Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to somehow block ARP on a home wireless network router? Basically I don't want the access point to forward ARP packets between clients. It would also be fine if the access point completely blocks communications between clients. I guess some wireless routers have this feature, but many don't. Is it possible to install some thrid-party firmware that will give me this functionality?

share|improve this question
    
Note: The reason I want to block ARP is so that I can have multiple clients having the same IP address. Clients use ARP to prevent IP address conflicts, so if I need to do this I need to disable ARP. –  TripShock Oct 22 '09 at 0:31
    
How is that going to work? Are you doing some kind of load balancing or something? –  Bill Weiss Oct 22 '09 at 21:38

4 Answers 4

up vote 2 down vote accepted

DD-WRT supports a client isolation mode for wireless clients. I am not sure if this is done via ARP or other traffic-shaping methods. You can get DD-WRT for many wireless routers, and it's fairly easy to install (usually).

More info here: http://www.dd-wrt.com/.

share|improve this answer

get a router that supports vlans.

share|improve this answer

The easy way to force clients to talk only to the router and nobody else, is to disable ARP on the client, and then add the static ARP entry for the router MAC. This way you can get to the router, and cannot resolve anything else if you try.

share|improve this answer
    
How can I disable ARP on the client? –  TripShock Oct 22 '09 at 0:29
    
ifconfig eth0 -arp –  Marcin Oct 22 '09 at 20:28

A router, by definition, routes between different broadcast domains.

If your wireless clients are all on the same broadcast domain and the router has a single interface on this network then it won't have any central involvement in the ARP process. The clients will issue requests to the broadcast address and the relevant client will respond directly.

For this reason the router can't stop the clients from communicating by just not participating in ARP. Nevertheless blocking ARP isn't a very good way to prevent communication anyway. It could easily by bypassed by observing MAC addresses on the wire and adding a static ARP entry.

A different approach will be called for. Nothing springs to mind right now though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.