ClientIsolation

Client isolation is a network feature that restricts direct communication between wireless clients connected to the same access point or network segment. When enabled, a device on the network cannot directly reach other wireless devices on the same subnet, effectively separating client devices at layer 2 while still allowing access to the external network through the gateway or to centrally provided services, if permitted by the network configuration.

The mechanism typically operates at the access point or switch level. It creates an access control policy that blocks traffic between client hosts on the same SSID or VLAN, while allowing traffic to the default gateway and to internet resources or to services hosted on shared infrastructure that do not require direct client-to-client communication. In some devices, client isolation is implemented as a per-SSID feature or as an option within the guest network configuration.

Common use cases include guest networks in homes, hotels, cafes, and corporate environments where user devices should not discover or interact with each other for security and privacy reasons. It is also used to mitigate lateral movement in networks containing IoT devices that may be less secure or more prone to compromise.

Limitations and considerations include potential disruption to legitimate local communication, such as printer sharing, local media streaming, or LAN gaming, unless access to specific resources is explicitly allowed through central servers or exceptions. Client isolation is not a substitute for comprehensive network segmentation or firewalling; it complements VLANs, firewall rules, and intrusion prevention measures.

Configuration generally involves enabling an option labeled as AP isolation, client isolation, or guest isolation in the wireless controller or access point management interface, and may be applied per SSID or per VLAN depending on the hardware.