https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26681#M1523 I've just done a test in my simple office lab.<BR /><BR />Are you trying to setup a Wireless SSID for clients, but want to keep them from seeing your AP WebUI, right?<BR /><BR />So then, you could leave your Eth port(s) configured as Bridge to WAN in VLAN 4 if you wish or is what you use, <BR />and define an Internal Subnet (any other VLAN) and DHCP scope, assign that to your SSID with Local subnet NAT <BR />and Route to WAN, and these wireless clients get an IP from your 'other' VLAN, and should still get thru your internal <BR />network to the Internet.<BR /><BR />However, with this configuration, no, I could not prevent the wireless VLAN clients from being able to ping the AP's <BR />IP address on the other VLAN/network.&nbsp; <BR /><BR />Depending on your infrastructure switch/router, you might be able to create an ACL on your VLAN 4 that deny's<BR />the Wireless VLAN subnet, from having HTTPS (tcp:443) to your AP's IP address...?&nbsp; My simple network can't<BR />test that ACL. Wed, 13 Jul 2016 20:46:48 GMT michael_brado 2016-07-13T20:46:48Z https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26678#M1520 I'd like to only permit Management from Ethernet Port 1. I don't want any clients to be able to &nbsp;see the management UI. I've tried setting the VLAN for management to VLAN 4 and setting up a Subnet for Port 1 on VLAN 4. I setup a subnet for the Radio on VLAN 1 but the wireless clients can still see the Management interface. Fri, 08 Jul 2016 21:44:36 GMT https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26678#M1520 brett_cherwinsk 2016-07-08T21:44:36Z https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26679#M1521 I'm not sure a standalone AP which acts as a router for both VLAN subnets, can "hide" one of it's Eth IP addresses.<BR /><BR />If you can experiment, can you now Disable port 1, and still manage the AP from an SSID using VLAN 4? Mon, 11 Jul 2016 18:23:03 GMT https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26679#M1521 michael_brado 2016-07-11T18:23:03Z https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26680#M1522 Wouldn't that lock me out of the manager if I can't get in to it vis SSID? Wed, 13 Jul 2016 18:51:23 GMT https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26680#M1522 brett_cherwinsk 2016-07-13T18:51:23Z https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26681#M1523 I've just done a test in my simple office lab.<BR /><BR />Are you trying to setup a Wireless SSID for clients, but want to keep them from seeing your AP WebUI, right?<BR /><BR />So then, you could leave your Eth port(s) configured as Bridge to WAN in VLAN 4 if you wish or is what you use, <BR />and define an Internal Subnet (any other VLAN) and DHCP scope, assign that to your SSID with Local subnet NAT <BR />and Route to WAN, and these wireless clients get an IP from your 'other' VLAN, and should still get thru your internal <BR />network to the Internet.<BR /><BR />However, with this configuration, no, I could not prevent the wireless VLAN clients from being able to ping the AP's <BR />IP address on the other VLAN/network.&nbsp; <BR /><BR />Depending on your infrastructure switch/router, you might be able to create an ACL on your VLAN 4 that deny's<BR />the Wireless VLAN subnet, from having HTTPS (tcp:443) to your AP's IP address...?&nbsp; My simple network can't<BR />test that ACL. Wed, 13 Jul 2016 20:46:48 GMT https://community.ruckuswireless.com/t5/To-Be-Moved/How-to-block-management-from-Wireless-clients-on-ZF-7372/m-p/26681#M1523 michael_brado 2016-07-13T20:46:48Z