0

I would like to create a firewall rule which prevents users in the LAN to communicate directly with other users. In other words, deny access from any LAN address to all other LAN addresses. Is this possible to achieve? The router is DIR-815.

2 Answers 2

1

I think it's possible, but you'll need to install dd-wrt so you can edit the routing table to put in purposefully-broken routes for your local subnet. It's also depends on how the ports on the router are set up. If the LAN ports are just a dumb hub, then every transmission is seen by every client and there will be nothing you can do to stop this. You're hoping for real switched ports.

1
  • Wouldn't that affect only IP packets? Windows can still use NetBEUI afaik. You'd need to block at the Ethernet (MAC) level.
    – MSalters
    Mar 28, 2011 at 15:29
0

Using the stock firmware, you cannot have more than one subnet on the device, so there is no way to do what you need if all your devices connect to the router using ethernet. If, however, you want to separate the wireless traffic from the ethernet traffic, you can do so by implementing the Guest Wifi network in the router's configuration. See documentation.

If, as Joel said, you install a custom firmware, you may be able to use more than one subnet, effectively partitioning your LAN into separate virtual LANs (commonly referred to as vLANs). Computers on separate vLANs are unable to see each other, while they remain able to communicate with those devices sharing their vLAN and are able to connect to the Internet if it is available to the router.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .