A teacher sent you here because students can't reach their quiz game. This page tells you exactly what the app does on your network, what usually blocks it, and the specific settings to check — written by someone who does school IT for a living.
QuizBlast is a native macOS app on one teacher's Mac. It runs an HTTP + WebSocket server bound to the Mac's local IP. Student devices connect to it directly with a plain browser — there is no app on student devices and, in local mode, no cloud service involved.
Student devices must be able to open a TCP connection to one staff Mac on port 8080 — which means an exemption from wireless client isolation, a permit through any student↔staff VLAN ACL, and an allow rule in your content filter for that raw-IP URL.
All three produce the same symptom — the student's browser spins forever — and all three are invisible to the teacher. Check them in this order.
The number-one cause. On student and BYOD SSIDs, isolation blocks all peer-to-peer traffic at layer 2 — clients can reach the gateway and the internet, but never each other. QuizBlast's server is a peer, so student devices simply time out. There is no app-side workaround; the fix is an exemption for the teacher Mac (most vendors support an allowlist) or disabling isolation on the SSID teachers actually use. Vendor-by-vendor settings are below.
Teacher Macs typically live on a staff VLAN and student devices on a student VLAN, with ACLs that block inter-VLAN traffic or allow only 80/443. QuizBlast needs TCP 8080 from the student VLAN to the teacher's IP (or to the staff subnet). A single permit rule scoped to that port is enough — no need to open the VLANs to each other generally. A DHCP reservation for the teacher's Mac keeps the rule stable.
Securly, Lightspeed, and GoGuardian filter on the student device itself, so this applies even when the Wi‑Fi is wide open. Raw-IP HTTP URLs look like filter-evasion and many district policies block IP-literal browsing outright — the giveaway is your district's block page appearing on some students' screens but not others (different policy groups). The filter needs its own allow rule for the teacher Mac's IP (and port 8080) — separate from any firewall or wireless change. This is the step everyone forgets.
Feature names and menu paths below come from each vendor's own documentation (checked August 2026). Firmware updates shuffle menus, but the feature names travel well.
Several vendors' isolation exemptions only cover wired destinations (Ruckus and Aruba say so explicitly). A teacher Mac on ethernet is also a steadier game host. If there's a live jack in the room, use it — then you're exempting a wired server, the easy case everywhere.
The per-SSID feature is "Layer 2 LAN isolation" (bridge-mode SSIDs, off by default):
Wireless → Configure → Firewall & traffic shaping → [SSID] → Layer 2 LAN isolation
Exemption: on MR firmware 31.1.6+ the isolation setting takes a MAC allowlist (up to 16 entries) — add the teacher Mac's MAC address. On older firmware there's no per-device carve-out; disable isolation on that SSID and constrain with L3 firewall rules instead. Note that NAT-mode SSIDs isolate always and can't be exempted — the class needs a bridge-mode SSID.
Look for "Client Isolation" and the "Deny Intra VLAN Traffic" toggle (older gear: "deny inter user bridging"):
Central → Devices → Access Points → Config → WLANs → [SSID] → Advanced → Miscellaneous
Exemption: there's no per-client allowlist; isolation trusts a table of wired server destinations ("wired servers used in the network should be manually configured into this subnet table"). A teacher Mac on ethernet can be added as a trusted server; a wireless one can't — for Wi‑Fi-only rooms, turn the toggle off for the staff SSID. On Instant On (the SMB line), guest networks isolate by default — run the game on the employee network.
The feature is "Wireless Client Isolation," and Ruckus has the cleanest exemption: a first-class Client Isolation Whitelist taking MAC + IP entries.
Network → Wireless → Wireless LANs → [WLAN] → Configure → Isolation Whitelist
Exemption: add the teacher Mac's MAC and IP to the whitelist (older SmartZone: Services & Profiles → Access Control → Client Isolation Whitelist). Ruckus documents the whitelist as working for wired destinations — ethernet for the teacher Mac makes it bulletproof.
The per-WLAN checkbox is "Client Device Isolation":
Settings → WiFi → [network] → Advanced (Manual) → Client Device Isolation
Exemption: none exists for the checkbox — there's no allowlist. The UniFi way is to leave Client Device Isolation off and use Traffic Rules / firewall rules or switch ACLs to constrain client-to-client traffic, with an allow rule for the teacher Mac's IP on TCP 8080.
The SSID toggle is "Block intra-SSID traffic" (CLI: intra-vap-privacy):
WiFi & Switch Controller → SSIDs → [SSID] → Block intra-SSID traffic
Exemption: instead of the blunt toggle, attach an L3 Firewall Profile (WiFi & Switch Controller → Protection Profiles) that denies inter-client traffic but allows destination = teacher Mac's IP on TCP 8080 — intra-SSID traffic never reaches normal firewall policies, so the profile is the only place to carve the exception. Staff and student SSIDs on separate VLANs are the normal case: add an ordinary firewall policy, student VLAN → teacher Mac's IP, custom service TCP 8080.
These run on the student device, so fix them in addition to the wireless settings above.
GoGuardian has an explicit "Block Direct IP Access" setting (Filtering → Advanced Config). Allow the teacher Mac by adding its IP as an allowed site in the relevant policy — wildcards work, e.g. *10.0.5.23*.
Securly: add the Mac's IP/URL to the policy's allow list (Policy Editor), or the Global Allow list if it should bypass filtering district-wide.
Lightspeed Filter: add the address to the Allowed sites list for the affected policy groups — raw-IP LAN pages are a known block case in the field.
| What the teacher reports | Most likely cause |
|---|---|
| QR scans, page never loads, all devices | Client isolation, or the student/staff VLAN ACL |
| Works on a phone hotspot, not on school Wi‑Fi | Same — network policy, not the app |
| District block page appears | Content filter blocking raw-IP HTTP — needs its own allow rule |
| Works for some students, not others | Different filter policy groups, or students split across SSIDs |
| Teacher sees "0 joined" while everything looks normal | The Mac itself: macOS firewall denied, or Local Network permission off |
| All students drop at once mid-game | The Mac's IP changed or the Mac slept — reserve its DHCP lease for events |
Some districts can't or won't exempt peer-to-peer traffic — that's what QuizBlast Cloud is for. Students join through quizblast.net over standard HTTPS on 443, no local exceptions needed. It's in development; the local mode above is available today.