Guest network is not isolated from the main LAN

What the audit found

The configuration contains an interface, VLAN or bridge whose name suggests it carries guests or the public — something like guest, hotspot, visitors or public. That is a good design. But there is no active rule in the forward chain of the firewall that drops traffic coming from that segment, so the router forwards packets from guests to your internal network just as it does for trusted devices.

The audit reports this as high: a separate guest network gives a false sense of security if the separation exists only at layer 2 and not in the firewall.

Why it matters

The whole point of a guest network is that you do not have to trust the devices on it. A visitor's phone may carry malware, a contractor's laptop may be running anything, and on a public hotspot you have no idea who is connected. Putting them on their own VLAN or SSID keeps them off your broadcast domain, but the router still routes between networks unless told otherwise.

The realistic scenario is not a targeted attack. It is a laptop infected with something that scans whatever networks it can reach. From the guest VLAN it reaches your file server, the office printer's web interface, the reception PC with an old unpatched service, the camera NVR and the management page of the router itself. Anything with a weak password or a known bug is fair game, and none of your LAN devices expect connections from a hostile source inside the building.

There is also the intentional case: someone who was given the guest WiFi password — a former employee, a neighbour, a customer — and later decides to look around.

A single firewall rule closes this. Guests can still reach the internet, which is all they were meant to have.

What it looks like in Winbox

Open IP → Firewall → Filter Rules and look at the forward chain. A properly isolated guest network has a rule with In. Interface (or Src. Address) set to the guest segment and Action drop, usually restricting Out. Interface List to everything except WAN. If no such rule exists, guests are not isolated.

Find the guest interface itself under Interfaces (VLAN or bridge) or Interfaces → Interface List.

How to fix it

The fix is one rule in the forward chain under IP → Firewall → Filter Rules: match traffic whose In. Interface is the guest interface, VLAN or bridge, whose outgoing interface is anything not in your WAN interface list — that is, your internal networks — and drop it. Traffic bound for the WAN is not matched and continues to the internet as before, so guests keep what they were meant to have and lose the rest. If the guest network is defined by an address range rather than an interface, match on Src. Address with the guest subnet instead.

Two details decide whether the rule works. It assumes an interface list called WAN containing your uplink (Interfaces → Interface List); create it if you do not have one. And it must sit above any general accept rules in the forward chain, but after the accept rule for established and related connections, so that return traffic for guest internet sessions still flows.

The guest segment still gets DHCP and DNS from the router, because those go through the input chain rather than forward. If guests should not reach the router's management services either, add an input rule that accepts only DNS and DHCP from the guest interface and drops the rest. Safe Mode is not strictly needed because the rule does not touch your management path, but it costs nothing to switch on.

Afterwards, connect a phone to the guest network: the internet should work, while your NAS, a printer or the router's LAN address should time out, and the new rule's packet counter should climb. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Guests need to print, or use a Chromecast on the LAN. How do I allow just that?

Add a specific accept rule above the drop: a forward rule from the guest interface to the printer's address and port only, for example. Each exception is explicit and reviewable, which is how a guest network should work. Devices that rely on multicast discovery (Chromecast, AirPlay) also need a helper such as mDNS repeating, which is a separate topic.

My guest network is a hotspot. Doesn't the hotspot isolate it already?

The hotspot handles authentication and the captive portal, not routing. Once a user is logged in, their traffic is forwarded like any other unless the firewall says otherwise. The hotspot adds its own dynamic rules for the portal; the isolation rule above works alongside them.

I use a separate bridge for guests. Isn't that isolation?

A separate bridge or VLAN stops guests from seeing LAN devices at layer 2 (no ARP, no broadcasts), which is necessary but not sufficient. The router still has an address on both networks and routes between them. Only a firewall rule in the forward chain stops that.