Lan port Isolation via Command line - how to

[jvande]

This may be a stupid newbie question, perhaps answered somewhere before, but I've looked and can't find the right information in all of the wrong places...

On the WIFI page, when "Access Intranet" is disabled, these 2 ebtables rules come into being:

-i wl0.1 -o ! eth0 -j DROP
-i ! eth0 -o wl0.1 -j DROP

Is there a similar command to isolate the lan ports? Id like to keep wired clients from seeing each other. Ideally, I'd like to be able to turn "on/off" individual intranet access to each of the ports while retaining Internet access. Is this possible? What command should I be looking for? IPTABLES, VLAN commands, NAT or EBTABLES or something else altogether? I'm assuming I'll need access to telnet or ssh.

Thanks - currently using asuswrt-merlin 3.0.0.4.266.23 version on a RT-N66U.

 

[MrB]

I too would like to be able to isolate a LAN port in the same way as you can a guest wifi network.

If anyone knows how to do this I'd be extremely grateful!

Thanks in advance,
MrB.

 

[huotg01]

Does this help a bit: http://forums.smallnetbuilder.com/showthread.php?p=62235#post62235 ?

 

[MrB]

Not really. That's talking about filtering IP addresses and gives an examples of filtering IP address access to entire networks (wired, wireless, WAN) if I'm reading it correctly.

What I (and the original OP) want to do is to be able to block individual wired LAN ports from communicating with other devices on the LAN (and, for the sake of completeness WLAN).

In theory a client plugging into one of the wired LAN ports may have any address - so trying to block by IP would be easy to circumvent / not offer isolation based on port.

 

[alk630]

Not really. That's talking about filtering IP addresses and gives an examples of filtering IP address access to entire networks (wired, wireless, WAN) if I'm reading it correctly.

What I (and the original OP) want to do is to be able to block individual wired LAN ports from communicating with other devices on the LAN (and, for the sake of completeness WLAN).

In theory a client plugging into one of the wired LAN ports may have any address - so trying to block by IP would be easy to circumvent / not offer isolation based on port.

This would be a great idea...I've been wanting this for an eternity to stop kids plugging cables into the spare LAN ports...have lockable plugs keeping them out at the moment!