2
I have a set of six vacation rental apartments in the same building that all share a common router in the main office that serves internet to all the apartments.
Each apartment has its own individual wireless router which is connected to the main router in the office via ethernet. Each individual router is configured as an AP and the main router in the office performs DHCP for the whole network. The system works okay with some problems:
Devices connected to the same AP often can't see each other. For example AirDrop devices or internet games become unusable for my guests.
Devices not connected to the same AP sometimes appear in all the apartments. For example a guest's PC appears in another guest's list of networked devices.
What I would prefer is that each apartment is "firewalled" from the other apartments so that guests cannot see one another's devices; but within each apartment, all local devices are reliably visible to each other.
The main router in the office is a Vodafone Station Revolution and the APs are little Intellinet devices.
What is the best way to configure my network to do what I want?
Edit: turns out the network is set up even stranger than I realized.
Internet arrives at the Vodafone Station Revolution. From here is connected a WNAP-6305 wireless gateway configured as a wireless AP that serves two of the apartments on two different SSIDs. From there are connected four of the Intellinet wireless APs each serving one apartment each.
I was able to resolve my privacy problem by enabling SSID isolation on all of the devices. So far this seems to solve that problem. However I still have the issue of devices often not being able to see one another within a single SSID.
An easy way is to turn on NAT on all apartment routers: This leads to double NAT towards the internet (normally not recommended), but will quickly isolate the router networks from each other. You can achieve the same with firewall settings, but then you need to know what you are doing. Also make sure all APs use a different frequency, and have a different SSID and password. – dirkt – 2019-08-18T15:44:35.023
And the passwords shouldn't be guessable by the users. Don't use passwords like "app1" & "appt2", although this doesn't matter for the SSIDs. – harrymc – 2019-08-18T16:29:58.087
@dirkt turns out the network is set up even stranger than I realized. Internet arrives at the Vodafone Station Revolution. From here is connected a WNAP-6305 wireless gateway configured as a wireless AP that serves two of the apartments on two different SSIDs. From there are connected four of the Intellinet wireless APs each serving one apartment each.
I was able to resolve my privacy problem by enabling SSID isolation on all of the devices. So far this seems to solve that problem. However I still have the issue of devices often not being able to see one another within a single SSID. – Richard Lee – 2019-08-19T16:09:51.013
This setup doesn't look particular efficient, but that's a different problem. For the problem of devices not being able to see each other within a single SSID, the cause can only be the apartment AP. To narrow down the problem, it might help to list the exact circumstances under which that doesn't work, and if it's random or reproducable. E.g. AirDrop devices will use broadcast and mDNS, and it's possible you need to change something in the configuration of the AP to make it work. – dirkt – 2019-08-19T19:11:52.213