# AP Isolation for Guest isn't working **URL:** \ **Category:** Router\ **Created:** [January 18, 2026, 9:57am UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700 "2026-01-18T09:57:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ChadW](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/chadw/32/31091_2.png) [@ChadW](https://forum.gl-inet.com/u/ChadW)\ **Post date:** [January 18, 2026, 9:57am UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700/1 "2026-01-18T09:57:25Z")
I am on a Flint 2. I have another OpenWRT AP as well. I set up the Guest network on my Flint 2 and changed the settings to make it a full-blown VLAN. AP Isolate is enabled within the Gl.Inet Networking→Guest menu. I also see under Firewall Zone in Luci that Guest Intra zone forward is disabled. Nonetheless, devices on Guest can talk to each other (tested with ping as well as hitting a self-hosted website). After using Gemini for 2 hours, the only thing I was able to figure out how to block the cross communication was to create the following script to add a layer 2 bridge rule: `nft add table bridge isolation` `nft add chain bridge isolation forward '{ type filter hook forward priority -100; policy accept; }'` `nft flush chain bridge isolation forward` `nft add rule bridge isolation forward ether type vlan vlan id 100 counter drop` Is this an issue with the router firmware or perhaps it’s broken because I converted the subnet into a full blown vlan? FWIW, I also disabled Flow offloading and wed via /etc/modules.d/mt7915e to no avail (flow offloading was disabled because it was causing other issues with smoothly transitioning between APs w/o dropping packets – a different problem that I don’t want to get hung-up on in this thread. I also tried a Traffic rule to drop guest-guest zone packets but that didn’t do anything w/o the above nft rule. ---
**Author:** ![will.qiu](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/w/b38774/32.png) [@will.qiu](https://forum.gl-inet.com/u/will.qiu)\ **Post date:** [January 19, 2026, 8:19am UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700/2 "2026-01-19T08:19:23Z")
Hi, The **AP Isolation** function only applies to devices on the **Guest Wi-Fi**. If you have added **Ethernet (ETH) ports** to the Guest network, this isolation will not be effective for those wired devices. Furthermore, if you wish to implement isolation that includes Ethernet ports, you must manually add **nft (nftables) rules** to block forwarding at the **bridge level** , rather than at the **IP level** where firewall rules are typically created in Luci. ![image](https://forum-static.gl-inet.com/original/3X/8/c/8c6f0fe1d4924ae45b30299b356ac2a6d2622b8a.png) ---
**Author:** ![ChadW](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/chadw/32/31091_2.png) [@ChadW](https://forum.gl-inet.com/u/ChadW)\ **Post date:** [January 19, 2026, 5:10pm UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700/4 "2026-01-19T17:10:22Z")
I was only testing communication of devices that are on guest wifi. Perhaps however this is a problem because I do have a tethered AP to an ethernet port and some devices are connected to that AP's wifi which shows up on the Flint2 as an ethernet connected device. If that's the case, is the nft table rule I applied my only solution? Also, I had to create a script to apply that rule at start-up because I couldn't figure out a way for it to save between reboots. Is there a better way to do this? ---
**Author:** ![will.qiu](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/w/b38774/32.png) [@will.qiu](https://forum.gl-inet.com/u/will.qiu)\ **Post date:** [January 20, 2026, 10:28am UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700/5 "2026-01-20T10:28:14Z")
In this situation, nftables firewall rules are likely the only solution. > [@ChadW](#): > > Also, I had to create a script to apply that rule at start-up because I couldn't figure out a way for it to save between reboots. Is there a better way to do this? You can place your custom rules in the `/etc/nftables.d/` directory. ---
**Author:** ![system](https://forum-static.gl-inet.com/original/3X/7/7/77e28f6cb342ac4bd641bd9a6254595d61b2812a.png) [@system](https://forum.gl-inet.com/u/system)\ **Post date:** [May 13, 2026, 10:41am UTC](https://forum.gl-inet.com/t/ap-isolation-for-guest-isnt-working/66700/7 "2026-05-13T10:41:12Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.