Restrict admin page by MAC

[Marko Polo]

AFAIK, stock AsusWRT doesn't provide possibility to restrict access to router Admin interface from LAN by certain MAC-address. Only by IP.
Does Merlin allow such restriction?

 

[CaptainSTX]

AFAIK, stock AsusWRT doesn't provide possibility to restrict access to router Admin interface from LAN by certain MAC-address. Only by IP.
Does Merlin allow such restriction?

Curious. Why do you want to restrict access by MAC instead of IP? If it is for security it doesn't make much difference as you can spoof a MAC as easily as an IP.

 

[Marko Polo]

Not sure it is as easy. MAC is more stable, so more secure. IMHO.

 

[Martineau]

AFAIK, stock AsusWRT doesn't provide possibility to restrict access to router Admin interface from LAN by certain MAC-address. Only by IP.
Does Merlin allow such restriction?

You could try the following rule:

iptables  -I  INPUT  -m  mac  --mac-source  xx:xx:xx:xx:xx:xx  -d  $(nvram get lan_ipaddr)  -p  tcp  -m  multiport  --dport 80,$(nvram get https_lanport)  -j  DROP

where xx:xx:xx:xx:xx:xx is the MAC of the device you want to block from accessing the Admin GUI.

 

[CaptainSTX]

Not sure it is as easy. MAC is more stable, so more secure. IMHO.

I will agree that it is more secure but not for the reason you believe. There are apps you can download for free that will either let you change you IP or spoof any MAC address.

The only reason I can see that a MAC is more secure than IP is in a /24 subnet you have just 254 possibilities. With a MAC address a much larger pool of possibilities. This may not make any difference to anyone trying to hack into your network as they would probably only try addresses belong to a device that was or had been connected to your network.