Full wifi device isolation

RouterOS Wireless Networking
1

I am planning to buy a hap ax3 for my house.

The main thing I want is to be able to fully isolation nearly all devices on the wifi. So no talking to each other, only internet access.

Everything I’ve read about this is talking about VLANs. Is that the only option? To put every single device on its own vlan?

Most forum posts and articles I’ve read were talking about the physical ports. I just want to confirm, can I have each wifi device on its own vlan?

If VLANs are the way to go, is there an automated way so that every new device will auto be put in a new vlan or do I have to do that manually?

2

VLANS are extremely useful in preventing groups of users from accessing each other and are recommended.
For users within a VLAN, then firewall rules are useless.

In the old way of WIFI one could use access lists … however all i can find on my hapax3 is clien-isolation.

Here is a quote for Datapath Function TAB in Wifi…
client-isolation (no | yes) Determines whether client devices connecting to this interface are (by default) isolated from others or not.
This policy can be overridden on a per-client basis using access list rules, so a an AP can have a mixture of isolated and non-isolated clients.
Traffic from an isolated client will not be forwarded to other clients and unicast traffic from a non-isolated client will not be forwarded to an isolated one.
Default: no

3

It used to be in caps-man, client to client forwarding. Also under datapath.

4

I just read that I can’t have more than 1 VLAN per virtual/SSID. If that is the case, I guess that client-isolation is the way to go.

Is there some way to have firewall rules between WIFI devices? So for example to allow one specific IP to connect to another IP over port 80 and nothing else?

5

Mikrotik QuickSet config use a bridge filter that block forwarding. So that’s another way to do client isolation:

/interface bridge filter
add action=drop chain=forward in-interface=wifiXX
add action=drop chain=forward out-interface=wifiXX
6

Sorry, I posted this on the wrong thread, so I have removed it and put it on the correct thread.

Kind regards
Chris

7

On wireless chip, enable client isolation, then VLANs (Main VLAN, Guest VLAN etc), and finally on the layer 3-sub interface VLAN, you enable local-proxy-arp.

8

No, wifi client isolation only (enough for wifi) + bridge filter.

9

thanks ... applied that on a hAPacLite (no wave2 - only "legacy wireless"), because i ffs did not find any "client isolation" related stuff - and now that i think about that filter rules .... yes, makes absolute SENSE!

thank you

10

On Wireless is Default Forward option:
immagine

11

Possibly relevant:
https://tangentsoft.com/mikrotik/wiki?name=Isolated%20Guest%20WiFi%20Sans%20VLANs

12

how does this isolate wifi clients? this only states that clients which are authenticated and thus connected do not get their traffic forwarded unless it is stated in an AP Access Rule

image
image1016×624 56.5 KB

13

saw that and read it. but needed it for pre-wave2 AP
thanks anyways

14

??? I don't understand the question, if one...
the screenshot shows forwarding, not authentication, and it's on the standard wireless connection, not Wave2/WiFi.

15

i mentioned that it is not wave2

without default forwarding the wireless client's data does not get forwarded at all unless it is allowed in access list rule(s)