I need to be able to control traffic within a subnet or vlan. The only option I have seen so far is to isolate all clients or let them all see each other. I need to be able to control which devices within inside the same subnet and vlan see other devices. I would be grateful for help.
By definition if two devices are within the same subnet they will communicate with each other directly at layer 2 and not through the gateway (router / layer 3). This means any possible limiting would have to be done via switches or APs. Switch control is via an ACL: https://help.ui.com/hc/en-us/articles/23352709241495-UniFi-Switches-and-Access-Control-Lists-ACLs but can only filter traffic that goes through the switch - for example two clients of the same AP wouldn’t reach the switch when talking to each other. AP filtering is only possible by either setting a wireless network to isolate clients or to enable Guest mode - by default Guest mode will drop all traffic that is destined for a private IP address (RFC1918 ranges) but you can adjust those policies in the Guest Hotspot settings (you have to enable the “Hotspot Portal” on the wireless network, but then if “Guest Portal” is disabled you don’t have to have the captive portal).
1 Like
That’s what I was afraid of. The problem is I have most clients that are wireless and I need several vlans. In my setup, only 4 ssids are possible so I am drastically limited. Plus the more ssids, the less ideal for wireless performance. Any suggestions other than hardwiring (not an option in this case)?
Would you be able to use something like PPSK? PPSK (Private Pre-Shared Key) can be used with a single SSID to assign clients to different VLANs based on the PSK they use to connect. This allows for network segmentation without needing multiple SSIDs, which can be beneficial for reducing network overhead and simplifying management.
The only reason I can’t use PPSK is because it only allows wpa2. 
you might use Wireguard to put machines on different overlay networks which might live on the same VLAN
I haven’t changed to the zone based firewall yet. Does it allow for treating vpns like a vlan? I am using the previous firewall config and can’t find a way.
Yes, sort of. There is a zone that all remote access connections are put into called “VPN”. You can’t separate them from each other or choose to put them into custom made zones, but having a VPN zone at all is a big improvement over the prior setup.
EDIT: The info text on the VPN zone says “Contains VPN Servers and Site-to-Site VPNs that are allowed to access all other built-in zones by default. Policy-Based IPsec VPNs are not included.”
1 Like