Is there a way to let Guest Wifi clients see each other but not Intranet devices?

[domic]

Trying to set up a Google Nest Hub device for my IoT Guest network (same Asus router), and I seem only to find a "Access Intranet" option which I don't want to let all my smart light bulbs and other devices see my home subnet devices.

A Fing network scan (Android app) shows only the router and my phone as discovered devices. Any solutions?

 

[ColinTaylor]

You need to change the isolation setting for the given guest network via its nvram variable. Unfortunately there's no GUI option to set/unset it. The problem with this method is that if you subsequently make changes to that guest network in the GUI the nvram change will be undone.

So for example, to disable client isolation on 2.4GHz guest network #2:

nvram set wl0.2_ap_isolate=0
nvram commit
service restart_wireless

 

[bennor]

If one doesn't want to use the method detailed above, one can accomplish Guest WiFi client communication (on the same band) with the Asus-Merlin firmware (assuming one's router is supported) and the YazFi add-on. YazFi add's an option to enable/disable Client Isolation on the Guest WiFi.

When it comes to communication between 2.4Ghz and the 5Ghz, a similar question was asked last week in the Add-On's subforum.
https://www.snbforums.com/threads/yazfi-allow-communication-between-2-4ghz-and-5ghz-networks.82799/

An example of YazFi's options with the client isolation option highlighted:

 

[DiliMe]

You need to change the isolation setting for the given guest network via its nvram variable. Unfortunately there's no GUI option to set/unset it. The problem with this method is that if you subsequently make changes to that guest network in the GUI the nvram change will be undone.

So for example, to disable client isolation on 2.4GHz guest network #2:

nvram set wl0.2_ap_isolate=0
nvram commit
service restart_wireless

Nice one!

Do you know if a similar nvram variable exists for the equivalent of "One way to guest" setting in YazFi?

The ideea is that I had uninstalled YazFi because of the issue with IoT clients from the AiMesh node who would receive IP addresses from the main subnet.

Basically what I'm trying to accomplish is to be able to ping IoT clients so to receive notifications in case any of the IoT nodes is down.

Thank you!

 

[ColinTaylor]

Do you know if a similar nvram variable exists for the equivalent of "One way to guest" setting in YazFi?

No, there's no nvram equivalent for that. YazFi achieves it by creating separate subnets with firewall rules between them.

The idea is that I had uninstalled YazFi because of the issue with IoT clients from the AiMesh node who would receive IP addresses from the main subnet.

Basically what I'm trying to accomplish is to be able to ping IoT clients so to receive notifications in case any of the IoT nodes is down.

To disable intranet access for the guest network brouting rules are created that block ICMP and TCP traffic. You could manually change these rules but the changes would be lost when the router was rebooted or certain changes were made in the GUI. Using AiMesh nodes makes this even more complicated.

 

[DiliMe]

No, there's no nvram equivalent for that. YazFi achieves it by creating separate subnets with firewall rules between them.


To disable intranet access for the guest network brouting rules are created that block ICMP and TCP traffic. You could manually change these rules but the changes would be lost when the router was rebooted or certain changes were made in the GUI. Using AiMesh nodes makes this even more complicated.

OK, thank you for the quick response.