Question

Hello. Is there a way to restrict connected wifi and ethernet devices basing on scheduler? For example: wireless sensor 1 disables connection to RUT240 every 30 min for 25 min, or Ethernet connected sensor every other hour.

And also, how do I manually disable and enable connection to a particular wifi or ethernet device? Should this be done via Firewall or there's a better way of doing it?

Thank you!

Answer 1

Hello

It is not entirely clear whether you want to disable interface for specific users/devices, or simply disable interfaces and what is the end goal in general.

The desired periodicity is not achievable by the means available in the WebUI as well. Some workarounds can be attempted though.

If you want to restrict internet access or limit access for specific devices in LAN, you can create a traffic rule in router's WebUI, Network -> Firewall -> Traffic rules page:

• Scroll to the bottom of the page;
• Add a new instance of Open ports on router type.
• Give it a name, set Source zone as LAN, Destination zone as WAN, press Add.
• Source MAC address: list MAC addresses of the devices you want to restrict internet access.
• Set Action: Drop.

You will then need to drag this rule to the top of the page to give it highest priority.

You can also create a similar rule to limit access of the router as well by setting Destination zone to Device (input).

Then you can create crontabs to periodically enable/disable this rule with the following commands. For example, disabling the rule for 25 minutes, reenabling and repeating the same procedure every half a hour could look the following:

• */30 * * * * uci set firewall.<n>.enabled='0' && uci commit && sleep 1500 && uci set firewall.<n>.enabled='0' && uci commit

Be aware that to find the exact number of the rule <n> you will need to list firewall settings via CLI/SSH with the following command:

• uci show firewall

A similar crontab can be generated for the WiFi interface only:

• */30 * * * * /sbin/wifi down && sleep 1500 && /sbin/wifi up

Also, in WiFI settings, for example, there is a possibility to add a list of MAC addresses to blacklist or whitelist. It can be done in router's WebUI Network -> Wireless -> [Access point interface settings] -> [MAC-filter] tab.

For more details on crontab functionality, please refer here.

Best regards,

Comments

The goal is to limit traffic from/to specific devices and to be able to block a device whatsoever in case if it malfunctions. This is for an unattended remote setup where phisical disconnect of a device is impossible.

>>>>Also, in WiFI settings, for example, there is a possibility to add a list of MAC addresses to blacklist or whitelist. It can be done in router's WebUI Network -> Wireless -> [Access point interface settings] -> [MAC-filter] tab.

Can this be done for LAN connected devices as well ?

>>>>A similar crontab can be generated for the WiFi interface only:

*/30 * * * * /sbin/wifi down && sleep 1500 && /sbin/wifi up

Will this crontab disable wifi altogether, or will it disable access from specific wifi devices?

---

Can this be done for LAN connected devices as well?

WiFI MAC filtering is performed by hostapd daemon, which is separated from wired LAN connections and will not apply for them.

You will need to create traffic rules. However, you have to be aware, that devices connected with wired interfaces will be able to communicate within the same LAN, as firewall rules can only limit traffic if, it is forwarded between different zones, like LAN <-> WAN, or LAN<-> VLAN.

Will this crontab disable wifi altogether, or will it disable access from specific wifi devices?

It will disable the interface completely, which applies to all devices.

Best regards,