# network client isolation

> client isolation can be used to prevent low-level bridging of frames between associated stations in the BSS

**Wikidata**: [Q125420966](https://www.wikidata.org/wiki/Q125420966)  
**Source**: https://4ort.xyz/entity/network-client-isolation

## Summary
Network client isolation is a security feature that prevents low-level bridging of data frames between associated stations within a Basic Service Set (BSS). Functioning as a firewall mechanism on a router, it blocks direct communication between devices connected to the same wireless access point.

## Key Facts
- **Primary Function:** Prevents low-level bridging of frames between associated stations in the BSS.
- **Classification:** Identified as a type of firewall system.
- **Application Scope:** Applies specifically to the router component of a network.
- **Hostapd Configuration:** Implemented using the parameter `ap_isolate=1`.
- **OpenWrt Configuration:** Configured via the variable `wireless.guest.isolate="1"`.
- **Alternative Names:** Also referred to as "AP Isolated feature."

## FAQs
### Q: What is the primary purpose of network client isolation?
A: The primary purpose is to prevent low-level bridging of frames between associated stations in the BSS. This ensures that devices connected to the same wireless network cannot directly communicate with or bridge traffic to one another.

### Q: Is network client isolation considered a firewall feature?
A: Yes, network client isolation is classified as a firewall mechanism. It specifically applies to the router to control traffic flow between connected clients.

### Q: How is client isolation enabled in Hostapd?
A: In Hostapd, this feature is enabled by setting the configuration parameter `ap_isolate` to `1`.

## Why It Matters
Network client isolation matters because it serves as a critical security control within wireless local area networks (WLANs). By functioning as a firewall at the router level, it addresses the inherent vulnerability of shared wireless mediums where associated stations might otherwise intercept or bridge frames directly to one another.

This capability is particularly significant for managing "Public Wi-Fi" or guest networks. Without isolation, a compromised or malicious device connected to the same access point could potentially attack other connected devices (stations) via low-level bridging. By enforcing this isolation, network administrators can ensure that client traffic is restricted to upstream connections (internet access) only, effectively segmenting peers within the same Basic Service Set (BSS) to maintain privacy and security.

## Notable For
- **Traffic Restriction:** Specifically targets and blocks low-level bridging of frames, a granular control not present in standard forwarding rules.
- **Wireless Security:** Acts as a dedicated firewall measure for wireless environments (BSS).
- **Configuration Standardization:** recognized across different firmware environments via specific parameters like `ap_isolate=1` (Hostapd) and `wireless.guest.isolate="1"` (OpenWrt).
- **Peer Segmentation:** Distinguishes itself by segregating associated stations from each other rather than just filtering external traffic.

## Body
### Technical Function
Network client isolation operates by preventing the low-level bridging of frames between associated stations in the BSS. In a standard wireless setup, an Access Point (AP) may facilitate direct communication between connected clients. When isolation is active, the AP blocks these direct peer-to-peer transmissions.

### System Classification
The feature is structurally defined as a **firewall** mechanism. While traditional firewalls often focus on Wide Area Network (WAN) to Local Area Network (LAN) filtering, client isolation applies specifically to the **router** as an internal traffic control rule. It monitors and controls the flow of traffic strictly between local wireless clients.

### Configuration and Implementation
Implementation of network client isolation varies by operating system and software platform, utilizing specific variable flags:

- **Hostapd:** The feature is toggled using the parameter `ap_isolate=1`. This instructs the access point driver to stop forwarding frames between wireless clients.
- **OpenWrt:** The configuration is managed through the variable `wireless.guest.isolate="1"`, often used specifically for guest network interfaces to ensure visitor devices remain segregated.
- **General Nomenclature:** The feature is also widely recognized as the "AP Isolated feature."