I use Ubuntu + isc dhcp server + iptables to control my local network and I use Ubiquiti Rocket M2 wireless access points. The APs only serve for the client to connect. Nothing else. Client administration is in charge of the server.
Problem: I have activated the "client isolation" option in the APs, to prevent clients from sharing things (folders, other resources, etc.). But this is affecting since customers cannot print on Wi-Fi printers (with static IP) within the local network.
Important: I have not seen any options within panel Rocket M2 APs that allow excluding (white list) IP addresses (to exclude IPs from printers). and in Manual AirOS6, say: "Client Isolation (Available in Access Point or AP‑Repeater mode only.) Allows packets to be sent only from the external network to the CPE and vice versa. If client isolation is enabled, wireless stations connected to the same AP will not be able to interconnect on both the Layer 2 (MAC) and Layer 3 (IP) levels. This also affects associated stations and WDS peers as well", but says nothing about "whitelist".
What alternative do you suggest?
PD: I don't know if this can be done with iptables instead APs
PD: none of these rules work:
printers.txt included all my WiFi printers IP and enp2s0 my LAN card
192.168.1.11
192.168.1.12
Iptables rules:
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
for ip in `cat printers.txt`; do
iptables -t nat -I PREROUTING -i enp2s0 -j ACCEPT
iptables -t mangle -I PREROUTING -i enp2s0 -j ACCEPT
iptables -I INPUT -i enp2s0 -j ACCEPT
iptables -I FORWARD -i enp2s0 -j ACCEPT
done
with client isolation activated (Ubiquiti Rocket M2 images) with last firmware update (XM.v6.2.0):