This has been stated many times. The only way to prevent clients talking to each other over a layer 2 network is for the edge equipment to be set up to prevent this. This has been and will always be the case. On switches this means VLANs and or Port Isolation, on access points this means Client Isolation. If you're choice of equipment doesn't have these basic security settings, I would suggest looking into better hardware.

How is a device in the middle of the network supposed to stop devices right next to each other from talking to each other? The simple answer is that it can't, it can only manage traffic that is going over it.

You're looking at managed switches. Extreme, HP, Foundry, AT, Cisco - that kind of thing.

No, the Horizon value needs to be the same, basically what it's saying is any traffic that comes in on this port with a Horizon number of x, do not let the traffic go out of any of the ports that have the same number set. This is why you will need to leave the Horizon option off of the uplink port, otherwise the traffic will not be able to leave the bridge (not a problem if the MikroTik is the router).

MikroTiks handle VLANs very differently than a real switch will. It is a Linux based device and it handles and deals with VLANs just like Linux will. Whenever you add in a VLAN, what it does is it makes a virtual interface in the router that just so happens to tag all traffic leaving it with the tag and read only traffic coming into it with the right tag. As far as the MikroTik is concerned it's just another usable physical interface, you can assign an IP to that interface, route traffic out of it, or anything else that you can do to a real interface. When you add in a VLAN on switch and assign it to an interface, the switch will not treat that VLAN as a separate interface, all it really does there is tell the switch what ports the traffic is allowed to come in on and out of.

It works, it doesn't help your case.

You don't need VLANs.

Set the same horizon value on client ports, set NO horizon value on the uplink port.

/interface bridge filter
add in-interface=ether2 out-interface=ether3 action=drop

Question: are you running a public Hotspot over WiFi?

If so, you HAVE to run it as an open access point. You cannot use WEP or WPA (which are broken, anyway), and you cannot use WPA2. You would confuse people and make it hard for them to connect, and you would lose customers.

In an open access point ANYONE CAN SEE THE FRAMES THE RADIO SENDS INTO THE AIR. Client isolation does not magically make it so the AP somehow transmits only to the intended client, client isolation only makes it so that clients can't talk to one another. THEY CAN STILL SEE THE TRAFFIC, and can therefore see the MAC and IP address of one another.

You cannot prevent users from stealing access. You can come up with some harebrained schemes like having an open access point where users buy credentials, and then they get limited to 1k up Nd down and instead use the credentials to log into a WPA2 access point that then grants the real access. If you do that - or anything similar - you increase the amount of service calls and reduce purchases to the point that you lose more money than through people stealing access.

Give up. This isn't worth your time.

the people who are stealing are taking mac and IP of an active authorize client so that client will complain that the internet is slow. I don't have a method to know if something wrong with his computer or someone clone his ip and mac as him.

the people who are stealing are taking mac and IP of an active authorize client so that client will complain that the internet is slow. I don't have a method to know if something wrong with his computer or someone clone his ip and mac as him.

No one does. There was no security built into MAC addresses when it was first implemented and as a result you can spoof the MAC of whatever you want. Think of it this way, if you meet two people and both claim to have the same name, but one of them is not telling the truth, how do you know what one is the real one when you only ever have their name to go off of? You can't, when the router gets a packet from said MAC and IP that is a completely valid request it will do what routers do, it has no way of knowing who is the legitimate user or not.

The firewall chains you are describing are inefficient, the Horizon option works much better. As Fewi mentioned, this will ONLY protect the traffic going over the router/switch itself, not the AP. Client Isolation will ONLY ever prevent people from talking to each other over AP itself. The radio cards in a laptop/computer/access points will broadcast signal, and anyone that wants to listen in that is in range can do so. That is the nature of wireless, there is nothing you can do about that.

You can encrypt traffic between the AP and the client itself to prevent someone from understanding it, or make it so the client needs to make a tunnel to the router in order to get online, but these are only realistic options when you control everything about the network up to and including the devices that will connect to the network. Otherwise you are asking to spend most of your time troubleshooting and dealing with support issues on one network for every new client that comes in. If you are in a hotspot kind of situation this is not a viable solution at all. At least by preventing people from scanning each other over the entire network, you are now narrowing it down to a specific area around one AP. You're only course of action is to find out who is doing it and preform some "guest education", or live with this reality.