3
I'm currently setting up a public wireless network. I want to prevent the clients from talking to each other.
Here's my current setup.
/etc/config/firewall without anything related to lan:
config 'zone'
option 'name' 'wan'
option 'input' 'REJECT'
option 'output' 'ACCEPT'
option 'forward' 'REJECT'
option 'masq' '1'
option 'mtu_fix' '1'
option 'network' 'wan'
config 'rule'
option 'src' 'wan'
option 'proto' 'udp'
option 'dest_port' '68'
option 'target' 'ACCEPT'
option 'family' 'ipv4'
config 'rule'
option 'src' 'wan'
option 'proto' 'icmp'
option 'icmp_type' 'echo-request'
option 'target' 'ACCEPT'
config 'zone'
option 'name' 'public'
option 'network' 'public'
option 'output' 'ACCEPT'
option 'input' 'REJECT'
option 'forward' 'DROP'
config 'forwarding'
option 'dest' 'wan'
option 'src' 'public'
config 'rule'
option 'target' 'ACCEPT'
option 'src' 'public'
option 'proto' 'tcpudp'
option 'dest_port' '53'
option '_name' 'public dns'
config 'rule'
option 'target' 'ACCEPT'
option '_name' 'public dhcp'
option 'src' 'public'
option 'proto' 'udp'
option 'src_port' '67-68'
option 'dest_port' '67-68'
Somehow clients are still able to communicate with each other. Why is that and what can I do against it?
Inter LAN traffic? Is that a feature of the WLAN standard? That would explain the 20% package drop. – Georg Schölly – 2011-04-18T12:58:07.743
It looks like OpenWRT abandonned nvram settings in favor of /etc/config/ long ago anyway. – Georg Schölly – 2011-04-18T13:05:51.093
Sorry, that should be intra-LAN. But if you're some packets dropped and not others with this configuration, I don't know. It looks like my OpenWRT knowledge is too far out of date. – Bacon Bits – 2011-04-18T21:26:09.477