Nebula SSID Layer 2 isolation and network scanners

Hi @HPITS ,

With the current mechanism of L2 isolation, it is to

• Allow multicast packets,
• Allow broadcast packets
• Allow packets from a configured Wi-Fi interface if the destination MAC is on the list (e.g., GW MAC)
• Drop other packets from the configured Wi-Fi interface.

Usually, scanner software will send an ARP request to ask all the IPs in a subnet and ARP request is broadcast. Though ARP reply is unicast, it will be allowed since its source interface is not the Wi-Fi's L2 isolation interface. Once the scanner receives an ARP reply, it knows the corresponding IP has a device.

Reversing rules 3 & 4 (only allowing packets from whitelisted MACs on the Wi-Fi output interface, others are dropped) can block the ARP reply part, but this software will still use UPnP or Bonjour (mDNS) to find services. They are of the allowed multicast type, so they can still be discovered.

In addition, if blocking broadcast/ multicast, there may cause abnormalities in some applications.

To sum up, in the network with wired clients, please refer to the port isolation feature to check whether achieve the requirement. For AP, since all Ethernet devices are on the uplink port side, it is not possible to achieve the same effect as port isolation.