69
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 04 Mar 2024
69 points (94.8% liked)
Selfhosted
39677 readers
440 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
How do you accomplish this isolation since they're on the same subnet/broadcast domain? Is it a feature of the hardware you're using?
A lot of access points, even consumer-grade ones, have this option. It's usually accomplished via predefined firewall rules on the access points themselves.
Consumer-grade access points usually let you have just one isolated guest network, whereas fancier ones (Omada, Unifi, Ruckus, Aruba, etc) usually let you enable isolation for any SSID (ie the "guest network" is no different from any other SSID)
Isolated guest networks I get, but isolating guests from other guests on the same subnet/isolated net is what I haven't seen.
If there's an option on the AP to not permit link local routing within a vlan/ssid, that will force all traffic up to the firewall. Then you can block intrazone traffic at the firewall level for that vlan.
I've seen this in Meraki hardware where it's referred to as "client isolation". Ubiquiti might be able to do this too.
The APs know who the Wi-Fi clients are and just drops traffic between them. This is called client/station isolation. It’s often used in corporate to 1) prevent wireless clients from attacking each other (students, guests) and 2) to prevent broadcast and multicast packets from wasting all your airtime. This has the downside of breaking AirPlay, AirPrint and any other services where devices are expected to talk to each other.
I used to have a Netgear Nighthawk router/AP I bought from Costco, and if I remember correctly, its guest network automatically isolated guests from other guests. This router didn't support VLANs so I think it was just a bunch of firewall rules.
For Unifi devices you setup a Virtual Network then assign the guests to that. https://help.ui.com/hc/en-us/articles/115000166827-UniFi-Hotspot-Portal-and-Guest-WiFi
I'm not seeing anything there that says guests can't see other guests - quite the opposite.
I suppose a switch could be configured to prevent traffic going to other ports, which is how I would assume this would have to be done. This functionality would have to exist in the access point, I guess?
Does UniFi have a feature to isolate devices from each other on the same subnet? Seems like it would require some kind of Layer 2 routing?
It does. I have it enabled and tested. "Client Device Isolation." It's enabled per SSID.
Oh, neat. I'll have to look into it.
Thanks!
Unifi out of the box settings.