Isolation IPs from the wired network of the same subnet

Alex Atkin UK

Indeed, I have a bit of an isolation hack on my own network as I share it with some friends.

All four ports on pfSense are bridged and I enabled packet filtering on that bridge. I then have a firewall rule that allows my friends static IPs to only talk to the firewall itself, so while some broadcast traffic might slip through (I only have it blocked in one direction) they can't accidentally ChromeCast to my TV like they did once.

But honestly, if all you need is full isolation then its just easier to have it on a completely different LAN. Although that will not isolate the WiFi clients from each other, that has to be done in the WiFi access point itself.

Derelict

Depends. Layer 2 isolation is a valuable tool especially in public access environments such as hotels, etc.

That said, any leverage of a pfSense bridge to accomplish the task is likely pretty far from an optimal solution.

Alex Atkin UK

Agreed, it was just convenient for my setup as its not vitally important my friends are blocked from the LAN, it just prevents little mishaps like described.

After all, if they change devices they will still get an IP from the dynamic pool which will bypass my blocks (although I might add those to the list) or they specify a static IP which would almost DEFINITELY bypass the rules.

Although I have the added benefit of knowing not only that those people know sod-all about networking, they wouldn't even bother to try learning about it either. I can't even convince them to connect to 5Ghz over 2.4Ghz as the whole concept of it not "just working" freaks them out. ;)

For true isolation, VLANs or just having the AP into its own ethernet port with its own network range is key. There is in fact no logical reason to HAVE them on the same subnet in the first place.

Derelict

But then you need isolation in the AP to keep them from each other.

We're not really talking about isolating subnets. That's done in the firewall.

We're talking about isolating hosts in the same subnet from each other, but not from the gateway or other necessary hosts.

Alex Atkin UK

Right, I got completely confused about what the OP was trying to achieve here.

johnpoz

He was/is trying to create isolation of devices on the same layer 2 by just telling them their mask is /32 - which as we all know is just borked.

JKnott

A /32 mask is used by some routers to designate an interface, rather than a network.

@alex-atkin-uk said in Isolation IPs from the wired network of the same subnet:

Even with most dumb switches (as many pass VLAN tags without messing with them)

No switch should touch the VLAN tag, except a managed switch configured for that VLAN. Dumb switches should pass VLAN tags untouched. The exception would be ancient gear that's incapable of passing a frame with both a VLAN tag and full 1500 byte payload, as it would be too large for it to pass. In that case, the frame should be dropped entirely, not passed on with anything mangled.

JKnott

@derelict said in Isolation IPs from the wired network of the same subnet:

We're talking about isolating hosts in the same subnet from each other, but not from the gateway or other necessary hosts.

The only way I'm aware of to do that is a firewall running on the device, that's capable of filtering on MAC addresses. The firewall on OpenSUSE is capable of that.

NogBadTheBad

Some switches have a Protected / Private VLAN edge port as John previously mentioned.

Features of a protected port:

Protected Ports provide Layer 2 isolation between interfaces (Ethernet ports and LAGs) that share the same VLAN.

Packets received from protected ports can be forwarded only to unprotected egress ports. Protected port filtering rules are also
applied to packets that are forwarded by software, such as snooping applications.

Port protection is not subject to VLAN membership. Devices connected to protected ports are not allowed to communicate with
each other, even if they are members of the same VLAN. Both ports and LAGs can be defined as protected or unprotected.

Derelict

Right. That is Cisco's private vlan edge. Brocade calls it uplink ports which makes all non-uplink ports on a VLAN isolated from everything but the configured uplink ports. This can be more flexible than cisco's protected ports because it is configured per-VLAN. Some switches have port isolation built in. Some can do it with asymmetric VLANs. The SG-3100 and XG-7100 can do it (on the built in switch) using a similar method.

Then there are true private VLANs which are harder to implement because to fully support it everything has to support it on VLAN trunk ports (APs, etc). It gets really complicated when you start trunking switches/gear together.