Why two laptops on an iPhone hotspot can't talk

Two laptops on the same WiFi. You find each other's IP with ifconfig. You run nc. It works.

Two laptops on the same iPhone hotspot. Same steps. Nothing.

I assumed a hotspot was just a small WiFi router. It's not.

The setup that works

Home WiFi. Two laptops on the same network.

Laptop A (192.168.0.2) ──┐
                          ├── WiFi Router ── Internet
Laptop B (192.168.0.3) ──┘

# Laptop A
nc -l 5000
 
# Laptop B
nc 192.168.0.2 5000

Works. The router forwards packets between devices on the same subnet. Standard LAN.

The setup that doesn't

iPhone hotspot. Two laptops connected.

Laptop A (172.20.10.2) ──┐
                          ├── iPhone (172.20.10.1) ── Carrier ── Internet
Laptop B (172.20.10.3) ──┘

nc -l 5000
nc 172.20.10.2 5000

Silence. Connection refused or timeout. Same subnet. Same command. Doesn't work.

The cause: AP isolation

iPhone's Personal Hotspot runs with AP isolation permanently enabled. The AP (your iPhone) refuses to forward packets between connected clients. Each laptop can reach the phone, and through the phone the internet. They cannot reach each other.

Laptop A → iPhone → Internet     ✓
Laptop B → iPhone → Internet     ✓
Laptop A → iPhone → Laptop B     ✗  AP isolation blocks this

The block is a policy at layer 2. The phone's bridge sees Laptop A's frame destined for Laptop B, consults its rule ("isolation on"), and drops it. No packet ever leaves the phone's LAN interface. The carrier is not involved. NAT is not involved. This is entirely a decision inside the phone.

Why Apple locks this

Three things Apple values, stacked:

1. Security by default. Coffee shop hotspot: random strangers should not be able to see each other's nc listeners.
2. iPhone as client, not router. Apple's mental model is that the phone is a terminal device. Router features (port forwarding, DMZ, isolation toggle, QoS) are deliberately absent.
3. Support cost. Fewer knobs, fewer tickets.

No user setting. No developer API. No MDM profile key. Not even hidden behind an entitlement. It is just off.

Android varies. Pixel and stock Android usually allow clients to talk. Samsung and some vendors have started adding the toggle, sometimes on by default. iOS is the one that is always on, always locked.

The workaround: Tailscale

The cleanest way around this is an overlay VPN. Tailscale is the default recommendation.

# Both laptops
brew install --cask tailscale
# Open the app, log in to the same account on both

Each laptop gets a Tailscale IP (100.x.x.x). Use those to reach each other:

# Laptop A
nc -l 5000
 
# Laptop B (use Tailscale IP, not the hotspot's 172.20.10.x)
nc 100.64.1.5 5000    # works

Why it works: Tailscale runs at L3 on top of the internet. Both laptops reach out through the iPhone's NAT to the Tailscale coordinator, which helps them find each other and punch a direct peer connection via WireGuard. The AP bridge never needs to forward sideways traffic, so AP isolation has nothing to block.

The irony: your two laptops sitting a foot apart are now connected by a round trip through the carrier, but the connection is solid and the latency is surprisingly low once NAT traversal settles.

Alternatives if Tailscale is off the table:

• A small travel router. Use the iPhone as WAN (USB tether or client WiFi), let the travel router be the real AP. Laptops connect there, free to talk.
• USB tether one laptop, then have it share its connection as a WiFi hotspot to the other laptop. That laptop becomes the router.

Both work but require extra hardware or awkward config.

Summary

An iPhone hotspot looks like a small router. It's not. It's a deliberately crippled AP that gives you internet and nothing else. If you need two laptops to actually talk while tethered, you route them through the internet via Tailscale. Apple didn't leave a door; you build one.