Greetings, gentlemen.

We set up the Mikrotik hotspot one year and so ago, made some tests and convinced ourselves that hotspot clients wouldn't be able to ping nor to see each other, until we set IP binding entries. But yesterday we saw the opposite.

Before wrecking our brains further, let me ask: which should be the default behaviour?
By default are hotspot clients, logged in or not, with no specific firewall rules (except for the default ones), able to connect between them?

If the hotspot 1:1 NAT is active, that will cause problems between localnet clients, but not totally stop the communication. If you disable the hotspot NAT, they will be able to communicate fine.

I have not found a way to totally isolate them unless they are all wireless, and use "default-forwarding=no" to isolate them from each other.

How is your infrastructure set up? Are the any switches in between the clients and hotspot gateway?

Oops! I forgot to be more specific. We use a Mikrotik router. WiFi antennas are autonomous, so there's no Mikrotik Wireless interface. And this default-forwarding seems to be wireless exclusive.

But thank you. I just wanted to know what to expect, to think which rules to put from there.