Last updated:
AP isolation, also called client isolation, restricts communication between wireless clients within the scope implemented by the access point. It can help on guest WiFi, but it is not automatically a firewall between every guest, wired device and main-network resource. A guest-network policy and client isolation solve different parts of that problem.
Three controls to distinguish
| Control | Main purpose | What to verify |
|---|---|---|
| AP/client isolation | Restrict peer communication among wireless clients | Scope across bands, access points and wired paths |
| Guest-network isolation | Restrict guests from the main LAN | Whether the router really blocks local resources |
| VLANs plus access rules | Separate groups and control traffic between them | Router, switch and access-point configuration together |
Terms such as “Net Isolation” are vendor-specific. Two differently named WiFi networks do not by themselves prove that traffic between them is blocked.
TP-Link example
TP-Link documents AP isolation on its Pharos products under Wireless > Advanced Wireless Settings, with a per-SSID option in supported Multi-SSID operation. Its Pharos instructions also state that the function is not available in Client mode. Do not apply this menu path to every Archer, Deco or Omada model.
ASUS example and wired-path limits
ASUS documents a Set AP Isolated control in supported router interfaces. Check the correct wireless band and apply the setting using the firmware’s instructions. Its isolation FAQ includes scenarios in which traffic carried through a wired path is outside the expected AP-isolation effect. This is why a mesh or second access point needs testing rather than a universal yes/no assumption.
Why printing or casting can stop working
A printer, casting receiver or local file server needs communication beyond simple internet access. Client isolation, guest-to-LAN blocking or multicast-discovery restrictions can stop that communication. A device may have working web access while its printer remains undiscoverable.
For a trusted printer, place the necessary devices in an appropriate trusted group or use a narrowly supported access rule. Turning off all guest protection to fix discovery is a broad change. Our Windows-to-Linux sharing guide covers another local-service example.
Test the boundaries you intend
- Confirm that a guest can reach the internet.
- Try reaching a known main-LAN service that should be blocked.
- Test peer access between guest devices on the same AP and on different bands or nodes.
- Check wired guests separately where supported.
- Recheck allowed printers or casting services after the change.
A failed ping alone is weak evidence: a host firewall may already block it. Test a known service and relevant router logs. Our segmentation guide explains a more complete policy, and the DHCP guide helps when the underlying problem is receiving the wrong address or subnet.