewall.guest_fwd.target="ACCEPT"
uci commit firewall
/etc/init.d/firewall restart

[mox74345346]

Thanks @vgaetera ! Guest wifi is working as expected. Will check the client-isolation on the weekend.

[mox74345346]

Isolating clients was trivial using the 3 lines Vladislav had referred to. For interested folks with the same issue, look at all posts above I marked as solution. All of these combined did the trick.

Big thanks a lot to @vgaetera and @mk24 , guest wifi is how I wanted now.

[dlakelan]

@mox74345346

all posts above I marked as solution. All of these combined did the trick.

You can only mark one post as solution, it just changes which one is marked when you click a different post

[mox74345346]

@dlakelan

You can only mark one post as solution, it just changes which one is marked when you click a different post

Thanks for the info

I have now just marked the first in the series of additions by Vladislav.
Interested readers need to start looking there and follow the advice from there.