Network isolation

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions
Author Message
pgte3
DD-WRT Novice


Joined: 19 Aug 2015
Posts: 10

PostPosted: Fri Jul 26, 2019 18:33    Post subject: Network isolation Reply with quote
What level of network isolation would I achieve with this configuration?

Router:
Router: ModelTP-Link TL-WR740N v4
Firmware Version: DD-WRT v3.0-r33772 std (11/16/17)

Current Bridging Table:
Bridge Name STP enabled Interface
br0 no eth1 ath0

Physical Interface ath0:
AP Isolation - Disable
IP Address: 192.168.1.1

Virtual Interfaces ath0.1:
Network Configuration: Unbridged
AP Isolation - Disable
Masquerade / NAT: Enabled
Net Isolation: Enabled
IP Address: 192.168.2.1

Note:
Each network uses its own DHCP server

Questions:
Can ath0.1 get to or "see anything" on eth1 or ath1? How does the answer related to the OSI model L2, L3 or L4?
Sponsor
SurprisedItWorks
DD-WRT User


Joined: 04 Aug 2018
Posts: 376
Location: Appalachian mountains, USA

PostPosted: Sun Jul 28, 2019 21:56    Post subject: Reply with quote
Your VAP ath0.1 is effectively completely separate from ath0, except that they share radio parameters other than SSIDs. Things like isolation, inclusion in bridges, and presence in firewall commands are completely separate for the two. So we can speak of your br0 devices as those devices connected to either your ethernet lan interface eth1 or to the SSID associated with ath0.

So, your br0 devices can see and interact with each other. Your ath0.1 devices can see and interact with each other. But your ath0.1 devices and your br0 devices are isolated from each other in that no packet from either of br0 or ath0.1 will be passed to the other. So your ath0.1 devices and your br0 devices are isolated from each other.

Enabling net isolation on an interface isolates it from br0. However, if you have two interfaces that are not in br0 and enable net isolation on each of them, each will be isolated from br0 but they will not be isolated from each other. To isolate them from each other, you have to add explicit iptables commands to the firewall. This appears to be left over from early dd-wrt days when no one apparently considered that having more than a main network and a guest network would ever be of interest.

I believe AP isolation is implemented in the wifi interface itself, but I am not truly certain. Net isolation is implemented in the firewall, which I believe is one level up from the interfaces. Can't help you regarding how those are numbered Lthis or Lthat, etc. (My network education is minimal.)

_________________
Six of the Linksys WRT1900ACSv2 on r38159, r40009, and r40784. On various:
VLANs, client-mode travel router, two DNSCrypt servers (incl Quad9), multiple VAPs, USB/NAS, QoS, OpenVPN client/PBR (random NordVPN server).
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum