1

We have created a wifi hotspot or a wireless access point using hostapd in Ubuntu. How can we isolate wifi clients the same way "Client Isolation" does in some access points? Is there any way we can combine iptables with hostapd to apply some firewall rules between wifi clients?

Improve this question

2 Answers 2

Reset to default
0

Create an iptables rule on input and output that allows the source address range to talk to the router/default gateway, additional rules for any servers or other resources on that subnet.

Create a final rule that drops packets between the source address range and the source address range.

iptables -A INPUT -i $WIFI -o $WIFI -s 192.168.1.0/24 -d 192.168.1.1 -j ACCEPT
iptables -A INPUT -i $WIFI -o $WIFI -s 192.168.1.0/24 -d $SOMESERVERIP -j ACCEPT
iptables -A INPUT -i $WIFI -o $WIFI -s 192.168.1.0/24 -d $SOMEOTHERSERVERIP -j ACCEPT
iptables -A INPUT -i $WIFI -o $WIFI -s 192.168.1.0/24 -d 192.168.1.0/24 -j DROP

The basics of this chain of events is:

  1. if it's in the subnet and it's talking to the gateway, accept it
  2. If it's in the subnet and it's talking to a server, accept it
  3. Rule 2 repeats until you run out of acceptable servers
  4. If it's in the subnet and it's talking to anything else in the subnet, drop it
Improve this answer
0

At this time, iptables rules have no effect on the packets forwarded directly by the wifi interface, according to this.

Good news is that Hostapd 2.9 has a an option called ap_isolate that does exactly what you described. You can read about it here.

Once you set that flag, all packets from devices on the access point network will be dropped by the access point.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .