Note to self.
So … there’s a computer on your LAN that you don’t want connecting to the internet for whatever reason. Maybe you have finite data allowance and the user is wasting it, maybe they’re simply not authorised.
This is a simple kind of thing that many people will already know how to do, but I’m recording it here for my own future reference.
First, I logged into my router. This needed a little trick itself, because OpenWRT was using a deprecated key exchange algorithm. Let’s say the router is on 192.168.1.1
$ ssh root@192.168.1.1
Unable to negotiate with 192.168.1.1 port 22: no matching host key type found. Their offer: ssh-rsa
Usually, this can be fixed like this:
$ ssh -oHostKeyAlgorithms=+ssh-rsa root@192.168.1.1
I prefer this solution over permanently enabling the deprecated key in my ssh config, because it is deprecated for a reason. Now, you can enable keys on a hosy-by-host basis, so I guess I could modify the config. But this works.
Once logged into the router (as root):
# vim /etc/config/firewall
Then, I added lines like these to the end of the file:
config rule
option name 'Computer reject 1'
option src 'lan'
option dest 'wan'
option start_time '11:00:00'
option stop_time '23.00:00'
option utc_time '1'
option target 'REJECT'
option proto 'tcp udp'
option src_mac 'AA.BB.CC.DD.EE.FF'
option enabled '1'
So let’s unpack this:
config rule — what follows is a new rule
option name ‘Computer reject 1’ — the name of the rule
option src ‘lan’ — for this rule, our source of requests is the LAN
option dest ‘wan’ — and the destination is the wider network (WAN)
option start_time ’11:00:00′ — the rule kicks in (turns on) a 11:00:00
option stop_time ‘23.00:00’ — the rule turns off at 23:00:00
option utc_time ‘1’ — set to ‘1’ means ‘yes’ — use UTC time
option target ‘REJECT’ — when the rule is on, reject connections from the source
option proto ‘tcp udp’ — reject these protocols
option src_mac ‘AA.BB.CC.DD.EE.FF’ — this is the MAC address of the source (which is how to identify it to block it)
option enabled ‘1’ — enable this rule
Once the firewall config file is saved, we restart the firewall:
# /etc/init.d/firewall reload
And it seems to work. I ran ‘date’ on the router to make sure it was using UTC time, and it is.
Now, this is for blocking desktop computer with a fixed MAC address. This is not always the case for a network device. You can ID a computer using its IP address instead. But software MACs and DHCP mean that a user may be able to workaround this reasonably readily, depending on the device.
This is effectively a blacklist. It switches out the specified machines. It would be better to do the reverse and use a whitelist than only allows specific machines at specific times. But for now this will do what I want, and it means I don’t have to have an entry for every device on the LAN, just the ones I want to excommunicate.
DSPACE 