I am worried that there is not really a benefit of doing that, just more noise and energy consumption.

  • BearOfaTime@lemm.ee
    link
    fedilink
    English
    arrow-up
    6
    arrow-down
    1
    ·
    8 months ago

    Guest devices can’t communicate with other guest devices

    How do you accomplish this isolation since they’re on the same subnet/broadcast domain? Is it a feature of the hardware you’re using?

    • dan@upvote.au
      link
      fedilink
      English
      arrow-up
      9
      ·
      8 months ago

      A lot of access points, even consumer-grade ones, have this option. It’s usually accomplished via predefined firewall rules on the access points themselves.

      Consumer-grade access points usually let you have just one isolated guest network, whereas fancier ones (Omada, Unifi, Ruckus, Aruba, etc) usually let you enable isolation for any SSID (ie the “guest network” is no different from any other SSID)

      • BearOfaTime@lemm.ee
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        edit-2
        8 months ago

        Isolated guest networks I get, but isolating guests from other guests on the same subnet/isolated net is what I haven’t seen.

        • conorab@lemmy.conorab.com
          link
          fedilink
          English
          arrow-up
          2
          ·
          8 months ago

          The APs know who the Wi-Fi clients are and just drops traffic between them. This is called client/station isolation. It’s often used in corporate to 1) prevent wireless clients from attacking each other (students, guests) and 2) to prevent broadcast and multicast packets from wasting all your airtime. This has the downside of breaking AirPlay, AirPrint and any other services where devices are expected to talk to each other.

        • jemikwa@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          2
          ·
          8 months ago

          If there’s an option on the AP to not permit link local routing within a vlan/ssid, that will force all traffic up to the firewall. Then you can block intrazone traffic at the firewall level for that vlan.
          I’ve seen this in Meraki hardware where it’s referred to as “client isolation”. Ubiquiti might be able to do this too.

        • dan@upvote.au
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          I used to have a Netgear Nighthawk router/AP I bought from Costco, and if I remember correctly, its guest network automatically isolated guests from other guests. This router didn’t support VLANs so I think it was just a bunch of firewall rules.

      • BearOfaTime@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        8 months ago

        I’m not seeing anything there that says guests can’t see other guests - quite the opposite.

        guests connected to your Hotspot Portal will be isolated from all other networks except the one they are assigned to.

        Guests on this network are able to access the internet, and communicate with the UniFi gateway to obtain a DHCP lease and resolve names using DNS

        I suppose a switch could be configured to prevent traffic going to other ports, which is how I would assume this would have to be done. This functionality would have to exist in the access point, I guess?

        Does UniFi have a feature to isolate devices from each other on the same subnet? Seems like it would require some kind of Layer 2 routing?