Blocking Ethernet clients from connecting to each other

[Denna]

This is for a home network that doesn't share resources.

Is this the easiest way to block Ethernet clients on the same router from connecting to each other ?

1) Configure the WebGUI DHCP address range. For example, 192.168.1.2 - 192.168.1.4.​

2) Create a /<path>/dhcp_cli.sh script file

3) Run chmod +x /<path>/dhcp_cli.sh

4) Fill the dhcp_cli.sh script with the DHCP addresses

ipset -N DHCP_CLI hash:ip

ipset add DHCP_CLI 192.168.1.2
ipset add DHCP_CLI 192.168.1.3
ipset add DHCP_CLI 192.168.1.4
​

5) Run the /<path>/dhcp_cli.sh script

6) Create iptables rule

iptables -A FORWARD -m set --set DHCP_CLI -src,dst -j DROP​

 

[Nullity]

You would require a managed switch to block clients on the same LAN. Or use the firewall on the actual clients themselves. Or alternatively use both a VLAN aware router and a managed switch.

Whenever LAN clients connect to each other it's mostly an ethernet/MAC (layer 2) thing, which a router (Layer 3) is unconcerned with. https://en.wikipedia.org/wiki/OSI_model#Description_of_OSI_layers