topic Re: R510 Unleashed: Isolate some clients (Wireless client isolation vs ACL?) in Unleashed

R510 Unleashed: Isolate some clients (Wireless client isolation vs ACL?)

PeterPan — Fri, 16 Jan 2026 20:26:45 GMT

Hello everyone,

after searching the web and this forum for quiet some time I could not find a clear answer or explanation to my question.
I have a wifi where I want to isolate all devices except 2, that need to be able to communicate with each other. The "Wireless Client Isolation" options in the "Others" tab of a WLAN will not work since they isolate everything or they permit every device to access the two devices that should only talk to each other.
Therefore i hoped that I could make use of an Layer 3/4 ACL in the "Access Control" tab.

in addition to the two predefined rules (DNS and DHCP) I added

Allow 192.168.90.10/32 to 192.168.90.11/32 with every option set to "Any"
Allow 192.168.90.11/32 to 192.168.90.10/32 with every option set to "Any"
Deny 192.168.90.1/24 to 192.168.90.1/24 with every option set to "Any"

With this setting in place I can still ping every device from every other device on the WLAN.
If I enable "Wireless Client Isolation" in addition to the ACL, even the two allowed devices stop communicating, to this option seems to have a higher priority that the ACL.

All the testing I have done seem to show that Layer 3/4 ACLs are not working. So my questions are:

How do ACL and Wireless client isolation interact with each other?
How are ACLs supposed to work?
How can i isolate all clients except specific ones?

Ruckus R510 with Unleashed 200.15.6.212.27

Re: R510 Unleashed: Isolate some clients (Wireless client isolation vs ACL?)

PeterPan — Fri, 16 Jan 2026 20:20:46 GMT

After some more research it seems that specific IP addresses or subnets in the Source and Destination field will make a rule getting ignored. In this case, the choosen default action (allow or deny) will be applied. The only way to have an ACL rule getting applied is when Source and Destination are set to ANY.

For testing I created the following example:
Default = deny
Rule 3 = allow ANY
--> traffic is allowed

When i enter an IP adress or subnet in either Source or Destination Field or both, all traffic is denied even though all devices should be able to contact 192.168.90.10.
Default = deny
Rule 3 = allow Source 192.168.90.1/24 to Destination 192.168.90.10/32
--> All traffic is denied.

Can someone confirm this?
Is there someting obvious I am missing?

Re: R510 Unleashed: Isolate some clients (Wireless client isolation vs ACL?)

PeterPan — Tue, 20 Jan 2026 22:30:05 GMT

Bump.

is annyone able to test and confirm this behaviour or to point out the mistake i made while creating the rules?
Any help is appreciated.

Re: R510 Unleashed: Isolate some clients (Wireless client isolation vs ACL?)

Rohit_W — Fri, 17 Apr 2026 16:55:31 GMT

Hi Peter,

I would recommend you to create a ticket with us to troubleshoot this issue.

Please use the below link to create a new ticket:
https://support.ruckuswireless.com/contact-us

Regards,
Rohit Walawalkar
Technical Support Engineer -EMEA
Work Hours: Monday-Friday, 9 AM to 5 PM GMT
Location: India