Virtual Gateway Isolation (VGI): Layer 2 MAC Segmentation

On standard home or office routers, every connected client device observes the exact same gateway MAC address in its local ARP cache. In high-density QA automation labs, multi-tenant development environments, and isolated enterprise subnets, sharing a single physical gateway MAC can cause infrastructure identity conflicts and ARP cache cross-talk across test groups.

WifiSocks provides Virtual Gateway Isolation (VGI) to assign an independent, unique virtual router MAC identifier to each connected device at Layer 2.

1. How Virtual Gateway Isolation Works

When VGI is enabled in the admin dashboard, the router generates unique virtual gateway credentials for each device:

At the network layer, each client device resolves an isolated virtual gateway identity, ensuring complete Layer 2 network segmentation without requiring separate physical gateway hardware.

2. Enabling VGI in the Admin Dashboard

1. Open the router dashboard (http://192.168.105.1).
2. Click Manage LANs in the top navigation bar to open the LAN Management modal.
3. Locate the setting Assign Independent Gateway MAC per Device (VGI).
4. Turn the toggle switch to On.
5. Select your preferred generation mode:
   • Dynamic Randomized (IEEE 802c): Creates a new randomized virtual router MAC every time a device connects or renews its lease.
   • Deterministic Hash: Creates a consistent, stable virtual router MAC derived from the device hardware address.
6. Click Update to save and apply.

3. How to Verify

1. Connect two different phones or computers to the router.
2. Check the gateway MAC address on both devices:
   • On Windows: Open Command Prompt and type arp -a.
   • On macOS / Linux: Open Terminal and type arp -n.
   • On Android / iOS: Check the router gateway details in your Wi-Fi network settings.
3. Compare the router physical addresses: each device will show a completely different MAC address for 192.168.105.1.

4. Recommended Best Practices

• Pair with Client Isolation: Turn on Block direct peer-to-peer device communication under Router Configuration -> Client Isolation so devices cannot see or scan each other across the network.
• Pair with Multi-SSID: If devices connect over Wi-Fi, create separate Wi-Fi names under Manage Wi-Fi Networks with Assign distinct MAC (BSSID) for each Wi-Fi enabled to keep wireless domains separated.