diff --git a/wifi/configs.py b/wifi/configs.py
index 7518872..11867b2 100644
--- a/wifi/configs.py
+++ b/wifi/configs.py
@@ -77,6 +77,7 @@
 {require_ht}
 {require_vht}
 {hidden}
+{ap_isolate}
 
 ht_capab={ht20}{ht40}{guard_interval}{ht_rxstbc}
 {vht_settings}
@@ -275,6 +276,7 @@
   enable_wmm = 'wmm_enabled=1' if opt.enable_wmm else ''
   hidden = 'ignore_broadcast_ssid=1' if opt.hidden_mode else ''
   bridge = 'bridge=%s' % opt.bridge if opt.bridge else ''
+  ap_isolate = 'ap_isolate=1' if opt.client_isolation else ''
   hostapd_conf_parts = [_HOSTCONF_TPL.format(
       interface=interface, band=band, channel=channel, width=width,
       protocols=protocols, hostapd_band=hostapd_band,
@@ -282,7 +284,8 @@
       require_ht=require_ht, require_vht=require_vht, ht20=ht20, ht40=ht40,
       ht_rxstbc=ht_rxstbc, vht_settings=vht_settings,
       guard_interval=guard_interval, enable_wmm=enable_wmm, hidden=hidden,
-      auth_algs=auth_algs, bridge=bridge, ssid=utils.sanitize_ssid(opt.ssid))]
+      ap_isolate=ap_isolate, auth_algs=auth_algs, bridge=bridge,
+      ssid=utils.sanitize_ssid(opt.ssid))]
 
   if opt.encryption != 'NONE':
     hostapd_conf_parts.append(_HOSTCONF_WPA_TPL.format(
diff --git a/wifi/wifi.py b/wifi/wifi.py
index bd796a1..9ba8b31 100755
--- a/wifi/wifi.py
+++ b/wifi/wifi.py
@@ -40,6 +40,7 @@
 bssid=                            BSSID to use []
 e,encryption=                     Encryption type to use (WPA_PSK_AES, WPA2_PSK_AES, WPA12_PSK_AES, WPA_PSK_TKIP, WPA2_PSK_TKIP, WPA12_PSK_TKIP, WEP, or NONE) [WPA2_PSK_AES]
 f,force-restart                   Force restart even if already running with these options
+C,client-isolation                Enable client isolation, preventing bridging of frames between associated stations.
 H,hidden-mode                     Enable hidden mode (disable SSID advertisements)
 M,enable-wmm                      Enable wmm extensions (needed for block acks)
 G,short-guard-interval            Enable short guard interval