Blocking Traffic Between LAN Clients

[Denna]

All clients are connected to the same Asus RT-AC88U router via Ethernet.

The router IP address is 192.168.1.1 and the client IP addresses are 192.168.1.2 - 192.168.1.9.

The Asus RT-AC88U has 8 ports and two switches with 4 Ethernet ports on each switch.

Using iptables, how would you prevent the clients from connecting to each other ?

 

[pege63]

Could use Guest network for all, they would only get internet access.

 

[Denna]

pege63,

That might be usable, but I wonder if it wouldn't have some unforeseen drawbacks. What drawbacks ? I don't know ... they're unforeseen !

Would this work ?

Use ipset to create a blacklist of internal clients.​

iptables -I FORWARD -m set --match-set blacklist src -j DROP​