hello, can someone help me with some firewall rules for my 4 mesh ap's so that I can use client isolation on them all, because I can access the following with option set "disable default forward on the wireless interface"

pc1<--wireless-->mesh ap 1<----WDS---->mesh ap 2<--wireless-->pc2
---boooom I can access pc1 from pc2 and verse visa, but 2 pc's on same ap is blocked

Hi folks... is this to difficult to pull off?

Default forward only applies to devices connected to the same radio, so what you are seeing is expected.

Without knowing your configuration, it's a bit hard to tell you how to setup the firewall. Most likely your interfaces are brigged correct? If so, set "use IP firewall" to yes on your birdge settings, and you should be able to block them on the forward chain of the firewall filter.

Default forward only applies to devices connected to the same radio, so what you are seeing is expected.

Without knowing your configuration, it's a bit hard to tell you how to setup the firewall. Most likely your interfaces are brigged correct? If so, set "use IP firewall" to yes on your birdge settings, and you should be able to block them on the forward chain of the firewall filter.

Your 100% correct, I've done that all, but I'm not sure what IP's to block on the forward rule, or should I just block all local lan ranges and I should be fine?

Block all src and dst addresses for local ranges except the default gateway for the network. You might need to also allow the broadcast IP in case you want to allow broadcast traffic to work. If you are on the mesh network while doing this, be sure to have safe mode enabled in case you mess something up!

Block all src and dst addresses for local ranges except the default gateway for the network. You might need to also allow the broadcast IP in case you want to allow broadcast traffic to work. If you are on the mesh network while doing this, be sure to have safe mode enabled in case you mess something up!

Thx good idea Its working like a charm