Block WAN access for a specific client on RT-AC66U

[FelixII]

Hi,

I have a ASUS RT-AC66U router and want to block WAN access for a specific wireless client. The client must be able to access local ressources like the DLNA server but shouldn't have access to the internet.

On my router I can accomplish this task by assigning this client a specific IP address based on his MAC address (manual DHCP assignment) and blocking this IP address from accessing the internet. The problem with this method is that the client can assign himself a static IP address and bypass the block.

Is there any way I can securily block this client from accessing the internet? I already tried DD-WRT firmware which has an option to block WAN access based on MAC addresses, which is exactly what I need. However DD-WRT halves my Wifi and USB transfer speed, so I prefer to use stock firmware.

Thank you for your help!

 

[Phylion]

I am not sure if on plain firmware access to console is possible. For that I recommend the great work of RMerlin over here. He makes alternative firmware for Asus devices based on Asus' firmware.

When you are able to configure through console, you can use firewall tools for this to create. As far as I know it cannot be done in the webGUI.

Yesterday I saw some examples based on ebtables and iptables. In your situation I would configure the firewall based on MAC address rather then IP address. Although a combination is also possible: only accept traffic from this device when MAC and IP (based on dhcp config) equals. If not: the user is trying to do things he/she is not supposed to, so deny all traffic.


For the sake of completeness: if the user is able to use another MAC address, your firewall rules won't block anymore.