1

I use Ubuntu + isc dhcp server + iptables to control my local network and I use Ubiquiti Rocket M2 wireless access points. The APs only serve for the client to connect. Nothing else. Client administration is in charge of the server.

Problem: I have activated the "client isolation" option in the APs, to prevent clients from sharing things (folders, other resources, etc.). But this is affecting since customers cannot print on Wi-Fi printers (with static IP) within the local network.

Important: I have not seen any options within panel Rocket M2 APs that allow excluding (white list) IP addresses (to exclude IPs from printers). and in Manual AirOS6, say: "Client Isolation (Available in Access Point or AP‑Repeater mode only.) Allows packets to be sent only from the external network to the CPE and vice versa. If client isolation is enabled, wireless stations connected to the same AP will not be able to interconnect on both the Layer 2 (MAC) and Layer 3 (IP) levels. This also affects associated stations and WDS peers as well", but says nothing about "whitelist".

What alternative do you suggest?

PD: I don't know if this can be done with iptables instead APs

PD: none of these rules work:

printers.txt included all my WiFi printers IP and enp2s0 my LAN card

192.168.1.11
192.168.1.12

Iptables rules:

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

for ip in `cat printers.txt`; do
  iptables -t nat -I PREROUTING -i enp2s0 -j ACCEPT
  iptables -t mangle -I PREROUTING -i enp2s0 -j ACCEPT
  iptables -I INPUT -i enp2s0 -j ACCEPT
  iptables -I FORWARD -i enp2s0 -j ACCEPT
done

with client isolation activated (Ubiquiti Rocket M2 images) with last firmware update (XM.v6.2.0):

enter image description here

enter image description here

enter image description here

enter image description here

2
  • Have you tried iptables -A -s 192.168.0.1 -j ACCEPT where 192.168.0.1 is the IP of the printer? This rule will need to be placed near the top of the rules so it isn't overridden by another rule.
    – cybernard
    Nov 19, 2019 at 17:29
  • none of this works: iptables -t mangle -A PREROUTING -s 192.168.0.1 -j ACCEPT or iptables -t nat -A PREROUTING -s 192.168.0.1 -j ACCEPT or iptables -A INPUT -s 192.168.0.1 -j ACCEPT or iptables -A FORWARD -s 192.168.0.1 -j ACCEPT
    – acgbox
    Nov 19, 2019 at 18:04

1 Answer 1

1

You probably can't do it the isolation on the "router" instead, as hosts in the same subnet isn't normally supposed to be communicate via a router (more precisely, a gateway) (but "directly" on layer 2 by finding out the destination MAC with ARP, i.e. through switching but not routing). So to achieve what you want, you either need a more advanced switch (AP), or force routing (and leave client isolation enabled).

With that said, to force routing within a (W)LAN is quite a nasty thing to do (and could be a bit hard to deploy), also it may not work for certain stuff.

To force routing, you need to either:

  1. assign an address to each of the clients with a /32 prefix (or subnet mask of 255.255.255.255), with the "router" address as the peer. Basically that means to set up a point-to-point link to the "router" and eliminate the idea of subnet/LAN on the IP level. Now your default route wouldn't explicitly have the router as gateway, for the record. This approach is probably the "proper way".
  2. Remove the subnet route (or add host route for each other with the router as gateway) on each of the clients (which is normally added by the OS automatically), add a host route to the "router" if that hasn't been done.

Either of those would cause the clients to reach each other with the default route via the "router", which means you can then limit access with iptables.

10
  • Your proposal is complex. Break the structure of the local network
    – acgbox
    Nov 20, 2019 at 15:05
  • Well, get a(n even) better AP? Or get another AP for the devices that are shared by the clients (so that they become "remote" hosts in another subnet/(W)LAN to the clients, which forces routing and allows you to limit access with iptables as well).
    – Tom Yan
    Nov 20, 2019 at 15:28
  • Is there any iptables rule that "emulates" the "client isolation"? (I ask not to have to use the client isolation option in the AP but in iptables)
    – acgbox
    Nov 20, 2019 at 15:53
  • You are still not getting the point. Once you disabled client isolation on the AP, the clients can communicate with each others without ever getting through the "router" (your Ubuntu machine whatsoever, that is), so the only way to achieve what you want is to enable client isolation and force the clients to communicate with each other via the router, only then iptables matters.
    – Tom Yan
    Nov 20, 2019 at 15:59
  • I get it. Iptables is irrelevant if "client isolation" is disabled on AP.
    – acgbox
    Nov 20, 2019 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .