cnPilot guest wifi isolation

[zoltanjuhasz (Zoltán Juhász)]

Hi!

Is it possible to set Layer 2 isolation in AP?
Do connected clients not discover each other with software like Fing or Wifiman?
For other products it is possible to disable MAC forwarding, for Ruckus MAC whitelist, for Mikrotik disable default forwarding, or for Zyxel enable layer 2 isolation.

Thank you!

[maxwire]

There is isolation in cnpilot home
You can do pretty much anything you want in cnpilot enterprise

[zoltanjuhasz (Zoltán Juhász)]

Can you show me how I can do this setup?
I would be grateful

[DaveClelland]

Its called Client isolation in the WLAN. Disable means that clients can learn each other, Enable means that clients can only see the default gateway, so no client to client communications in the Wifi network.

[zoltanjuhasz (Zoltán Juhász)]

I have made this setting, here is my config:

The guest vlan works perfectly, they only reach what I allow on the network, ping does not work between them.
But the discovery software (mobile app) Wifiman and Fing can see other clients on the network.

Discovery works

Ping doesnt work.

[DaveClelland]

That is what you should expect. The way wifi works is that every client and AP need to see each other so that the contention mechanism works…otherwise, RF collisions would hurt capacity. But not being able to communicate between clients is expected.

[zoltanjuhasz (Zoltán Juhász)]

Mikrotik simple wifi settings, ping and device discover works:

If I uncheked the Default Forward, ping and device discover not working annymore.

It shows the discovery app I’m alone, but that’s not true.
The question is, is it possible with the cnPilot AP?

[CAM_TSK]

@zoltanjuhasz

If neighbor device discovery mechanism is either using Multicast or broadcast packets, yes you will still see the neighbors but you cannot pass any traffic between clients.

However, with client isolation enabled, do enable drop multicast and this will help reduce neighbour devices. Please follow steps below:

Isolating devices Casting devices (Chromecast / Apple TV / Android TV Box) on the WLAN

Scenario: In Hotel / School Environment Guests connect Multiple Apple TVs, Chromecast, Android TV Box to the WLAN. This will make network vulnerable where anyone can cast screens / videos / pictures to any casting devices. Protocol used by Casting devices is Multicast DNS (mDNS) to discover and cast from the client devices. Procedure:  Configure the WLAN as follows: Enable Network Wide client isolation >> Client Isolation : Network Wide Static Add Gateway MAC and DHCP server MAC to the clien…

[zoltanjuhasz (Zoltán Juhász)]

Thank you for your efforts, it seems we are on the right track, but it did not bring the desired result.

Here is the Zyxel solution:

Zyxel Knowledge Base Article: How to isolate guest wifi from accessing main resource on NAP series?

It is working very well.
Found an older post by firefly from Cambium.

Installation best practice: use ACLs to filter unneeded multicast and broadcast

Broadcast and Multicast packets are transmitted typically at slower data rates that take up more airtime. They are also typically buffered up on the AP for clients that are in a power-save sleep mode, and transmitted only at DTIM (periodic beacon intervals), which can cause issues related to queuing. While many broadcast and multicast packets are important for normal network operation as well as specific applications on the client (video streaming etc), depending on your network and application…

I think this is the solution:

Rule	Description
acl deny mac 17 any ff:ff:ff:ff:ff:ff out	deny L2 broadcast packets going on air
acl permit mac 24 any any any	allow all other packets in both the directions

but something is missing, because this rule blocks communication between clients, but it also blocks the Internet connection.

Where did I make a mistake with the setting?

[CAM_TSK]

Please apply below rules in WLAN profile in addition to Client Isolation and Drop multicast:

Rule	Description
acl permit proto 5 tcp any any any any any	Allow all TCP connections in both the direction
acl permit proto 6 udp any 68 and 67 in	Allow incoming DHCP discover packets
acl permit proto 7 udp any 67 any any out	Allow DHCP offer packet in WLAN out bound direction
acl deny proto 8 udp any 137 any any any	Block Windows NetBios packets in both the direction
acl deny proto 9 udp any 138 any any any	Block Windows NetBios packets in both the direction
acl deny ip 10 any 224.0.0.0/240.0.0.0 in	Block all incoming multicast packets
acl deny proto 11 udp any 68 any 67 out	Block DHCP Discover going on air
acl deny mac 12 any 11:11:11:11:11:11 out	Block Cambium AP Multicast packet going on air
acl deny mac 13 any ff:ff:ff:ff:ff:ff out	Block ARP packets going on air
acl permit ip 14 any any any	Allow all other IP packets in both the direction

[zoltanjuhasz (Zoltán Juhász)]

Thanks for the help!

Now it works as I want, the discovery software shows that I am alone.
I analysed the traffic with the wire shark and disabling the broadcast packets solved the problem.
It works perfectly with the correct ACL rules.