TomatoUSB

I'm using an N16 with Shibby's 1.28.0000 MIPSR2-112 K26 USB AIO
I have several access points that are connected into a large switch. The switch then connects to my router through br0.

How do I isolate every user from each other on the network.
Example.. I don't want user A to ping user B, or vice versa, but they still connect to the internet.

And can I add two or three exceptions to this rule? If not, thats okay.

I found this but I'm not sure how to implement it.

wl -i wl0.1 ap_isolate 1
ebtables -I FORWARD -i wl0.1 -o wl0.1 -j DROP

I appreciate the help.

Client isolation is a very common feature on many home grade routers. I use a commecial custom system that impliments client isolation by establishing a 3 address subnet for each client. Gateway, client and broadcast. No user can see any other user. Google had a lot of returns that looked interesting.

Another slick trick that some commercial hotspot firmware has is called "Any IP". The controller will assume the gateway and DNS settings of any odd static settings from any client and provide service to it.

have several access points that are connected into a large switch. The switch then connects to my router through br0. How do I isolate every user from each other on the network.

You can't. This has nothing to do with the router and everything to do with the switch.

A switch repeats every received packet to all the other ports. They can merrily ping each other even if the router is unplugged. What you are looking for is a "managed switch". Prepare to spend mucho bucks.

Not really… Cisco SG200-08 = 8 port managed Gb switch. Its not super fast, so don't expect to pair bond all 10 ports for crazy throughput, but for standard workstation internet traffic it's more then powerful enough. Total cost = $100