Using a network switch and access point to bypass AP/SPI isolation on the ZTEF670L is technically impossible because the isolation is enforced at the router's internal firewall level, not by physical port connectivity. The modem simply blocks traffic between its wireless clients and wired LAN ports regardless of external hardware configuration. To achieve your goal, you must either disable the feature in settings or use a secondary router.
Understanding AP/SPI Isolation
The term AP/SPI isolation, often referred to as Client Isolation or AP Isolation, is a security feature found in most consumer-grade modems and routers. Its primary purpose is to prevent devices connected to the same Wi-Fi network from communicating with each other. This is useful in public hotspots to protect user privacy, but it is often frustrating for home users who want to share files or print wirelessly. When this feature is enabled, the ZTEF670L treats every wireless client as if it were on a separate virtual network. Traffic destined for another local device is dropped before it can reach the internal gateway. It is crucial to understand that this restriction is applied by the router's firmware. Therefore, adding external hardware like a network switch cannot override this software-level block. The switch merely extends the physical layer; it does not change how the router processes packets.The Role of the Network Switch
A network switch operates at Layer 2 of the OSI model. It forwards Ethernet frames based on MAC addresses. If you connect a switch to one of the LAN ports of the ZTEF670L, all devices plugged into that switch will be on the same LAN segment. However, if those devices are trying to communicate with Wi-Fi clients, the router will still block the traffic due to the active isolation setting. Some users mistakenly believe that wiring a device allows it to "bypass" Wi-Fi restrictions. This is incorrect. The isolation rule applies to the interface itself. Whether a device connects via cable or radio, the router decides whether it can talk to other interfaces. Without changing the router's configuration, no amount of cabling will create a bridge between isolated segments. Connecting Three Routers: Main Router, Bridge, and Access Point demonstrates how proper network topology can solve segmentation issues, but it requires configuring the main device correctly first.Why External Hardware Cannot Bypass the Setting
Attempting to use an access point or additional switch to circumvent the isolation setting is a common misconception. The ZTEF670L manages its own routing table and firewall rules internally. When AP/SPI is enabled, the device drops any packet where the source and destination IPs are both within the local subnet but originate from different interfaces (Wi-Fi vs. LAN).
Even if you set up a complex topology with multiple switches and access points, the bottleneck remains the ZTEF670L. The router sees the traffic leaving the LAN port and entering the Wi-Fi interface (or vice versa) and enforces the drop policy. There is no physical workaround for a logical restriction. You must address the root cause: the router's configuration.
If you are experiencing disconnections while trying to configure such a setup, ensure your wireless adapter is stable. Wifi Keep Disconnecting After Sometime (Wireless Adapter or Access Point) highlights common stability issues that can complicate network troubleshooting.
The Correct Solution: Disable Isolation
The only reliable way to allow communication between wired and wireless devices on the ZTEF670L is to disable the AP/SPI isolation feature through the web interface. This process varies slightly depending on the firmware version, but the general steps are consistent across most ZTE models.
First, connect a computer directly to one of the LAN ports of the ZTEF670L using an Ethernet cable. Open a web browser and enter the default gateway IP address, which is typically 192.168.1.1 or 192.168.0.1. Log in with your administrator credentials. If you have not changed these, they are often printed on the label attached to the modem.
Navigate to the Wireless Settings section. Look for a tab labeled "Advanced," "Security," or "Basic." Find the option named "AP Isolation," "Client Isolation," or "Inter-AP Communication." Set this option to Disabled or Uncheck the box. Save the settings and reboot the modem if prompted. Once the modem restarts, devices on Wi-Fi should be able to ping and communicate with devices on the LAN.
Alternative: Using a Secondary Router
If you cannot access the ZTEF670L settings or prefer not to disable isolation for security reasons, you can use a secondary router. Connect the secondary router's WAN port to a LAN port on the ZTEF670L. Configure the secondary router to obtain an IP address automatically (DHCP). This creates a separate subnet behind the secondary router. Devices connected to the secondary router can communicate freely with each other, but they will still be isolated from the ZTEF670L's Wi-Fi clients unless you configure static routes or port forwarding, which is complex for average users.
For simpler setups, consider configuring an existing device as an access point. Setting Up Raspberry Pi as a WiFi Access Point with Hostapd shows how advanced users can create custom networks, though this requires technical expertise. For standard home users, a dedicated access point configured in bridge mode is more appropriate.
Configuring Xiaomi AC1200 Repeater: Browser-Based Custom SSID Setup in Access Point Mode provides guidance on setting up third-party hardware effectively.
Frequently Asked Questions
Can I use a VLAN to bypass AP/SPI isolation?
No, VLANs do not bypass isolation on the ZTEF670L because the modem does not support VLAN tagging for client isolation. The isolation is applied to all wireless clients regardless of their VLAN assignment. You would need a managed switch and a router that supports VLAN routing, which the ZTEF670L does not provide.
Does disabling AP isolation reduce security?
Yes, disabling this feature allows all devices on your network to see each other. This means any device on Wi-Fi can potentially access shared folders or printers on wired devices. Ensure your devices have strong passwords and firewalls enabled to mitigate risks.
What is the default login for ZTEF670L?
The default IP address is usually 192.168.1.1. The username and password are often "admin" for both fields, or they may be unique to the sticker on the back of the device. If you changed them previously, you will need to reset the modem to factory defaults to regain access.
Why can't I see my wired printer from my Wi-Fi phone?
This is likely due to AP/SPI isolation being enabled. Once you disable this setting in the router's wireless advanced options, your phone should be able to discover and connect to the printer on the local network.
Is there a firmware update that fixes this?
Firmware updates rarely remove basic features like client isolation. Instead, they may add new options or improve stability. Check the manufacturer's website for updates, but do not expect them to change the fundamental behavior of the isolation feature.