IPTABLES rule for separating users [closed]

Question

I have an OpenWrt 10.03 router [ IP: 192.168.1.1 ], and it has a DHCP server pool: 192.168.1.0/24 - clients are using it through wireless/wired connection. Ok!

Here's the catch: I need to separate the users from each other.

How i need to do it: by IPTABLES rule [ /etc/firewall.user ].
Ok!
"Loud thinking": So i need a rule something like this [on the OpenWrt router]:

- DROP where SOURCE: 192.168.1.2-192.168.1.255 and DESTINATION is 192.168.1.2-192.168.1.255

The idea is this. Ok!

Questions!
- Will i lock out myself if i apply this firewall rule?
- Is this a secure method? [ is it easy to do this?: hello, i'm a client, and i say, my IP address is 192.168.1.1! - now it can sniff the unencrypted traffic! :( - because all the clients are in the same subnet! ]
- Are there any good methods to find/audit for duplicated IP addresses?
- Are the any good methods to find/audit for duplicated MAC addresses?
- Are there any good methods to do this IPTALBES rule on Layer2?:
$ wget -q "http://downloads.openwrt.org/backfire/10.03/ar71xx/packages/" -O - | grep -i ebtables $

p.s.: The rule would be [is it on a good chain?]: iptables -A FORWARD -m iprange --src-range 192.168.1.2-192.168.1.255 --dst-range 192.168.1.2-192.168.1.255 -j DROP
Thank you!

Answer 1

Is this isolation for the wired client? Wireless?

If Wireless, look here. http://www.wirelessforums.org/alt-internet-wireless/client-isolation-ap-isolation-how-does-work-774.html

If you want to stop wired clients from talking to each other, you can't do it with iptables. The clients talk directly to each other and don't use the router/gateway except for request outside the network.

The only way to really do this correctly on a wired network is with the magic of VLANs.

Also, for detecting changing IP addresses. http://en.wikipedia.org/wiki/Arpwatch

Answer 2

I've played around with setting a /32 subnet for DHCP and then forcing a default route to the gateway which will work okay, there are ways around it and it has messed up linux clients in the past (NetworkManager seems to handle this okay now).

Another method I've played with is setting up an "AnyIP" type setup. Essentially you arp poison the network to try and trick every connecting user into thinking your any and all other IP's. THIS IS A BAD IDEA lol. The nomadix people do this but it's really annoying and breaks many things.

VLANs are your best bet like Porch suggested. Nothing beats proper managed switches :)