I have a home network with various servers and routers (192.168.x.x).

I want to use the Raspberry Pi 3 to setup an isolated WiFi AP (guest AP) such as computers that connect to the Rasp WiFi have internet access but cannot connect to anything else on the home LAN.

I have used the following script (https://github.com/harryallerston/RPI-Wireless-Hotspot) go build a Rasp3 WiFi AP sharing the eth0.

However how can I disallow any access to or from other computers on the LAN but allow internet access?

  • What is the output of "route -n" ? – MatsK Aug 5 '17 at 13:29

As you said, create an access point on your Pi with the range 172.16.X.X for example.

Now on your router you must create an ACL that blocks traffic from the 172.16.X.X network to the 192.168.X.X.

Now allow network traffic 172.16.X.X to the IP address (for example) of Pi.

Then allow traffic from network 172.16.X.X to all networks (

Thus the machines connected to Wi-Fi Pi will no longer have access to your network but just Internet


You didn't write whether you're using routing or bridging. With routing I assume also NAT between the guest net and your home net. In this case, add filter rules that drop all packets that come in from your guest net and which are destined to your home net, except for the router. While not always strictly necessary to exempt the router, it might be needed when its DNS proxy and other services need to be used.

With bridging, things become more difficult, as you need to add IP filter rules that are run inside the bridge; this is possible, as ebtables in Linux support this.

However, better would be to separate both home and guest net completely instead of attaching the guest net in the home net.

As I final note I suspect it far more easier and quicker to get a suitable home router that does exactly that right out of the box, but of close this lacks the lulz and lemming factor.

  • I am routing using iptables – ECII Aug 6 '17 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.