Re: Guest isolation not supported in AP mode?

rhester72 · ‎2016-11-26

The good news: Guest access works.

The bad news: You can't do guest isolation in AP mode, apparently - the option is greyed out.

That makes it rather useless, unfortunately - why is this?

Rodney

TheEther · ‎2016-11-26

This is not unique to the Orbi. An AP has no way of isolating guest traffic on your internal network. It would have to do something like put it in a VLAN to send to the router but the router would also have to support VLANs.

peteytesting · ‎2016-11-26

have to agree here , the device would not really be working in AP mode if it where handling router features

rhester72 · ‎2016-11-26

I used to think so as well - except eero got this right. In AP mode, they use iptables to block any packets that aren't destined to TCP/UDP port 53 or DHCP broadcast to any local CIDR, based on eero's own IP addresses (v4 and v6). It's quite clever and works very well.

Rodney

TheEther · ‎2016-11-26

Ok, I see how that could work. Thanks for pointing it out.

Miles267 · ‎2016-12-31

Yes, Orbi should enable client isolation option for guest network even in AP Mode. Open-Mesh also supports this invaluable feature.

fbg · ‎2017-02-02

I thinks this warrants some discussion. If client A tries to talke to client B, both on wifi, what happens? The frames don't go directly from A to B via radio (ignoring ad hoc mode wifi). They go to the access point / wireless router. If that access point is an Orbi in AP mode, the Orbi could either deliver the frames, or just send them out the wire and let the downstream router decide what to do with them. I don't know which one it does, and I can't test it since I'm still looking into buying or not... Ideally I would want the Orbi to offer either behavior as an option.

Assuming the Orbi doesn't simply deliver the frames, the next question is: what will the downstream router do? If it is acting as a simple layer 2 / layer 3 device, it will deliver the frames. A and B are on the same layer 2 segment, so they should "see" eachother normally. However, if the downstream router is a firewall, it may be able to actually apply policy and not transmit the frames back out the interface, or perhaps bump the decision to layer 3 and only do so if the hosts in question match an ACL, etc...

I don't know without testing, but I expect the abstract scenario will give different results for different APs and different down-wire routers. Does anyone have more info on this?

In short I don't think this is a simple "no AP can do this" issue.

anschmid · ‎2017-02-03

Well AP mode isolation nice to have yes but from what I have just discovered Orbi doesn't even do proper isolation in router mode.

See my post here: https://community.netgear.com/t5/Orbi/CAUTION-Orbi-s-Wifi-Guest-Network-does-not-really-isolate-gues...

TheEther · ‎2017-02-03

@fbg wrote:

I thinks this warrants some discussion. If client A tries to talke to client B, both on wifi, what happens? The frames don't go directly from A to B via radio (ignoring ad hoc mode wifi). They go to the access point / wireless router. If that access point is an Orbi in AP mode, the Orbi could either deliver the frames, or just send them out the wire and let the downstream router decide what to do with them. I don't know which one it does, and I can't test it since I'm still looking into buying or not... Ideally I would want the Orbi to offer either behavior as an option.

I would not expect the Orbi to simply send frames out the wire. It's possible that the downstream router will not even see the traffic, so it won't be in a position to isolate guest traffic.

Instead, I would expect the Orbi determine whether client A is on the guest network and either forward or drop the traffic accordingly at the base station. Netgear has a couple of ways they could implement this. A sensible way would be to have the satellite put guest traffic into a VLAN when sending over the Wi-Fi backhaul connection. The VLAN tag would clearly mark guest traffic. The base station could then look at the destination address of the traffic. If it's on the same subnet, then the traffic is dropped. If it's not local, then it sends it to the router to be forwarded to the Internet.

peteytesting · ‎2017-02-03

@TheEther wrote:
@fbg wrote:
I thinks this warrants some discussion. If client A tries to talke to client B, both on wifi, what happens? The frames don't go directly from A to B via radio (ignoring ad hoc mode wifi). They go to the access point / wireless router. If that access point is an Orbi in AP mode, the Orbi could either deliver the frames, or just send them out the wire and let the downstream router decide what to do with them. I don't know which one it does, and I can't test it since I'm still looking into buying or not... Ideally I would want the Orbi to offer either behavior as an option.
I would not expect the Orbi to simply send frames out the wire. It's possible that the downstream router will not even see the traffic, so it won't be in a position to isolate guest traffic.

Instead, I would expect the Orbi determine whether client A is on the guest network and either forward or drop the traffic accordingly at the base station. Netgear has a couple of ways they could implement this. A sensible way would be to have the satellite put guest traffic into a VLAN when sending over the Wi-Fi backhaul connection. The VLAN tag would clearly mark guest traffic. The base station could then look at the destination address of the traffic. If it's on the same subnet, then the traffic is dropped. If it's not local, then it sends it to the router to be forwarded to the Internet.

using the vlan tag would it also overcome the issue in ap mode as well ?

TheEther · ‎2017-02-03

The VLAN tag could be used in either router or AP mode. It merely serves to easily identify guest traffic. How much extra work the base station needs to do in order to handle the guest traffic depends on whether it is in router or AP mode. In AP mode, the Orbi could apply the sorts of checks that rhester72 described several posts above. In addition, the it could also support an advanced mode whereby it doesn't strip the VLAN tag but, instead, forwards it to a router that understands VLAN tagging. The router could, then, enforce the traffic segregation. This is how some enterprise-class networking gear work.

anschmid · ‎2017-02-03

VLAN tags for Guest Network will work. The Apple Airport devices use VLAN tag 1003 for the Guest Network to separate it from the main network traffic.

If you using the wireless device in AP mode this becomes a bit harder to configure on your main router/firewall and other network devices as they need to be able to understand and deal with the VLAN tag traffic rather than a different subsegment but it's entierly possible.