I'm still learning, so maybe it's a stupid question. I have created an access point (is it correct to call it router?) on my laptop on linux. I connected two devices (further I call it clients) to that access point and made sure they can access each other (ping, request to a web server on another device's host). The subnet would be, where is the laptop (the access point), is the first device and is the second device. Then I blocked all packets on the laptop via iptables (DROP on INPUT, OUTPUT, FORWARD) and expected that the clients could not access each other anymore, but the clients still could access each other. Does that mean that after getting an IP address from the DHCP server on the router the clients doesn't need the router anymore and they connect to other clients directly? Is it possible to block the clients from communicating with each other, so the clients could access only the router (the laptop in my case)? I want to clarify that I'm not asking about setting a firewall on any of the clients, but only having access to the router.

  • It is easiest to let devices block what they don’t want. Much easier.
    – John
    Sep 18, 2022 at 1:46
  • @John, yeah I know, but what if the clients are not controlled by me? I'm just curious if it's even possible to control access between clients having access only to the access point
    – g00dds
    Sep 18, 2022 at 1:52

1 Answer 1


802.11 WNICs in AP mode automatically forward frames to other wireless clients based on the destination MAC address. Relayed wireless-to-wireless frames don't necessarily even get passed up from the AP-mode WNIC to the host system, so the host system's network stack doesn't get a chance to act on them (maybe not even see them).

Some AP-mode-capable WNIC chipsets / drivers may have a "client isolation" mode that disables that automatic intra-BSS (wireless to wireless) relay behavior. You'll need to research if your WNIC/driver supports that.

If your WNIC supports it and you're using hostapd to control AP mode, you can add ap_isolate=1 to your hostapd.conf to enable this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .