[student13]

Hi did I setup my iptables correctly to block my printer from accessing the internet? Thanks. It did not seem to work, my printer was still able to access the internet
(HP test server).

Thanks. PS printer has a static ip address.

[js1662]

Have you tried this: https://www.dd-wrt.com/wiki/index.php/Access_Restrictions

BTW, next time when you post a picture, please limit the picture width to 800 pixels. It can easily be done by trimming the unnecessary background on the picture. Otherwise, others may not bother to read your post as the text are hard to read when you attached a large picture.

[student13]

I have tried access restrictions, and that is the only thing that works.
But I did this to in part learn iptables, and really wanted the iptables to work out.
I added iptables exactly as described, by another member.

In the future I will crop my images to the correct size for others.

But What is wrong with my iptables as I have placed them in the firewall rules.?

[Alozaros]

first IPtables must be saved in firewall script only...

iptables -I FORWARD 1 -d (IP to Block) -j DROP
iptables -I OUTPUT 1 -d (IP to Block) -j DROP


second you can try with blocking by mac address like

iptables -I INPUT -p tcp --dport 80 -m mac ! --mac-source 00:24:81:D7:26:B4 -j REJECT --reject-with tcp-reset

or

filter any non static IP addresses connecting to router

Use dnsmasq and additional options:

Code:
dhcp-host=11:22:33:44:55:66,set:known
dhcp-ignore=tag:!known

First directive will send extra options tagged as "known" to machine with Ethernet address 11:22:33:44:55:66.
The other directive will ignore any clients which are not specified in dhcp-host lines. Equivalent to ISC "deny unknown-clients".
This relies on the special "known" tag which is set when a host is matched.
On linux (!) means NOT.

[student13]

The first command that you suggested did the trick very well, I set my printer to a static ip of 192.168.1.110
and used this on my WRT1900AC:

iptables -I FORWARD 1 -d (IP to Block) -j DROP
iptables -I OUTPUT 1 -d (IP to Block) -j DROP

>>RESULT: Gateway blocked + external ip blocked.WORKED!

When I used the access restriction on DD-WRT and entered my printer's mac address ;

>>RESULT : Gateway accessible , BUT external ip blocked.

This command at least on my router (WRT1900AC), did not yield result

iptables -A INPUT -i eth0 -s 192.168.1.10 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.1.10 -j DROP
iptables -A FORWARD -o eth0 -s 192.168.1.10 -j DROP


>>RESULT : Did not work, printer (HP) corportate web server accesible.





Now on to my question about your other other command :

iptables -I INPUT -p tcp --dport 80 -m mac ! --mac-source 00:24:81:D7:26:B4 -j REJECT --reject-with tcp-reset
This suggests to me, that your are only rejecting requests coming from port 80 to a particular mac address? Is this correct? What if somebody from the
web access the printer aside from port 80 ? PS networking noob here.

Thanks.

[Per Yngve Berg]

iptables -I INPUT -p tcp --dport 80 -m mac ! --mac-source 00:24:81:D7:26:B4 -j REJECT --reject-with tcp-reset

This commabd blocks the printer from accessing the web-gui of the router.

[Alozaros]

just change port number for the printer....

[student13]

I can change the port number but that does not exactly help because new printers communicate on 3/4 port numbers right.

A better command would be to block a mac adress from any wan communication on or out. But can it be done via iptables?

[Alozaros]

Use dnsmasq and additional options:

Code:
dhcp-host=11:22:33:44:55:66,set:known
dhcp-ignore=tag:!known

[Per Yngve Berg]

To block your printer from accessing the Internet on any port:

iptables -I FORWARD -s 192.168.1.110 -o `get_wanface` -m state --state NEW -j DROP

[student13]

my printer communicates with my laptop via HP "jet direct" on port 9100. (192.168.1.110:9100)

SO here is how my firewall is set up .

iptables -I FORWARD -s 192.168.1.110 -o `get_wanface` -m state --state NEW -j DROP

iptables -I FORWARD -p tcp --dport 20005 -j DROP
iptables -I FORWARD -p tcp --dport 9100 -j DROP

Does this stop port 9100 from communicating with the Internet? PS , I use to use iptables forward/output rules, but it made the printer go fritz-y.

Thanks.

[student13]

BTW, when I try to setup and UBuntu printer driver, to make it print on my local network, this command, blocks all communication between my computer 's driver and the printer.
Anyone know why ? Shouldn't these commands only block outside (WAN) communication on to the lan?


iptables -I FORWARD 1 -d (IP to Block) -j DROP
iptables -I OUTPUT 1 -d (IP to Block) -j DROP

[student13]