I am worried that there is not really a benefit of doing that, just more noise and energy consumption.

  • @danA
    link
    English
    93 months ago

    A lot of access points, even consumer-grade ones, have this option. It’s usually accomplished via predefined firewall rules on the access points themselves.

    Consumer-grade access points usually let you have just one isolated guest network, whereas fancier ones (Omada, Unifi, Ruckus, Aruba, etc) usually let you enable isolation for any SSID (ie the “guest network” is no different from any other SSID)

    • @BearOfaTime@lemm.ee
      link
      fedilink
      English
      1
      edit-2
      3 months ago

      Isolated guest networks I get, but isolating guests from other guests on the same subnet/isolated net is what I haven’t seen.

      • @jemikwa@lemmy.blahaj.zone
        link
        fedilink
        English
        23 months ago

        If there’s an option on the AP to not permit link local routing within a vlan/ssid, that will force all traffic up to the firewall. Then you can block intrazone traffic at the firewall level for that vlan.
        I’ve seen this in Meraki hardware where it’s referred to as “client isolation”. Ubiquiti might be able to do this too.

      • @conorab@lemmy.conorab.com
        link
        fedilink
        English
        23 months ago

        The APs know who the Wi-Fi clients are and just drops traffic between them. This is called client/station isolation. It’s often used in corporate to 1) prevent wireless clients from attacking each other (students, guests) and 2) to prevent broadcast and multicast packets from wasting all your airtime. This has the downside of breaking AirPlay, AirPrint and any other services where devices are expected to talk to each other.

      • @danA
        link
        English
        13 months ago

        I used to have a Netgear Nighthawk router/AP I bought from Costco, and if I remember correctly, its guest network automatically isolated guests from other guests. This router didn’t support VLANs so I think it was just a bunch of firewall rules.