How to switch on/off internet access for certain mac address

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page Previous  1, 2
Author Message
guido72
DD-WRT Novice


Joined: 24 Feb 2019
Posts: 15

PostPosted: Mon Jun 10, 2019 17:14    Post subject: Reply with quote
I found the answer in this thread: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=307182

You can activate a access policy by name/rule number:

Code:
/usr/sbin/nvram set filter_ruleMyRuleNumber="\$STAT:1\$NAME:MyRuleName\$DENY:1\$\$" && /sbin/stopservice firewall && /sbin/startservice firewall
root@Trapkast:~# /usr/sbin/nvram set filter_ruleMyRuleNumber="\$STAT:2\$NAME:MyRuleName\$DENY:1\$\$" && /sbin/stopservice firewall && /sbin/startservice firewall
Sponsor
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway

PostPosted: Mon Jun 10, 2019 18:50    Post subject: Reply with quote
Why don't you set it in the Access Restrictions tab in the GUI?
guido72
DD-WRT Novice


Joined: 24 Feb 2019
Posts: 15

PostPosted: Tue Jun 11, 2019 6:59    Post subject: Reply with quote
Hi, I don't want to do it through the gui because it takes a lot of time, starting a browser, log in, navigate to the right page, select the right rule, click on 'active', scroll down, click on 'apply'.
When it is set up in my Home Automation, I can open the app that I use a lot anyway, and just tab a switch.
Or I can just say: 'Computer, stop internet of xyz!'.
Ok, the last part is possible, but I don't have that installed yet. Wink.
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1416

PostPosted: Wed Jun 12, 2019 1:37    Post subject: Reply with quote
guido72 wrote:
Finally I got some time to test the above. Unfortunately it doesn't seem to work.
When I issue 'iptables -vnL FORWARD', I get the table with lots lines.
When I type:
Code:
iptables -I FORWARD 1 -i `nvram get lan_ifname` -m mac --mac-source 4C:DD:31:90:D4:D1 -j REJECT

This is accepted, but 'iptables -vnL FORWARD' doesn't show any line with the mac address.
Also, the phone I am testing this with, is still connected to the internet through the router.
I tried 'su'and 'sudo' but this is not accepted.
Am I doing something wrong?


So I am struggling to understand why this is not working... have you tried individual parts of it? The do look at the very first line because the 1 after the FORWARD means it is the very first forward rule. I do suggest changing from REJECT to ACCEPT just to make sure that you do not remove access.
guido72
DD-WRT Novice


Joined: 24 Feb 2019
Posts: 15

PostPosted: Wed Jun 12, 2019 14:33    Post subject: Reply with quote
Wildlion wrote:
So I am struggling to understand why this is not working...


I really appriciate that.
To answer the rest of your question: no I don't know how to investigate further. And because I now have a working way of setting a access rule active or inactive, this suits my needs! There isn't a reason for me to dig deeper anymore.

On the other thread, there is an even simpler way suggested. I will try that next weekend.
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1416

PostPosted: Thu Jun 13, 2019 0:42    Post subject: Reply with quote
Let try:

Code:

iptables -I FORWARD 1 -j ACCEPT


If you see that as the first entry then do some traffic to see if the numbers are increasing

Code:

iptables -D FORWARD 1


to delete it

next try

Code:

iptables -I FORWARD 1 -i `nvram get lan_ifname` -j ACCEPT   


If you see that as the first entry then do some traffic to see if the numbers are increasing

to delete it

Code:

iptables -D FORWARD 1



If needed post the output of the iptables -vnL FORWARD command after you have added the rule

I am expecting to see something like:


Code:

# iptables -I FORWARD 1
 -i `nvram get lan_ifname` -m mac --mac-source 4C:DD:31:90:D4:D1 -j REJECT
# iptables -vnL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0           MAC --mac-source 4C:DD:31:90:D4:D1 reject-with icmp-port-unreachable
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum