24

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients connected to the AP. Wireless clients can talk to the LAN, and reach the Internet if such connection is available, but they cannot communicate with one another.

How is this achieved? Are there any particular weaknesses which would allow this to be easily bypassed?

2
  • 1
    Seems like this would be trivial to implement -- just drop all packets sent to the local subnet (besides the router itself). This is just a comment since I have no idea if they actually do it this way. Commented Jul 3, 2012 at 2:10
  • @BrendanLong "just drop all packets sent to the local subnet (besides the router itself)." drop broadcasts?
    – curiousguy
    Commented Jul 4, 2012 at 18:23

2 Answers 2

18

The implementation that I've seen of this is done by fiddling with the MAC forwarding table on the access point. Since the access point simply acts as a network bridge, it is fairly well suited to this kind of task. At the switching layer it is already collecting all of the heard (sometimes called learned) MACs and which interface it can be found on.

The logic looks kind of like this:

  1. Access Point receives a packet over the wireless interface
  2. Bridging subsystem examines packet for destination MAC
  3. If destination MAC is in the learned switching table for wireless interface -> DROP
  4. Otherwise forward packet via wired interface

Because of the way network bridges work I see this being fairly difficult to trick the access point into forwarding a packet to a client in spite of the isolation. Your best bet would be to attempt to talk directly to the other client, as if you were operating with an ad-hoc network.

5
  • 1
    "Your best bet would be to attempt to talk directly to the other client" how?
    – curiousguy
    Commented Jul 4, 2012 at 18:18
  • 3
    @curiousguy: I'm a gonna go with leaving it as an exercise for the curious.
    – Scott Pack
    Commented Jul 4, 2012 at 19:37
  • 6
    You're going about this all wrong, curiousguy. You should have said "It's impossible to talk directly to a client as if you were operating an ad-hoc network." Scott would have typed a novel.
    – k to the z
    Commented Nov 7, 2014 at 22:24
  • 2
    @curiousguy you'll need a Wi-Fi adapter that supports injection, and you'll have to forge packets, after you get the correct link keys
    – alfwatt
    Commented May 31, 2016 at 23:17
  • How does the AP, if operating as an L2 bridge, know which destination MAC is that of the internet gateway — it must allow that traffic for devices to access wan, right? Do you have to configure client isolation with the IP of the internet gateway on that LAN? Does it snoop on DHCP traffic to learn of all the possible IP gateways?
    – init_js
    Commented Mar 20 at 14:49
13

Wireless client isolation, how it works and how it's bypassed:

When you establish a wireless (wpa/wpa2-aes/tkip) connection to your access point (AP/router) 2 keys are created, a unique key for unicast traffic and a shared key for broadcast traffic which is shared with every pc that connects, known as the GTK.

When you send data to the AP it's encrypted with your unicast key. The AP then decrypts this and uses the broadcast GTK to send the data to the next system on the wireless network.

When you enable client isolation on the AP it stops using the GTK to send data. Because everyone establishes a unique unicast key to send data with you will no longer be able to see eachothers data.

Bypassing this takes a little more effort and understanding. Know that ARP traffic still gets broadcasted across the network using the GTK so that DHCP can maintain clients.

If the ARP table is poisoned with a broadcast MAC on the clients entry you will force the clients system to use the bradcast GTK when sending data. If the clients system is fooled into using the GTK to send data it can now be seen and you will bypass the client isolation.

Thus, if you set your local static ARP entry using the clients ip with a bradcast mac your local system will think its sending broadcast traffic when talking to that client and use the GTK allowing the client to see your traffic.

It will take about two minutes for DHCP to fix a poisoned ARP entry so you will have to write a program that streams poisoned/fake ARPs to maintain visability.

I acknowledge that some advanced APs have arp control and layer 2 isolation where advanced tactics are needed but we're not talking about those guys were talking about your SOHO.

Cheers.

3
  • Patrick... would it be possible for you to explain the client isolation bypass process once more in a little less tech version? Say, using a smart phone to bounce communications of a wifi router to another smart phone without being logged into the router itself. Thanks, Bill Commented Jan 2, 2017 at 23:29
  • If I understand correctly, it secures wireless communication by not using the global AP key, but it does nothing in terms of preventing communication at the IP level. The term "client isolation" has always confused me because it sounded like it prevents communication between clients on the WiFi, but that's an IP layer feature, definitely not on layer 2.
    – Oxwivi
    Commented Aug 18, 2019 at 14:52
  • Thanks. Does it have to rely on ARP? Does that preclude support for ipv6 client isolation, or similar mechanisms are allowed there?
    – init_js
    Commented Mar 20 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .