[RoomClearInnTemper]

For whatever reason none of my access restrictions work.

Firmware: DD-WRT v3.0-r40189 std (07/04/19)

My access restrictions used to work before I set up a few things in DD-WRT (VPN, DNS and DHCP changes, iptables firewall rules), but now they don't work I can browse the web with all devices at all hours of the day. I am sure the times of day are set up correctly, and I have included all MAC addresses and static IPs of all NICs on all my devices. This is true of connections via WiFi or wired.

Some notes about my setup:
-my router is an OpenVPN client to a VPN service I pay for and also as an OpenVPN server
-I disabled DHCP server on my router since I use another device (my Pi-hole) for this
-for DNS, my router points to a local DNS server/firewall (Pi-hole) with an upstream DNS server

I have for instance the following four rules:

[egc]

I do not know much about acces restrictions, but normally you do not need any firewall rules for the OpenVPN Client and only one firewall rule for the OVPN server (and only if you want to have internet acces from your OVPN server clients):

[RoomClearInnTemper]

I am aware that my firewall is a bit redundant, I've just never been too great at understanding iptables. I can certainly try to remove some of those lines.

One thing I did notice is that if I disable and then re-enable an access restriction, it goes into effect and works. But then the following day, it's no longer working. e.g. right now I should not be able to access the Internet from this laptop.

Maybe is there some sort of debug/log for access restrictions in DD-WRT?

[egc]

I can remember seeing problems with Access restrictions only working once.

It had to do with running cron, I think.

Google for recent threads dealing with this problem

[RoomClearInnTemper]

I Googled around and added the following to Administration/Management/Additional Cron Jobs but nothing has changed. Instead of a single line with MAC aa:bb:cc:dd:ee:ff, I have that line duplicated with the MACs of all the devices I want blocked. Nothing changes. And the radios don't even turn off. Weird. Cron is definitely enabled.

[SurprisedItWorks]

[RoomClearInnTemper]

Thanks. /var/spool/cron/crontabs/root is a totally empty file.

However /etc/cron.d has a file called cron_jobs that has the exact text that I pasted above into Additional Cron Jobs. There is nothing else in /etc/ related to Cron.

However I noticed in the DD-WRT Cron help document it said to add root before every command, so I just did that and restarted cron. I know I already had root before the radio commands and those didn't work, but maybe because those are at the bottom of the commands, it errors out beforehand because of the lack of root. We'll see!

[RoomClearInnTemper]

Okay, looks like I also messed up on the absolute path to iptables.

Calling any of the commands individually don't seem to even do anything. What is going on here?? Is my firewall overriding this stuff?

For instance, from the shell I called startservice radio_off_0 and startservice radio_off_1 and my radios are still on. I tried enabling wireless scheduling under wl0/wl1_Advanced and calling these commands again. Same thing.

Then I tried calling /usr/sbin/iptables -D FORWARD -m mac --mac-source aa:bb:cc:dd:ee:ff -j DROP and it was successful. However that device could still browse to the internet, over the radio I had supposedly disabled. So maybe Cron's good but the commands just do nothing. Why would these commands not work??

Here's the updated Cron script that still doesn't work.

[RoomClearInnTemper]

Okay, one last update. I got cron to turn off the wireless radios with the code below. However for my hardwired devices, I still need the MAC filtering to work. Do I maybe have conflicting iptable entries that will allow packets to go through? I posted my firewall below (also I'm not the best with iptables).

Just a heads up, my router is also an OpenVPN server and client.

Final working Cron section

[SurprisedItWorks]

[RoomClearInnTemper]

Honestly, every time I try to learn iptables it goes way over my head. Your post helps a lot actually.

So I understand -A appends to the bottom and -I inserts it at the top of the ruleset. I guess for something like this (complete blocking) -I makes more sense like you said because there are probably other rules above it. I'll try making the switch to -I and see how it goes.

I checked out the FORWARD chain and at the very top is a rule allowing all traffic in and out of tun1 (my OpenVPN client). Since my LAN devices are all going out tun1, I assume this rule matches instantly and it ignores everything below it.

[SurprisedItWorks]

[SurprisedItWorks]

Let me add one thing though... the iptables rules for tun1 are added when the vpn tunnel is created during vpn startup, and they are removed when the tunnel is taken down when the vpn connection terminates. So if you put your iptables rules in the firewall in the obvious way, they'll be there first and then the tun1 rules will be created above them, making your rules kind of pointless again.

So your scheme seems reasonable if the vpn is always up, give or take some question of what happens first during boot. You are going to want to think that bootup part through. Keep in mind that the Firewall section in GUI>Administration>Commands is just a shell script. What makes it the special Firewall section is when it is run. dd-wrt runs it when the firewall needs to be restarted. But since it is just a shell script, you can use shell commands freely, meaning there is no harm doing things like

(sleep 120; iptables blah blah blah ) &

so that a particular iptables command is run a couple of minutes after the rest of the firewall is set up. You may need a couple of minutes to give the vpn time to start up.

I don't believe you can do things like that in cron specifications. I believe the latter have to be actual single commands, so if you need anything more complex, you are stuck creating a shell script in a file and marking it executable so you can run it from cron. In startup you can do

cat <<'EOF' >/tmp/root/myscript
#!/bin/sh
blah
blah
blah
.
.
.
EOF
chmod +x /tmp/root/myscript

and then run /tmp/root/myscript with cron.

[johnnyNobody999]

Access restrictions don't work for me and hasn't worked for any firmware I've tried. Setting up iptables rules hasn't helped either. My routers are WRT3200ACM and WRT1900ACSv1.

[RoomClearInnTemper]

User SurprisedItWorks's suggestion fixed it. I had to insert the iptables rule and not append it. Thanks!