0

I have two MacBook Pros and a Cisco RV110W wireless router.

I have created a VLAN with all ports untagged and I linked this VLAN to a Wi-Fi with the option "Wireless Isolation with SSID" on.

From both MacBooks I can successfully connect to the Wi-Fi (previously created) and if I try to ping between them, they can't see each other, which is something I'm happy with.

The problem occurred when I saw in Finder the name of the other MacBook Pro (this has screen sharing (VNC) enabled), so I clicked on it and then provided the credentials, and I was able to connect to the other MacBook Pro, which I thought was not possible due to the Isolation option I enabled in the router.

First Question: How is it possible they can see each other, if pinging between them showed me that they can't communicate with one another, and the Wi-Fi VLAN has isolation enabled?

Second Question: Is Bonjour enabling the communication between them?

Third Question: How can I truly isolate both MacBooks using this router?

  • If you really want true isolation, you could put the devices on two different VLANs, and create ACLs to block traffic from one VLAN to the other. – Ron Maupin Jul 5 '16 at 19:20
  • Unfortunately the RV110w does not allow ACLs between VLANs – Edenshaw Jul 6 '16 at 12:11
  • 1
    I've had folks with Macs think that isolation was broken. What was actually happening was that each device was connecting to "the cloud" (the outside world, apple's chunk thereof, accessible to each endpoint) and passing traffic that way. It can be a subtle thing to sort particularly if you (or your users) are onboard with signing in from every device all the time. – Ecnerwal Jul 7 '16 at 1:57
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 19:12
2

I think SSID isolation is not the same as Client Isolation. Some controllers will have both and I believe they perform two different tasks.

With SSID isolation, it simply means that if you have multiple SSID's and clients connected to them, the clients from different SSID's will not be able to communicate.

With client isolation ( which is what you want ), clients on the same network will not be able to communicate with each other.

It is possible that the ping not going through is a red herring and is not due to the SSID isolation.

If you can, setup a second SSID and connect each Mac Book to a different SSID and see if you can still connect via VNC.

Ideally, if you really want to seperate them, I would go with what Ron said and create two seperate VlAN's and block them of with access control entries.

Hope this helps you on your quest.

SleepyMan

  • I tried what you mentioned (creating both WIFIs, each of them link to a VLAN) but they still can see each other on Finder :S I have also checked ACLs between VLANs, but the RV110w does not allow it :( I'm thinking to install OpenWRT, but I have not found any doc on RV110w – Edenshaw Jul 6 '16 at 12:40
  • If you are not routing between VLANs, then something else is going on. Is your Internet router forwarding between them? – Ron Trunk Jul 6 '16 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.