Block a mac address so it cannot connect at all...

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
View previous topic :: View next topic  
Author Message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Tue Jun 28, 2016 1:28    Post subject: Block a mac address so it cannot connect at all... Reply with quote
Router: Netgear WNDR4500
Firmware: DD-WRT v24-sp2 (02/04/15) giga

I have a device on my network that's used 200mb+ of data since yesterday and while sure I can can change the PW.

The easiest thing for me to do is just block that specific device... so ya, how can I block a MAC address without messing up any other connected devices ?

Ty.
Back to top View user's profile Send private message
Sponsor
ddaniel51
DD-WRT Guru


Joined: 19 Feb 2013
Posts: 1464
PostPosted: Tue Jun 28, 2016 3:17    Post subject: Reply with quote
Mac Filter in Wireless tab.
_________________
Segment 1 XR700 10Gb LAN, 1Gb WAN ISP BS
Wired AP 1 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 2 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 3 Unifi Wifi 6 LR US 1Gb LAN
Syslog Services Asustor 7110T NAS 10GB
NetGear XS716T 10GB Switch
download1.dd-wrt.com/dd-wrtv2/downloads/betas/ (Brain Slayer)
YAMon https://usage-monitoring.com/index.php
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Tue Jun 28, 2016 3:45    Post subject: Reply with quote
ddaniel51 wrote:
Mac Filter in Wireless tab.
Ty.

FWIW, is there a way to check attempts from that Mac to make sure the blocks working ok other than waiting to see it as a connected device ?
Back to top View user's profile Send private message
ddaniel51
DD-WRT Guru


Joined: 19 Feb 2013
Posts: 1464
PostPosted: Tue Jun 28, 2016 7:18    Post subject: Reply with quote
Block one of your own devices to test the function.
_________________
Segment 1 XR700 10Gb LAN, 1Gb WAN ISP BS
Wired AP 1 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 2 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 3 Unifi Wifi 6 LR US 1Gb LAN
Syslog Services Asustor 7110T NAS 10GB
NetGear XS716T 10GB Switch
download1.dd-wrt.com/dd-wrtv2/downloads/betas/ (Brain Slayer)
YAMon https://usage-monitoring.com/index.php
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Tue Jun 28, 2016 7:39    Post subject: Reply with quote
ddaniel51 wrote:
Block one of your own devices to test the function.
Good idea but seems it's working. Seems the devices tried to connect and managed a 0.1 mb data grab. I only know this because I also use Yamon. So it seems like there's a sm window before the block kicks in but seems it works.
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Wed Jun 29, 2016 2:36    Post subject: Reply with quote
MoreBloodWine wrote:
ddaniel51 wrote:
Block one of your own devices to test the function.
Good idea but seems it's working. Seems the devices tried to connect and managed a 0.1 mb data grab. I only know this because I also use Yamon. So it seems like there's a sm window before the block kicks in but seems it works.
Ok, so for a blocked device, how does it seemingly jump from 374.5mb last night to 520.3 now ?

It's like its blocked but doesnt catch right away thus allow data grabs.
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Wed Jun 29, 2016 19:49    Post subject: Reply with quote
Ok, so just how do these damn filters work because now the "blocked" device has managed to go from the previously posted number to a whopping 732.7 !

Edit 8:10pm: 765.9
Back to top View user's profile Send private message
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1415
PostPosted: Thu Jun 30, 2016 0:10    Post subject: Reply with quote
What you could do is go to Admin->Commands
Code:

#MAC Filter
insmod ipt_mac
iptables -N CMACFILTER
iptables -A CMACFILTER -m mac --mac-source (MAC_ADDRESS) -j DROP
iptables -A CMACFILTER -j RETURN
iptables -I FORWARD 1 -j CMACFILTER
iptables -I INPUT 1 -j CMACFILTER


with (MAC_ADDRESS) = to the mac address that you want to filter
and then press save Firewall

THis will prevent it from connecting to the internet but will allow it to still access the network resources.

Last edited by Wildlion on Thu Jun 30, 2016 0:12; edited 1 time in total
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Thu Jun 30, 2016 0:12    Post subject: Reply with quote
Wildlion wrote:
What you could do is go to Admin->Commands
Code:

#MAC Filter
insmod ipt_mac
iptables -N CMACFILTER
iptables -A CMACFILTER -m mac --mac-source (MAC_ADDRESS) -j DROP
iptables -A CMACFILTER -j RETURN
iptables -I FORWARD 1 -j CMACFILTER
iptables -I INPUT 1 -j CMACFILTER


with (MAC_ADDRESS) = to the mac address that you want to filter
and then press save Firewall
What all does that do and FWIW. Why wouldn't the MAC filter by itself seem to be working ?

Thx.
Back to top View user's profile Send private message
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1415
PostPosted: Thu Jun 30, 2016 0:19    Post subject: Reply with quote
what that is doing is adding to the firewall a new chain called CMACFILTER

In that chain the first is saying if the source of the packet is from that mac address to just drop it and return to the chain for all others. Then the last two are inserting rules into the FORWARD and INPUT chains to jump to the newly created chain.

I have no idea why the MAC filter is not working. I was trying to give you an alternative since the MAC filter seems to not be working for you.
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Thu Jun 30, 2016 0:23    Post subject: Reply with quote
Wildlion wrote:
what that is doing is adding to the firewall a new chain called CMACFILTER

In that chain the first is saying if the source of the packet is from that mac address to just drop it and return to the chain for all others. Then the last two are inserting rules into the FORWARD and INPUT chains to jump to the newly created chain.

I have no idea why the MAC filter is not working. I was trying to give you an alternative since the MAC filter seems to not be working for you.
Oh I appreciate that. I was just dumbfounded as to why the MAC filter seems to be still allowing some stuff.
Back to top View user's profile Send private message
ddaniel51
DD-WRT Guru


Joined: 19 Feb 2013
Posts: 1464
PostPosted: Thu Jun 30, 2016 3:28    Post subject: Reply with quote
Did you apply the filter to all radios?
_________________
Segment 1 XR700 10Gb LAN, 1Gb WAN ISP BS
Wired AP 1 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 2 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 3 Unifi Wifi 6 LR US 1Gb LAN
Syslog Services Asustor 7110T NAS 10GB
NetGear XS716T 10GB Switch
download1.dd-wrt.com/dd-wrtv2/downloads/betas/ (Brain Slayer)
YAMon https://usage-monitoring.com/index.php
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Thu Jun 30, 2016 5:01    Post subject: Reply with quote
ddaniel51 wrote:
Did you apply the filter to all radios?
Just the one radio "it" had access to as I'm 110% no one but me knows the other radios PW.

I've since upgraded my FW though. So am in the midst of redoing settings. So will test the MAC thing again sometime tomorrow / later today.

Firmware: DD-WRT v3.0-r30016 giga (06/24/16)
Back to top View user's profile Send private message
MoreBloodWine
DD-WRT User


Joined: 23 Jun 2016
Posts: 147
PostPosted: Thu Aug 25, 2016 4:04    Post subject: Reply with quote
MoreBloodWine wrote:
Ok, so just how do these damn filters work because now the "blocked" device has managed to go from the previously posted number to a whopping 732.7 !

Edit 8:10pm: 765.9
Mac Filters a joke.

Guaranteed way, access deny restriction. 0.0b total on downloads all day and somehow, but who cares, 2.7mb on uploads.

On build 8/16/16 as of this reply.
_________________
Back to top View user's profile Send private message
steve98664
DD-WRT Novice


Joined: 30 May 2015
Posts: 11
PostPosted: Thu Mar 07, 2019 2:00    Post subject: Protocol for Deny Script Reply with quote
SO I got the protocol for deny script wrong. Hope this helps others at my level.

This attempt did not work.

#MAC Filter
insmod ipt_mac
iptables -N CMACFILTER
iptables -A CMACFILTER -m mac --mac-source (38:3C:28:91:16:32) -j DROP
iptables -A CMACFILTER -j RETURN
iptables -I FORWARD 1 -j CMACFILTER
iptables -I INPUT 1 -j CMACFILTER

No parenthesis works for me based on trial. No critique on the helpful folks who provided this. Just my misinterpretation.

#MAC Filter
insmod ipt_mac
iptables -N CMACFILTER
iptables -A CMACFILTER -m mac --mac-source 38:3C:28:91:16:32 -j DROP
iptables -A CMACFILTER -j RETURN
iptables -I FORWARD 1 -j CMACFILTER
iptables -I INPUT 1 -j CMACFILTER
_________________
RT-AC87U V3 30534
RT-N66U v24-26138_NEWD-2_K3.x_mega veteran
Back to top View user's profile Send private message
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum