[RjG]

I have a situation where I need to lock down internet access for everything, wired and wifi connections, except a small select list of MAC addresses.

I found a few references in the forum that seemed to make sense, but it doesn't seem to be working for me.

This is what I am trying:

[AfterShock]

why not just use the access restrictions tab or the wireless mac filtering?

[tli]

No matter how it's implemented, what it's called, and/or how it's spun, it's still rudimentarily just MAC Filtering. FYI, article from 2005: https://www.zdnet.com/article/the-six-dumbest-ways-to-secure-a-wireless-lan/

Follow-up article from 2007: https://www.zdnet.com/article/wireless-lan-security-myths-that-wont-die/

Published and substantiated over a decade ago, yet today in 2019 still misconceptions...

Using, protecting and trusting one's WPA2/WPA3 key(s) would easily secure and block one's network from most unauthorized accesses beside state-sponsored and well-organized intrusions.

OT but still equally misunderstood to this day is SSID Hiding. Referenced 2003 white paper from the above 2005 article: http://medon.htt-consult.com/~rgm/icsalabs/Debunking%20the%20Myth%20of%20SSID%20Hiding.pdf

FYI.

[Alozaros]

[RjG]

I already used the Access restrictions, every legit IP is static , all the rest blocked. That doesn't do anything for somebody manually setting an IP (even though it's static assigned to a different MAC) from getting full access to LAN/WAN. That is what I have going on, trial and error IP until one works.

My problem is people plugging into LAN jacks, more than wifi right now.

I am aware it's not perfect, but I don't know any better way to lock it down, than choose the 1/2 dozen legal MACS and IPs both to grant access and reject the rest.


Alozaros, thank you, I will try that.

Doess numbering the rules work differently than insert?
Or is the syntax wrong?

[RjG]

[tli]

If unsuccessful via DD-WRT, I suspect something more robust like this may be needed to properly secure access. Don't know if this is viable but FYI:
https://howdoesinternetwork.com/2015/how-to-enable-dot1x-authentication-for-wired-clients

[RjG]

Authentication server would be nice, too complicated, thanks though:)

Learning as I go, I can answer my own last question now, the drop at the top matches all, so no internet. The drop can't be rule 1.

Still reading, I can't figure out a way to say
Default DROP unless "Match one of these"

Just inserting that drop anywhere else seems like it would conflict with existing port forwarding and stuff that I do use.

I wonder if I can put these on OUTPUT chain instead? There is no other rules to screw it up there.

[jwh7]

[Wildlion]

Here is the format I have used before

[egc]

Do not use the GUI to set anything on the command line (you can but special characters have to be escaped)

You should telnet/Putty to your router do do these kind of things. If it works you can Save the commands as Firewall

You can try the following:
iptables -I FORWARD -o $(nvram get wan_ifname) -m mac --mac-source 94:6A:B0:11:47:22 -m state --state NEW -j REJECT

You should only need this rule.
As you want to block outgoing traffic from your WAN you should use the -o , you can not block incoming traffic from the WAN with a MAC address.

I use state new so that any port forwards to this address can still work, if you do not need this then you can skip using state new.

As you are only blocking outgoing traffic to the WAN/internet you can still see things on your network and router

I have not tested it so curious to see if it works

[RjG]

[RjG]

[RjG]

I will try both these tonight and post back how it went. (without "insmod ipt_mac" ?)

Thank you

[Wildlion]

Yes it should still work without it, because I think it is built in and the kernel module is not needed. Probably need to update my notes.

P.S. Good luck and report back if you need help