Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients connected to the AP. Wireless clients can talk to the LAN, and reach the Internet if such connection is available, but they cannot communicate with one another.

How is this achieved? Are there any particular weaknesses which would allow this to be easily bypassed?

share|improve this question
Seems like this would be trivial to implement -- just drop all packets sent to the local subnet (besides the router itself). This is just a comment since I have no idea if they actually do it this way. –  Brendan Long Jul 3 '12 at 2:10
@BrendanLong "just drop all packets sent to the local subnet (besides the router itself)." drop broadcasts? –  curiousguy Jul 4 '12 at 18:23

1 Answer 1

up vote 8 down vote accepted

The implementation that I've seen of this is done by fiddling with the MAC forwarding table on the access point. Since the access point simply acts as a network bridge, it is fairly well suited to this kind of task. At the switching layer it is already collecting all of the heard (sometimes called learned) MACs and which interface it can be found on.

The logic looks kind of like this:

  1. Access Point receives a packet over the wireless interface
  2. Bridging subsystem examines packet for destination MAC
  3. If destination MAC is in the learned switching table for wireless interface -> DROP
  4. Otherwise forward packet via wired interface

Because of the way network bridges work I see this being fairly difficult to trick the access point into forwarding a packet to a client in spite of the isolation. Your best bet would be to attempt to talk directly to the other client, as if you were operating with an ad-hoc network.

share|improve this answer
"Your best bet would be to attempt to talk directly to the other client" how? –  curiousguy Jul 4 '12 at 18:18
@curiousguy: I'm a gonna go with leaving it as an exercise for the curious. –  Scott Pack Jul 4 '12 at 19:37
You're going about this all wrong, curiousguy. You should have said "It's impossible to talk directly to a client as if you were operating an ad-hoc network." Scott would have typed a novel. –  k to the z Nov 7 '14 at 22:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.