Network segmentation and parental controls?

[walter4938]

Hello, I am coming from an r7000 with freshtomato trying to figure out how to setup similar parental blocking/network segmentation/scheduled blocking features. My previous setup, I had the R7000 block ALL internet access at scheduled times on all devices except my whitelist. I have multiple wifi cameras that I need whitelisted, while also blocking all other devices. The first router (r7000) also had network segmentation setup with two separate networks(192.168.1.XXX, 192.168.10.XXX) with a wireless VLAN on the 10.xxx network, . I also have a second router connected to the LAN port running fresh tomato in bridge mode, but everything was handled through the r7000. It's not super complicated, but I cannot find a good way to use this ASUS RT-AC86U router to do something similar.

Are there any scripts/programs (through amtm or something else?) that is capable of easily setting up network segmentation that includes the LAN ports, allows blocking internet on all devices except whitelist on a schedule, and allow me easier/better control over my network?

 

[Adooni]

generally AsusWRT is very bad with parental control and if someone need it go with FT/OpenWRT or for example Synology router
for Asus like most of routers OEMs it is niche product that need a lot time to support to add functionality

what you can try search forum and find for example same scripts that can help you like this one
https://www.snbforums.com/threads/asus-parental-controls-script-to-enforce-rules.82455/

 

[drinkingbird]

Hello, I am coming from an r7000 with freshtomato trying to figure out how to setup similar parental blocking/network segmentation/scheduled blocking features. My previous setup, I had the R7000 block ALL internet access at scheduled times on all devices except my whitelist. I have multiple wifi cameras that I need whitelisted, while also blocking all other devices. The first router (r7000) also had network segmentation setup with two separate networks(192.168.1.XXX, 192.168.10.XXX) with a wireless VLAN on the 10.xxx network, . I also have a second router connected to the LAN port running fresh tomato in bridge mode, but everything was handled through the r7000. It's not super complicated, but I cannot find a good way to use this ASUS RT-AC86U router to do something similar.

Are there any scripts/programs (through amtm or something else?) that is capable of easily setting up network segmentation that includes the LAN ports, allows blocking internet on all devices except whitelist on a schedule, and allow me easier/better control over my network?

As far as segmentation, Guest Wireless 1 (on latest firmware) will be segmented into its own subnets (one subnet for 2.4, one for 5).

Parental controls are configured via the GUI, but it runs on a blacklist format rather than whitelist/exceptions, meaning you have to put all PCs you want filtered into it.

If you're looking for as many controls and options as FreshTomato you're not going to find that with stock or even Merlin firmware.

 

[walter4938]

As far as segmentation, Guest Wireless 1 (on latest firmware) will be segmented into its own subnets (one subnet for 2.4, one for 5).

Parental controls are configured via the GUI, but it runs on a blacklist format rather than whitelist/exceptions, meaning you have to put all PCs you want filtered into it.

If you're looking for as many controls and options as FreshTomato you're not going to find that with stock or even Merlin firmware.

I realize that the guest networks are segmented. However, I had wanted the LAN ports on the same networks along with the wireless, depending on which port you're plugged into. I'm all around disappointed with ASUS's user interface. I know that it is capable of doing everything that the freshtomato router is doing, it is "just software".

The blacklist format is easy to get around.. I should be able to use iptables to make sperate networks no?

 

[drinkingbird]

I realize that the guest networks are segmented. However, I had wanted the LAN ports on the same networks along with the wireless, depending on which port you're plugged into. I'm all around disappointed with ASUS's user interface. I know that it is capable of doing everything that the freshtomato router is doing, it is "just software".

The blacklist format is easy to get around.. I should be able to use iptables to make sperate networks no?

Asus is releasing some new "Pro" routers with VLANs etc in them, not sure how much customization there will be.

Which Asus router do you have? I have LAN ports in the guest networks with a fairly simple script, VLANs are supported in the CLI just not the GUI (though you can load tomato on many Asus routers if you want it via the GUI). Some routers the script is pretty simple, others are a bit more involved, but by making use of the two (or 3) guest VLANs it is pretty simple.

IPtables won't give you separate networks but it will let you filter traffic between networks once you create them. If you want to create additional networks (beyond the main LAN and two or 3 guest ones) then you will need to do some scripting which again, difficulty depends on whether you have an HND chipset or non-HND.

Of course to do any of that you'd need to load Merlin firmware as stock doesn't let you script stuff.

For parental controls (filtering at least, not time limits) you can also make use of DNS servers that filter that stuff and use DNS Director to force clients to use them (and allow others to bypass them).

 

[walter4938]

Asus is releasing some new "Pro" routers with VLANs etc in them, not sure how much customization there will be.

Which Asus router do you have? I have LAN ports in the guest networks with a fairly simple script, VLANs are supported in the CLI just not the GUI (though you can load tomato on many Asus routers if you want it via the GUI). Some routers the script is pretty simple, others are a bit more involved, but by making use of the two (or 3) guest VLANs it is pretty simple.

IPtables won't give you separate networks but it will let you filter traffic between networks once you create them. If you want to create additional networks (beyond the main LAN and two or 3 guest ones) then you will need to do some scripting which again, difficulty depends on whether you have an HND chipset or non-HND.

Of course to do any of that you'd need to load Merlin firmware as stock doesn't let you script stuff.

For parental controls (filtering at least, not time limits) you can also make use of DNS servers that filter that stuff and use DNS Director to force clients to use them (and allow others to bypass them).

its an RT-AC86U, unfortunately not supported by tomato at this time. I am NOT a scripting guru in linux that is for sure, I would definitely need some ELI5 and examples. what is the HND chipset?

 

[OzarkEdge]

what is the HND chipset?

I think it means product of Broadcom's Home Networking Division.

OE

 

[drinkingbird]

its an RT-AC86U, unfortunately not supported by tomato at this time. I am NOT a scripting guru in linux that is for sure, I would definitely need some ELI5 and examples. what is the HND chipset?

Not positive on that one, I think people have said it uses the HND chipset which is more difficult.

But ssh into it and do a "robocfg show" and see if you get any output or not.

 

[walter4938]

Not positive on that one, I think people have said it uses the HND chipset which is more difficult.

But ssh into it and do a "robocfg show" and see if you get any output or not.

not found. I had read elsewhere the 86u has the HND chipset.

 

[drinkingbird]

not found. I had read elsewhere the 86u has the HND chipset.

I think if you use ifconfig to figure out what bridges those guest wireless are in, then you can move physical ports in those same bridges. There have been discussions here about it, you may need to use vlanctl and other commands too. I think that may be why yours doesn't support Tomato, due to the different/more complex architecture.

 

[Tech9]

FrestTomato stuck to whatever was available as opensource in the past. Nothing Asus after 2015 is supported.

 

[walter4938]

I am very ignorant with unix/linux, what kind of commands are used to say make two of the LAN ports assigned a separate subnet such as 192.168.10.xxx? If I make changes using vlanctl, I assume it has to be scheduled in a script?

 

[drinkingbird]

I am very ignorant with unix/linux, what kind of commands are used to say make two of the LAN ports assigned a separate subnet such as 192.168.10.xxx? If I make changes using vlanctl, I assume it has to be scheduled in a script?

First, if you're on 386 or higher code base and have guest wireless 1 enabled, you should have VLAN 501 (2.4Ghz guest) and VLAN 502 (5ghz Guest) already created, each with their own subnet and DHCP pool. So they've kind of done some of the work for you. So I'd highly recommend going that route to get a lot of the work out of the way automatically. I have moved a wired port into 502 (untagged) and also trunked (tagged) 501 to my outdoor 2.4Ghz AP on my non-HND router and it works well. If you want some ports in their own subnet/vlan that is NOT shared with a guest wireless, you can still use this pre-configured functionality, just hide the SSID for guest wireless 1 and use it strictly for wired clients, then if you want guest you can use GW2 and/or 3 for that (which will share a subnet with your LAN but use firewall rules to block communication as long as you enable the option to block LAN access from guest.

If you search here for RT-AC86U VLANs you'll find some discussions. Bear in mind a lot of the discussions were before Asus created these two new networks for you so they are actually doing a lot more than you need to now. I believe now all you have to do is move the physical interface into the guest bridge, and use ifconfig (and possibly vlanctl or ip link) to enable that new sub-interface. I believe you'll also have to disable hardware switching with ethswctl -c hw-switching -o disable for it to work. In one of the threads it is stated that once you disable hardware switching you can also use the more standard linux "ip link" commands to do some of the stuff for you.

Yes any changes you make using vlanctl, brctl, ip link, etc will need to be in a script. Services-start script works, you just have to keep in mind any changes you make in the router could potentially overwrite your script changes until you reboot or re-run the script. Service-event scripts may be more appropriate since they'll run after various services are restarted and reapply your configs.

I think you're going to need to do the following
disable hardware switching
brctrl to remove the physical eth port from the main bridge
brctl to add that port into the guest bridge
ifconfig to bring up the new subinterface like eth0.v501

Without having access to an HND router all I can really tell you is to go look at how VLAN 501 and 502 are set up in ifconfig, vlanctl, ip link, brctl, etc and reverse engineer how to move a physical port over.

Your other option is to upgrade to an AX router (either a Pro model which has native VLAN support, or a non-pro that uses non-HND chipset and robocfg which makes the script a lot easier). You could also look at a different AC router like the RT-AC88U which uses non-HND, or even the RT-AC1900P. Probably can get them cheap used. I believe the 86 is considered a dud of a router so you may want to replace it anyway.

 

[Adooni]

FrestTomato stuck to whatever was available as opensource in the past. Nothing Asus after 2015 is supported.

FT have 3rd party Asus FW support now and work at new Asus routers supporting FT will start soon but I do not think AC86U will be priority at all

looks like work will start from TUF-AX3000 V2 when GPL will be available end of FEB beginning of MAR this year.

info I have is from Polish dev site https://openlinksys.info/forum/viewthread.php?thread_id=22134&rowstart=760 but you can read more here https://www.linksysinfo.org/index.php?forums/tomato-firmware.33/

 

[coldheat]

I kinda asked about this in a separate thread and have not installed Merlin yet on my RT-AC5300 but to confirm, this little ubiqui managed switch I bought to use with the stock firmware on my 5300 won't work right? Because stock firmware doesn't support vlan's?

 

[drinkingbird]

I kinda asked about this in a separate thread and have not installed Merlin yet on my RT-AC5300 but to confirm, this little ubiqui managed switch I bought to use with the stock firmware on my 5300 won't work right? Because stock firmware doesn't support vlan's?

Depends, do you want to use multiple VLANs between the switch and the router? If not, it will work fine (the fact that the switch supports VLANs doesn't mean it requires them). If you want multiple VLANs between the router and switch then you need to install Merlin and do some scripting.

 

[coldheat]

Depends, do you want to use multiple VLANs between the switch and the router? If not, it will work fine (the fact that the switch supports VLANs doesn't mean it requires them). If you want multiple VLANs between the router and switch then you need to install Merlin and do some scripting.

which is the moral of the story. been looking for solid white papers on that.

 

[drinkingbird]

which is the moral of the story. been looking for solid white papers on that.

On what - enabling VLANs on the router? If you are running merlin, SSH into the router and do "robocfg show". If you get an output, then it is fairly easy to do with a script.

 

[coldheat]

On what - enabling VLANs on the router? If you are running merlin, SSH into the router and do "robocfg show". If you get an output, then it is fairly easy to do with a script.

Yes, I'm just looking for the script

 

[drinkingbird]

Yes, I'm just looking for the script

Did you get an output from that command?