Specifically I am talking about clients on the same WLAN, that are on the same subnet and lets make it interesting they are not the same vlan.
My understanding is that isolating wifi clients from each other was as simple as UNCHECKING the forward checkbox on the wireless settings page of the WLAN.
Similar to many other wifi routers with an isolate feature.
In a number of discussions and youtubes etc…
I see two other things often occurring.
a. On the bridge settings that is associated with the network people check of the box USE IP Firewall.
b. Make a rule like add chain=forward action=reject source-address=vlanAmembers destination-address=vlanAmembers
I can possiblly see why b. if for some reason the request from a vlanAmember that is not stopped by the WLAN interface somehow gets to he router side (how??) and the router tries to route it back to the WLAN??
If so, why do you need to check a bridge setting??
Very confused!
What if one had wifi clients as above on a vlan and then other clients on the same vlan but wired. How would one block wired and wireless clients from reaching each other in that scenario?
Not for all connections, but at least between ethernet and WLAN interface: split-horizon bridge
from the Wiki:
“Set the same value for group of ports, to prevent them from sending data to ports with the same horizon value. Split horizon is a software feature that disables hardware offloading”
“Bridge horizon feature allows to configure bridge ports with horizon setting so that packet received over port with horizon value X is not forwarded or flooded to any port with the same horizon value X.”