Block all internet traffic for a device

[acca84]

Hello
Is that possible to block all internet traffic for a specific device ?
I want this device to access local network but not internet.
Thanks

[billz]

Yes, this can be done with iptables rules.

RaspAP takes a different approach by using dnsmasq's --dhcp-ignore option, although it blocks all network access (not just internet) by ignoring DHCP requests from clients without a static lease.

[pratappal]

Hi There,

i need some guidance - i found this thread and thought of asking here, if incorrect please let me know.

my requirement is i need to restrict internet/network access for few specific wifi devices (preferable by mac address instead of IP) connected to RASPAP, while other connected device should still have access. Also it would be nicer if i can restrict by time stamp.

As explained above i was trying to utilize the 'static lease' with 'limit' switch but somehow the limit switch is not working for me, anyway this option will also not fulfill my need 100%.

Any help please.

[billz]

@pratappal you've discovered an exciting new bug. A fix is already in progress #1732. thanks for raising this!

[billz]

An example of how this works with the fix applied:

# RaspAP wlan0 configuration
interface=wlan0
dhcp-range=10.3.141.50,10.3.141.254,255.255.255.0,12h
dhcp-host=fe:00:66:12:ff:00,10.3.141.100 # iPhone
dhcp-option=6,9.9.9.9,1.1.1.1
dhcp-ignore=tag:!known

Re: time stamps, you can set a lease time to control this. Refer to the dnsmasq docs for specifics.

[pratappal]

Thanks Billz,
i see - manually updating the /etc/dnsmasq.d/090_wlan0.conf with "dhcp-ignore=tag:!known" has turned the 'limit' switch on in the web-gui. However still a concern - even after the limit switch is turned on -
for the non listed hosts i.e. 'unknown' hosts access is restricting for first few min after restarting the dnsmasq service and
then unknown hosts are able to access again after 2-3 min. can this be a duration dependent process, where i can define the duration may be?

Also one more question if we use 'dhcp-ignore=tag:known' i.e. without the '!', does it act opposite - meaning then it should restrict the listed 'known' hosts instead?

[acca84]

Thank you, I'll look at iptables

[acca84]

Hello,
With the following command :
sudo iptables -I FORWARD -s 10.3.141.136 -d 0/0 -j DROP
the device with IP 10.3.141.136 can't access internet, and that is what i wanted.
But i don't understand why it can acces local network (but that is what i wanted :) )
Can someone explain please ?