Should I allow or block wireless devices from directly communicating with each other on my LAN AP?

Question

The question I'm asking is, like all security, a bit open-ended, and ultimately - like all security - it involves a personal balance between ease/usability vs. risk/security:

• Should I let users' devices (1) communicate locally with each other on my WiFi AP, or (2) segregate them from each other, or (3) is there any "middle ground" between these choices?

The problem being, I don't know what user devices/applications' needs and expectations might be, nor how significant any convenience/inconvenience or security gain would be.

So I'm asking this to get a better sense of the security information and social considerations which I should take into account, and how I should assess the issues it raises, so that I can make a good quality informed decision.

Background:

My LAN is pretty simple on the WiFi side: a pfSense router that also acts as DHCP server, 3 network ports (WAN, wired LAN, Wireless AP), and firewall rules separating them.

In the past, I've handled Wifi by simply having a commodity AP on a dedicated interface of the router, setting up WPA2, device segregation, and access control on the AP, and creating rules on the router to prevent any WLAN interface traffic other than to/from the WAN. From the perspective of my LAN, WiFi security problem = solved.

I now want to "up my game" a bit. I'm swapping the commodity AP for a Netgear router running OpenWRT 15.05 as an AP, and configuring separate trusted vs parially-trusted virtual APs (the first is for me and will use 802.1X, the second is for friends/family and will use WPA2, or WPA3 when it's out and widely supported). The two sets of traffic will be on separate VLANs between AP and router.

It's primarily the "friends and family" AP setup that's relevant in this question. I'm not at all concerned about wired LAN access, or inappropriate traffic "jumping" to a trusted device, because that can be managed with VLANs and firewall rules on the router itself. But if devices are on the AP, then I have to decide what setup to adopt on the AP itself, regarding inter-device traffic.

My issue:

In the past I would have automatically gone with configuring the AP so that devices are segregated - no direct traffic between them within the AP or LAN. But in this day and age, it occurs to me, people may want/need/expect their separate devices (and those of friends) to be able to communicate with each other on the WLAN. I don't have that need, so I'm not aware at all whether or how much blocking inter-device AP traffic might be an issue to some people.

Examples:

• Communication beneficial: (1) A friend with an iPhone + iPad who may need them to communicate. (2) Two friends might want to send a file between them in some way.

• Communication adverse: (1) A friend's Windows laptop could be malwared/exploited, and attempting to use its WLAN access to probe for other WiFi device MACs and data, or to listen into/modify their sessions. (2) A neighbour or passing wardriver could try to take advantage of the WLAN or "listen in" to communications on it.

There might be other risks I should take into account, but those seem to be the main risks related to WiFi segregation issues.

So there are good reasons why segregating user devices would be beneficial to my own peace of mind as well as the friends+family who use my WiFi. But how disruptive would it be, and is it still sensible or impractical to do it these days, given how fast usage (including direct user-to-user) might be converging? Or perhaps they use other technology like Bluetooth/NFC so it's not a problem at all?

The question:

I don't really have any good way to gauge how disruptive or okay blocking inter-device traffic would be for users and apps, and I don't have a real sense of the true extent to which it will actually benefit users or I in terms of security and privacy. I don't use any apps or devices myself, which would trigger this issue.

In an ideal world I'd like to segregate all WiFi devices from each other "on principle", but I don't know the impact of any disruption this could have, or how much of a problem it is (what solutions exist), if someone is disrupted.

It's also possible (hypothetically) that the real issue could be overwhelmingly the device to AP sessions + individual traffic, which can't be segregated anyway, perhaps this makes any device segregation security benefits miniscule in consequence.

So my question can be expressed like this:

• What is the realistic situation and facts I need, both about security and about current/medium term everyday WiFi usage/expectation/connectivity, to decide how to handle this?

• What usual approaches (other than "802.1X universally required") are adopted by people who have thought about this before configuring their setup?

Answer 1

What is the realistic situation and facts I need, both about security and about current/medium term everyday WiFi usage/expectation/connectivity, to decide how to handle this?

For enterprise networks, it is best practice to segregate devices from communicating with each other as the end users don't have an implied trust with one another (I don't trust everyone on the public wifi at starbucks, so they shouldn't be able to see my device on the network). On home networks, it's all about your acceptable risk and the answer is going to be "It depends". How advanced are your users? What type of applications do they run on the network? How many users are you talking about?

What usual approaches (other than "802.1X universally required") are adopted by people who have thought about this before configuring their setup?

I run a "guest" wireless for my family and friends because I don't trust them not to click on malicious links. The devices can see each other on the network, but there are rarely more than 4 devices on this access point. This is enough network segmentation for me, as all of my workstations and servers are on a separate network than the guest wireless.