Parental Controls Bypassed When Client Uses Static IP Address

[asammar]

I am using an RT-AC68U with Merlin 384.15. All clients have an assigned IP address under LAN/DHCP Server.

I have a few PC rules (time scheduling as well as full block) on a number of clients. Under normal DHCP conditions everything works as expected. Yesterday, I found out that if I set a static IP address on any of the devices under PC (different from the assigned one), then the device gets full internet access and the PC rules are bypassed. It's as if the PC rules are applied to the IP address and not to the MAC address. Surprisingly, in the client list view, the icon for the client in question has the red mark that says it is blocked but it is not!

Is this an expected behavior? If yes, is there a way to apply PC rules to the MAC address instead? Any other possible solutions assuming the MAC addresses do not change?

Thank you.

 

[ChatmanR]

I am using an RT-AC68U with Merlin 384.15. All clients have an assigned IP address under LAN/DHCP Server.

I have a few PC rules (time scheduling as well as full block) on a number of clients. Under normal DHCP conditions everything works as expected. Yesterday, I found out that if I set a static IP address on any of the devices under PC (different from the assigned one), then the device gets full internet access and the PC rules are bypassed. It's as if the PC rules are applied to the IP address and not to the MAC address. Surprisingly, in the client list view, the icon for the client in question has the red mark that says it is blocked but it is not!

Is this an expected behavior? If yes, is there a way to apply PC rules to the MAC address instead? Any other possible solutions assuming the MAC addresses do not change?

Thank you.

Same issue. I recall a post saying the PC and NAT Acceleration do not work well together.

 

[ColinTaylor]

Parental Controls are based on MAC addresses. But as @ChatmanR says it's possible hardware acceleration is having an effect, particularly with connections that were already established when time-based blocking starts.

 

[asammar]

Thanks for the quick replies.
NAT acceleration is OFF all along. Also, the behavior is present for new connections not only old ones.

 

[ColinTaylor]

The only way to debug this is if you were to upload the output of "iptables-save" to somewhere like pastebin for us to look at.

 

[asammar]

The only way to debug this is if you were to upload the output of "iptables-save" to somewhere like pastebin for us to look at.

I've never used pastebin before but I will take a look.
Is it OK to mask the MAC addresses that show up in the output or you need that for debugging?

Thank you.

 

[ColinTaylor]

I've never used pastebin before but I will take a look.
Is it OK to mask the MAC addresses that show up in the output or you need that for debugging?

Changing the MAC addresses could make debugging more difficult. I suggest you just mask your WAN IP address.

BTW You can set an expiration time on your pastebin upload, for example 1 day.