How to filter ARP-Requests with Nftables using a Raspberry Pi as AP (using hostapd)

Question

I´m trying to filter ARP-requests coming from certain IP-addresses in my network. I tried :

table arp filter {
        chain input {
                type filter hook input priority 0; policy drop;
                arp saddr ip 192.168.2.1 counter accept #ISP-Router
                arp saddr ip 192.168.1.100 counter accept #Laptop
                arp operation reply counter accept}}

It should drop all ARP-requests not coming from either the router or the laptop. But requests send by my smartphone are still recieved by my laptop. (My Pi acts as routed access point, it is connected to the ISP-Router via ethernet and uses interface wlan for AP function.)

Then I tried to use table netdev with ingress hook because (at least in theory) it should resolve first:

table netdev wlan {
        chain wlanFilter {
                type filter hook ingress device wlan0 priority 0;
                meta protocol arp counter drop # ARP-requests were still getting from smartphone to laptop, but ARP-Cache on Pi was incomplete afterwards  
                meta pkttype {broadcast, multicast} counter drop # didn´t filter ARP Broadcast}}

I also tried to use the hostapd function ap_isolate=1. Same result.

I use Raspberry Pi OS with kernel version 5.10.17-v7+, hostapd version 2.8-devel, nft version 0.9.6, dnsmasq version 2.80. ip_forward is active and NAT aswell. I wasn´t using a bridge but to be thoroughly: I tried table bridge with similar rules, no success. I then changed the whole setup to bridged access point instead of routed. I tried all rulesets again. Didn´t work either.

Could it be, that Hostapd forwards packets to the local network before packetfilter like Nftables are enforced? Or is there something wrong with my ruleset? Or is it something else altogether?

Answer 1

As some in the comments suggested, the key was the option ap_isolate in hostapd.conf. It didn´t work before because of missing support from the driver of the BCM43455 chip which is the built-in NIC of the Raspberry Pi 3 B+. It does work with the RT5370 chip used in some Wifi Dongles. Therefore I used one of those in my setup.

I needed to change some configurations aswell.

First: activate predictable interface names in raspi-config to bind the name to the MAC address. Without it the names for wlan0 (internal card) and wlan1 (external card) would sometimes swap after reboot.

Second: deactivate built-in card with sudo rfkill list -> sudo rfkill block <number of interface of built-in card> to avoid conflicts between the NICs.

Then I followed the answer of user A.B on https://superuser.com/questions/1661060/hostapd-how-to-block-only-netbios-broadcasts-to-clients-in-same-wlan-by-applyin to activate hairpinning.

Now I could create rules to filter local traffic using the bridge family. For example:

table bridge br0 {
        chain forward {
                type filter hook forward priority 0; policy drop;
        }
}

can be used to isolate all clients. Further rules could be used to allow certain communication:

table bridge br0 {
        chain forward {
                type filter hook forward priority 0; policy drop;
                ether type arp accept
        }
}