Block devices via script/Scheduler

The easiest way to filter WiFi devices is to use the Wireless Filter menu. However, there are times you want to block specific devices via a script. This is especially true when you need to manage device blocking for many devices. Scripting also lets you schedule blocking/filtering on or off, as needed.

• For a bridged environment (when using Media bridge mode,
  Ethernet bridge mode or Ethernet-to-Ethernet) you'll need ebtables.
• For a routed environment (single router), you'll use iptables.

Given a MAC address you wish to control, like: AA:BB:CC:DD:EE:FF you can filter in two ways:

# Block
/usr/sbin/ebtables -A FORWARD -d AA:BB:CC:DD:EE:FF -j DROP

# Unblock
/usr/sbin/ebtables -D FORWARD -d AA:BB:CC:DD:EE:FF -j DROP

# Flush (unblock all the defined references at once)
/usr/sbin/ebtables -F

NOTE: There might be additional ebtables in your system so be careful about flushing the full ebtable.

# Block Internet access (or any intra-vlan):
/sbin/iptables -I FORWARD -m mac –mac-source AA:BB:DD:EE:FF -j DROP

# Block any network activity, even services provided by the router (minidlna/webserver):
/sbin/iptables -I INPUT -m mac –mac-source AA:BB:CC:DD:EE:FF -j DROP

# Unblock (reverse) whatever command was issued by replacing “-I” with “-D”:
/sbin/iptables -D FORWARD -m mac –mac-source AA:BB:CC:DD:EE:FF -j DROP

# Flush
You don't do that for iptables instead, reboot the device

Nowadays, blocking MAC addresses can be tedious. Many devices use MAC randomization. MAC addresses can “change” freqeently.

For managing this, one alternative is to filter using hostnames.

For example:

# Block:
iptables -I FORWARD -s iphone-julie -j DROP

# Unblock:
iptables -D FORWARD -s iphone-julie -j DROP

The kernel still resolves the hostname to an IP address. A device with randomized MAC address will obtain a new IP address when reconnecting. This might function well, but only until the user restarts the device or just manually disconnects WiFi.

If you're security conscious, you could trigger a “service wireless restart” for each new client connecting, but that would be disruptive to the general network.

For WiFi devices, perhaps the best way to limit access is to make them connect to a dedicated SSID, and enable/disable that SSID as needed. For details about this approach, see the HOWTO: Turning on/off radio elements from script.