2

Is it possible to somehow block ARP on a home wireless network router? Basically I don't want the access point to forward ARP packets between clients. It would also be fine if the access point completely blocks communications between clients. I guess some wireless routers have this feature, but many don't. Is it possible to install some thrid-party firmware that will give me this functionality?

TripShock
  • 173
  • 1
  • 8
  • Note: The reason I want to block ARP is so that I can have multiple clients having the same IP address. Clients use ARP to prevent IP address conflicts, so if I need to do this I need to disable ARP. – TripShock Oct 22 '09 at 00:31
  • How is that going to work? Are you doing some kind of load balancing or something? – Bill Weiss Oct 22 '09 at 21:38

4 Answers4

2

DD-WRT supports a client isolation mode for wireless clients. I am not sure if this is done via ARP or other traffic-shaping methods. You can get DD-WRT for many wireless routers, and it's fairly easy to install (usually).

More info here: http://www.dd-wrt.com/.

Kyle Smith
  • 9,683
  • 1
  • 31
  • 32
2

A router, by definition, routes between different broadcast domains.

If your wireless clients are all on the same broadcast domain and the router has a single interface on this network then it won't have any central involvement in the ARP process. The clients will issue requests to the broadcast address and the relevant client will respond directly.

For this reason the router can't stop the clients from communicating by just not participating in ARP. Nevertheless blocking ARP isn't a very good way to prevent communication anyway. It could easily by bypassed by observing MAC addresses on the wire and adding a static ARP entry.

A different approach will be called for. Nothing springs to mind right now though.

Dan Carley
  • 25,617
  • 5
  • 53
  • 70
1

The easy way to force clients to talk only to the router and nobody else, is to disable ARP on the client, and then add the static ARP entry for the router MAC. This way you can get to the router, and cannot resolve anything else if you try.

Marcin
  • 2,391
  • 1
  • 17
  • 14
0

get a router that supports vlans.

natxo asenjo
  • 5,739
  • 2
  • 26
  • 27