I use ubuntu + isc dhcp server + iptables to control my local network and I use ubiquiti rocket m2 wireless access points. The APs only serve for the client to connect. Nothing else. Client administration is in charge of the server.

Problem: I have activated the "client isolation" option in the APs, to prevent clients from sharing things (folders, other resources, etc.). But this is affecting, since customers cannot print on Wi-Fi printers (with static IP) within the local network.

Important: I have not seen any options within panel rocket m2 APs that allow to exclude (white list) ips addresses (to exclude IPs from printers). and in Manual AirOS6, say: "Client Isolation (Available in Access Point or AP‑Repeater mode only.) Allows packets to be sent only from the external network to the CPE and vice versa. If Client Isolation is enabled, wireless stations connected to the same AP will not be able to interconnect on both the Layer 2 (MAC) and Layer 3 (IP) levels. This also affects associated stations and WDS peers as well", but says nothing about "white list"

What alternative do you suggest?

PD: I don't know if this can be done with iptables instead APs

PD: none of this rules work:

printers.txt included all my wifi printers ip and enp2s0 my LAN card

Iptables rules:

iptables -P INPUT ACCEPT

for ip in `cat printers.txt`; do
  iptables -t nat -I PREROUTING -i enp2s0 -j ACCEPT
  iptables -t mangle -I PREROUTING -i enp2s0 -j ACCEPT
  iptables -I INPUT -i enp2s0 -j ACCEPT
  iptables -I FORWARD -i enp2s0 -j ACCEPT

with client isolation activated (Ubiquiti Rocket M2 images) with last firmware update (XM.v6.2.0):

enter image description here

enter image description here

enter image description here

enter image description here

Thanks in advanced

  • Have you tried iptables -A -s -j ACCEPT where is the IP of the printer? This rule will need to be placed near the top of the rules so it isn't overridden by another rule. – cybernard Nov 19 '19 at 17:29
  • none of this works: iptables -t mangle -A PREROUTING -s -j ACCEPT or iptables -t nat -A PREROUTING -s -j ACCEPT or iptables -A INPUT -s -j ACCEPT or iptables -A FORWARD -s -j ACCEPT – ajcg Nov 19 '19 at 18:04

You probably can't do it the isolation on the "router" instead, as hosts in the same subnet isn't normally supposed to be communicate via a router (more precisely, a gateway) (but "directly" on layer 2 by finding out the destination MAC with ARP, i.e. through switching but not routing). So to achieve what you want, you either need a more advanced switch (AP), or force routing (and leave client isolation enabled).

With that said, to force routing within a (W)LAN is quite a nasty thing to do (and could be a bit hard to deploy), also it may not work for certain stuff.

To force routing, you need to either:

  1. assign an address to each of the clients with a /32 prefix (or subnet mask of, with the "router" address as the peer. Basically that means to set up a point-to-point link to the "router" and eliminate the idea of subnet/LAN on the IP level. Now your default route wouldn't explicitly have the router as gateway, for the record. This approach is probably the "proper way".
  2. Remove the subnet route (or add host route for each other with the router as gateway) on each of the clients (which is normally added by the OS automatically), add a host route to the "router" if that hasn't been done.

Either of those would cause the clients to reach each other with the default route via the "router", which means you can then limit access with iptables.

  • Your proposal is complex. Break the structure of the local network – ajcg Nov 20 '19 at 15:05
  • Well, get a(n even) better AP? Or get another AP for the devices that are shared by the clients (so that they become "remote" hosts in another subnet/(W)LAN to the clients, which forces routing and allows you to limit access with iptables as well). – Tom Yan Nov 20 '19 at 15:28
  • Is there any iptables rule that "emulates" the "client isolation"? (I ask not to have to use the client isolation option in the AP but in iptables) – ajcg Nov 20 '19 at 15:53
  • You are still not getting the point. Once you disabled client isolation on the AP, the clients can communicate with each others without ever getting through the "router" (your Ubuntu machine whatsoever, that is), so the only way to achieve what you want is to enable client isolation and force the clients to communicate with each other via the router, only then iptables matters. – Tom Yan Nov 20 '19 at 15:59
  • I get it. Iptables is irrelevant if "client isolation" is disabled on AP. – ajcg Nov 20 '19 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.