LAN Subnets & Zero-Trust Client Isolation Setup
Table of Contents
WifiSocks gives you full control over your local network address range and device isolation. You can change your router gateway IP, adjust DHCP lease timing, and prevent connected phones or computers from scanning or communicating with each other over the local network.
1. Managing LAN Network Settings
Click the Manage LANs button in the top navigation bar to open the LAN Management modal:
| Setting Name | What It Controls | Recommended Value |
|---|---|---|
| IP Address | The router gateway address used to open the dashboard. | Default: 192.168.105.1. You can change this if your upstream modem uses the same range. |
| Prefix length | Subnet size determining how many total devices can connect. | Default: 24 (up to 254 devices). Use 22 (up to 1,022 devices) for high-density setups. |
| LAN Port | Physical port assignment for this local network. | Map to available physical router ports. |
| DHCP Start | The starting IP address given to client devices. | Default: .2 or .10. |
| DHCP Limit | Maximum number of devices that can receive an automatic IP. | Match your expected total device count. |
| DHCP Lease Time | How long an IP address is reserved before recycling (in minutes). | Set to 10 minutes for testing labs with frequent rotation; 60 to 120 minutes for stable setups. |
| Assign Independent Gateway MAC per Device (VGI) | Enables Virtual Gateway Isolation at Layer 2. | Turn on to assign a unique gateway MAC to each device. See Virtual Gateway Isolation. |
Click Update (or Update LAN Network) to save any changes.
2. Zero-Trust Client Isolation
In standard office or home networks, all devices connected to the same router can see each other, ping each other, and scan open ports.
In WifiSocks, you can stop all direct communication between devices using the Client Isolation card under Router Configuration:
flowchart TD
subgraph Client Isolation Active
Phone1["Device 1 (e.g., Phone A)"]
Phone2["Device 2 (e.g., Phone B)"]
Printer["Whitelisted Printer / NAS"]
Phone1 -.->|"Direct Connection Blocked"| Phone2
Phone1 -->|"Allowed to send print jobs"| Printer
end
How to Configure Client Isolation:
- Open the dashboard (
http://192.168.105.1). - Go to the Router Configuration tab.
- Locate the card titled Client Isolation.
- Configure the three isolation settings:
- Block direct peer-to-peer device communication: Turn this toggle On to completely block client devices from seeing, pinging, or scanning each other over LAN and Wi-Fi.
- Trusted Exception Devices List: If you have an office network printer or a shared file server (NAS) that devices need to use, select it in this list.
- Allow two-way connections for exception devices:
- Off (One-Way): Only the printer/server can contact other machines.
- On (Two-Way): Client devices can actively connect to the printer/server (for example, to send print jobs or transfer files).
- Click Update at the bottom of the page to apply.
3. Important Advice for Network Switches
- Direct LAN or Wi-Fi: When devices connect directly to the router LAN ports or built-in Wi-Fi SSIDs, client isolation is enforced automatically.
- Using an External Switch: If you connect multiple devices to an external unmanaged switch (a standard plastic multi-port splitter) before plugging into the router, the switch may pass traffic between its own ports locally. For complete wired isolation, plug devices directly into the router or use a managed switch with Port Isolation enabled.
4. Common Troubleshooting
You changed the router IP and cannot open the dashboard
- Open your browser and type the new IP address you configured.
- Unplug and reconnect your Ethernet cable (or disconnect and reconnect Wi-Fi) so your computer receives a new IP address matching the new subnet.
Cannot print to a shared office printer
- Make sure the printer is selected in the Trusted Exception Devices List.
- Verify that Allow two-way connections for exception devices is toggled On.
