Blocking internet access for devices with randomized mac address

[qvrb]

I'd like to block my kids from using the internet at certain times, but most of their devices have the ability to generate randomized mac addresses so the traditional methods of specifying mac address with scheduled times don't seem to work.

I've a ASUS RT AC 86U running Merlin 386.7_2

What i tried to do is to block all devices, and then schedule time for certain mac addresses in parental controls but it doesn't seem to work, everything is still blocked any ideas?

 

[BreakingDad]

How to enforce time-based restrictions on kids devices

Hi, I am new to ASUS devices and Merlin firmware (just upgraded to Merlin yesterday) and I am trying to transition the router functionality from another router to Asus/Merlin device (RT-AC86U). With the old router (Gargoyle), I would block kids' devices based on time restrictions. I noticed...

www.snbforums.com

 

[Smokey613]

I guess you could enable wifi mac filtering. This would only allow wifi devices you give access to by mac address to connect to the wifi. This MAY prevent them using random mac assignments, but I am sure given time, even this could be bypassed.

 

[bbunge]

As has been said many times before, be a parent! You have the right to take the devices. Give the kids books instead.

 

[Ripshod]

Or set up an AP with an ssid just for them, in a secure spot, and use a timer to control it.

 

[Nick B]

Why does this have to be a parental thing? I would like to know what devices are what and not have non-persistent mac randomization blow up my DHCP lease table.

It would be nice if YazFi had an option to post a captive portal for users using mac randomization (which is easy enough to identify).

 

[KronFace]

Wifi schedule on a dedicated kids only wifi network.
If it were me, I'd name it "Happy Accidents"

 

[Nick B]

Wifi schedule on a dedicated kids only wifi network.
If it were me, I'd name it "Happy Accidents"

Maybe I lost the spirit of the OP's actual question, but the title of the post is, "Blocking internet access for devices with randomized mac address"

 

[Viktor Jaep]

The only way to go is with mac address filtering on. I do the same to control any random device the kids or their friends try to connect to our network. I know it's a pain, but really the only avenue.

I *wish* there was a feature that would more automatically add devices to the whitelist and prompt you like so:

WARNING! A new device <name> just tried to join your network with mac address <mac>. Would you like to allow them to join? Y/N

 

[Nick B]

The only way to go is with mac address filtering on. I do the same to control any random device the kids or their friends try to connect to our network. I know it's a pain, but really the only avenue.

I *wish* there was a feature that would more automatically add devices to the whitelist and prompt you like so:

WARNING! A new device <name> just tried to join your network with mac address <mac>. Would you like to allow them to join? Y/N

This is ultimately possible. You would throw up a captive portal page after connect saying something like, "Please wait while the admin approves your connection..." and then once you approved it, it would whitelist it in both the captive portal page and iptables/etc.

 

[Viktor Jaep]

This is ultimately possible. You would throw up a captive portal page after connect saying something like, "Please wait while the admin approves your connection..." and then once you approved it, it would whitelist it in both the captive portal page and iptables/etc.

Get to it! LOL

EDIT: Never knew this, but it actually looks like some of this functionality already exists only for these routers: 4G-AC68U, 4G-AC86U, 4G-AX56, BRT-AC828

[Guest Network ] How to set up Captive Portal? | Official Support | ASUS USA

@RMerlin -- is there any possibility of perhaps porting some of this "captive portal" functionality over to the main branch(es)? It sounds like it would be a really "nice-to-have" feature? I know you said back in 2012 that you don't see the need to add something like this, but even if there's a way to expose enough functionality to build this kind of custom solution ourselves, that might even work?

 

[bennor]

Search turns up some past discussion on the captive portal subject mostly a mixed bag:

Captive portal for guest network on RT-AC66U B1

Hey! I'm running Asuswrt Merlin on my new RT-AC66U B1 and really happy with it. I'm amazed of all the things I can do with it. I'm a little noob in the field of building small networks and specially with this router and Merlin. I have a guess network at home and I would like to know if I...

www.snbforums.com

Anybody able to get NoDogSplash working?

I'm trying to build NoDogSplash on AsusWrt Merlin 384.14. Compile is fine, configuration also ok. But when I start nodogsplash, it complaining that iptables version is too low. It requires 1.4.17, and AsusWrt Merlin using iptables 1.4.15. Manually lower requirement to v1.4.15 cause error like...

www.snbforums.com

Compile packages from sources

Ultimate repo for embedded devices. Contribute to Entware/Entware development by creating an account on GitHub.

github.com

GitHub - nodogsplash/nodogsplash: Nodogsplash offers a simple way to provide restricted access to an Internet connection using a captive portal. Pull requests are welcome!

Nodogsplash offers a simple way to provide restricted access to an Internet connection using a captive portal. Pull requests are welcome! - nodogsplash/nodogsplash

github.com

 

[Viktor Jaep]

Search turns up some past discussion on the captive portal subject mostly a mixed bag:

Captive portal for guest network on RT-AC66U B1

Hey! I'm running Asuswrt Merlin on my new RT-AC66U B1 and really happy with it. I'm amazed of all the things I can do with it. I'm a little noob in the field of building small networks and specially with this router and Merlin. I have a guess network at home and I would like to know if I...

www.snbforums.com

Anybody able to get NoDogSplash working?

I'm trying to build NoDogSplash on AsusWrt Merlin 384.14. Compile is fine, configuration also ok. But when I start nodogsplash, it complaining that iptables version is too low. It requires 1.4.17, and AsusWrt Merlin using iptables 1.4.15. Manually lower requirement to v1.4.15 cause error like...

www.snbforums.com

Compile packages from sources

Ultimate repo for embedded devices. Contribute to Entware/Entware development by creating an account on GitHub.

github.com

GitHub - nodogsplash/nodogsplash: Nodogsplash offers a simple way to provide restricted access to an Internet connection using a captive portal. Pull requests are welcome!

Nodogsplash offers a simple way to provide restricted access to an Internet connection using a captive portal. Pull requests are welcome! - nodogsplash/nodogsplash

github.com

Thanks... Yeah, a mixed bag of old threads going nowhere, and a GitHub project of unknown proportions that may require a lot of borking around outside of Merlin to get it to work.

 

[visortgw]

Thanks... Yeah, a mixed bag of old threads going nowhere, and a GitHub project of unknown proportions that may require a lot of borking around outside of Merlin to get it to work.

Tell us what you really think, @Viktor Jaep.

 

[Viktor Jaep]

Tell us what you really think, @Viktor Jaep.

I think I communicated it in much nicer words than what I was going to say. Lol!

 

[thelonelycoder]

I think I communicated it in much nicer words than what I was going to say. Lol!

Sounds like a fun project, any updates on your progress?

 

[Viktor Jaep]

Sounds like a fun project, any updates on your progress?

Ha!

 

[Nick B]

Perhaps the most comprehensive set of instructions alive for such a simple project / setup: https://digitalcommons.calpoly.edu/...YQFnoECDEQAQ&usg=AOvVaw37fTXSnCgM2QMkENO_2A4x

I've gotta give the guy credit for going that balls-deep with a guide like I've never seen before. Writes it like it's a research paper.... Oh wait...

 

[maxbraketorque]

Perhaps the most comprehensive set of instructions alive for such a simple project / setup: https://digitalcommons.calpoly.edu/...YQFnoECDEQAQ&usg=AOvVaw37fTXSnCgM2QMkENO_2A4x

I've gotta give the guy credit for going that balls-deep with a guide like I've never seen before. Writes it like it's a research paper.... Oh wait...

Could have been a senior project.