Turn off Admin Panel for WiFi

[Mav3ricK]

Hey netbuilders,

Is it possible to deny access to the Admin Panel from WiFi connections?

I want to allow connections to the panel from wired LAN only...

Thank you

 

[hggomes]

Unfortunately no, but its a very interesting option to add on the FW.

 

[CaptainSTX]

While you can't do exactly what you want you do have the option to limit admin access for up to four specified IPs. If you select the IPs of wired devices you have accomplished most of what you wanted.

 

[Denny]

If I am not wrong you can specify max 4 IPs from which you'll be able to access to the interface.
If you fix your static dhcp leases, it should work the way you want it.

I would suggest to put at least 2 IPs in case of ...

 

[Mav3ricK]

Yes, that's true - a bit risky that setting, but it's possible.
Guess I have to go that way...

An option would be awesome.

 

[KevTech]

TomatoUSB has an option to disallow wireless access to the GUI.

 

[CaptainSTX]

Yes, that's true - a bit risky that setting, but it's possible.
Guess I have to go that way...

An option would be awesome.

How is it risky? Inconvenient maybe in that you are limited to a maximum of on four devices that can administer your router.

 

[Zirescu]

If the Wifi users only need Internet access then you could just give them access via the Guest Network.

 

[Mav3ricK]

How is it risky? Inconvenient maybe in that you are limited to a maximum of on four devices that can administer your router.

Risky as it is a typical "set-and-forget" option.
You have to make sure not to forget that only a client with the IPs 192.168.1.x, 192.168.1.y and 192.168.1.z can reach the Admin panel at all.

@Zirescu: That's an idea, if guest network clients have no access to the admin panel. I'll give it a shot.

Otherwise I think I'm going to try Tomato, would prefer to stay on Merlin-WRT though.

 

[RMerlin]

Using a strong password would do the job. Asuswrt even has brute force attack prevention that will block access after 5 invalid passwords (or at least it used to - that code was causing a fair amount of false positives, not sure if Asus either fixed it or disabled it).

Tomato's method of blocking Wifi access involves checking the entire list of associated MACs at the wireless driver level to determine who to allow and who not to. The code would be a tad complex to implement with the RT-AC87U's Quantenna radio requiring completely different code to handle its own clients. So that's not a priority for me at this time.

 

[Mav3ricK]

Thanks Merlin. I see, that doesn't make much sense.

I thought it could be suppressed that the admin panel (port 80 or 443 of the router's IP) is being exposed to the WLAN adapter.

Fair enough, I'll stay with the possibilities of allowing only certain IPs and use a strong password.

 

[CaptainSTX]

In some/many networks barring access by WiFi connected devices won't always work.

If you have additional APs connected by Ethernet to your router and a WiFi device is connected to the AP instead of the router then the wireless device is identified as being a wired connection and therefore would not be blocked from accessing the admin pages on the router.

 

[hggomes]

That's a completly different scenario, if your network is configured that way it's normal not blocking the access, clients are connected to other AP.

 

[CaptainSTX]

That's a completly different scenario, if your network is configured that way it's normal not blocking the access, clients are connected to other AP.

Clients are connected to the another AP, but their IP on the network is set by the primary router and doesn't change regardless of what AP or radio they are connected to. By using the option to restrict access to pre determined IPs it doesn't make any difference what AP or band they connect using they are either authorized or not.