I need a bit of advise on how to isolate hosts inside vlan.
My setup -- I have hap AC2 working as internet router, a bunch of devices connected directly to it and then another few via a couple of mikrotik managed switches (RB260GS).
I have set up a couple of vlans, to separate my nas & PCs from less thrustworthy internet-connected devices.
I would like to add a bit more isolation between various devices on the guest vlan - none of them should really be talking to each other, and I would like to enforce it (or at least make it reasonably hard).
The most reliable way of isolation would have been to place each device into separate VLAN, but it is too much work (and quite error-prone at it) to set up large number of vlans, especially given web interface of SwOS.
And because I don't need it to be absolutely bullet-proof, I figured it should be enough to block the APR between devices in guest VLAN, so they would only be able to communicate with the router.
My current plan (and things I'm uncertain about):
* Set up ACL #1 in RB260GS:
From: all ports except trunk
VLAN: tag present, vlan id = 5 (guest vlan)
Ethertype: 0806 (ARP)
Redirect to: trunk
* ACL #2
From, vlan -- same as above
No redirect to,hopefully this means DROP?
Dest MAC: ff:ff:ff:ff:ff:ff
* on HAP AC2, vlans are set up via "interface swith", set up similar rules in "switch rule"
* on HAP AC2, VLAN interface set APR to "reply only", set DHCP server to add ARP entries for leases.
Things I'm not completely sure about:
1) Would ACLs actually work when traffic is switched between ports? I do recall reading somewhere that swithc is adding VLAN tag on the packets from access ports only when they are forwarded to trunk port. So I wonder if my vlan settings (tag present, id=5) would match when packets are switched between access ports?
2) Exactly the same question applies to HAP ac2 switch rules, it has the very same
3) What is the correct ARP settings for the router? First of all it has to be set on VLAN interface, right?
Second I'm not actually sure which mode it should be (disable, reply only, local-proxy-arp)?