LAN to LAN Network Services Filter?

[azdeltawye]

Hello
Noob question here..

Is there any way to easily isolate a wired client from the rest of the local LAN?

I want to deny a wired IOT device access to the rest of my local LAN the same way that the wireless guest network does when you select the 'Disable intranet access' option. I played around with the Network Services Filter but that only seems to block LAN to WAN packets. I know this can probably be accomplished with scripting but I was looking for a built-in UI option.

Any help would be appreciated.
Thx

 

[eibgrad]

IOT devices requiring isolation should be placed on their own network (in the case of Merlin, one of the 3 available Guest neworks), NOT the private network.

 

[CaptainSTX]

Hello
Noob question here..

Is there any way to easily isolate a wired client from the rest of the local LAN?

I want to deny a wired IOT device access to the rest of my local LAN the same way that the wireless guest network does when you select the 'Disable intranet access' option. I played around with the Network Services Filter but that only seems to block LAN to WAN packets. I know this can probably be accomplished with scripting but I was looking for a built-in UI option.

Any help would be appreciated.
Thx

It can be done with some creative scripting to set up VLANS on your router if it is running Merlin. A simpler way to accomplish it using a GUI is to add a smart switch that supports VLANS. Depends on how much your time is worth. A TP-Link 8 port smart switch costs US$42. They work well and I have set up three VLANS. 1 = IoT, 2 = Video, 3 = secure using mine.

Another option is to flash Tomato Version 1.28 on your router if it is available as it supports both VLANs and virtual APs. Both can be setup using the GUI. Tomato is getting a little long in the tooth.

 

[azdeltawye]

@CaptainSTX - Thanks for the info on the switch! I'll give it a try. I don't think I want to try and learn Tomato. I like the stability of Merlin...

@eibgrad - I totally agree; IOT devices should NOT be on the private network. However the built-in guest network options are only for wireless clients...


Perhaps someday, a future build of Merlin FW will have LAN-LAN & WAN-LAN options in the Network Services Filter.

 

[eibgrad]

There's always freshtomato, which I use for my primary router.

https://www.linksysinfo.org/index.php?threads/fork-freshtomato-arm.74117/
http://freshtomato.org/

Merlin is really nice firmware, but it does lack a few features commonly found in other tomato variants. And if you need those features, perhaps it's worth considering.

FWIW, I have three networks; private (br0), guest (br1), and IOT (br2), each supporting their own wireless and wired clients.