Menu
What's new
By:
Filters Better Search

Time based rule to not allow LAN access to a device

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

J

JohnD5000

Very Senior Member
My son is watching movies on his tablet. The movies are located on a hard drive attached to the router. I do not want him to have the ability to watch anything after 10 pm at night through 8 am in the morning. Is there any way to put in a rule that the device does not have access to the LAN (it is connected wirelessly) between those hours?

Note, I know the mac address of the device and the device has a Manually Assigned IP address in the DHCP.

Thank you
 
Add appropriate firewall rules w/ the firewall-start script.

Code: 
iptables -I INPUT -i br0 -s 192.168.1.100 -p tcp -m multiport --dports 139,445 -m time --timestart 22:00 --timestop 00:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
iptables -I INPUT -i br0 -s 192.168.1.100 -p tcp -m multiport --dports 139,445 -m time --timestart 00:00 --timestop 08:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT

I'm assuming the access protocol is SMB (ports 139 & 445).
 
eibgrad said:
Add appropriate firewall rules w/ the firewall-start script.

Code: 
iptables -I INPUT -i br0 -s 192.168.1.100 -p tcp -m multiport --dports 139,445 -m time --timestart 22:00 --timestop 00:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
iptables -I INPUT -i br0 -s 192.168.1.100 -p tcp -m multiport --dports 139,445 -m time --timestart 00:00 --timestop 08:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT

I'm assuming the access protocol is SMB (ports 139 & 445).
Click to expand...


Thanks,

I'm not sure about SMB (ports 139 & 445), I set this up under:

USB Applications/Services Center
-Media Server -- enable UPnP Media Server = (ON)
and
-Network Place (Samba) -- Enable Share = (ON)
 
Samba *is* SMB (SaMBa). Just start an ssh session and copy/paste the rules into the terminal window, and see if it works. If it does, you can then commit the rules to the firewall-start script.
 
P.S. Looks like the Media Server is using minidlna, which uses port 8200. So you could add that to the list of ports in the rules as well.
 
eibgrad said:
Samba *is* SMB (SaMBa). Just start an ssh session and copy/paste the rules into the terminal window, and see if it works. If it does, you can then commit the rules to the firewall-start script.
Click to expand...


Thanks, I entered them. Is there any place to see if they are in there? Nothing shows on any of the Firewall screens in the GUI.

Is the only way to test is to just go to the device and try it throughout the day?
 
You can dump the FORWARD chain of the filter table to see the rules (they'll be at the top). And if they are being activated, they will show a >0 pkts count.

Code: 
iptables -vnL INPUT

Anything done from the command line will NOT show in the GUI. That's just the way it works.

And yes, like any change, whether via the GUI or scripting, the proof of the pudding is in the eating.
 
Last edited:
OK, I don't think it worked

Code: 
Jadmin@RT-AC86U-07F8:/tmp/home/root# iptables -I INPUT -i br0 -s 192.168.81.180 -p tcp -m multiport --dports 139,445,8200 -m time --timestart 22:00 --timest
op 00:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
Jadmin@RT-AC86U-07F8:/tmp/home/root# iptables -I INPUT -i br0 -s 192.168.81.180 -p tcp -m multiport --dports 139,445,8200 -m time --timestart 00:00 --timest
op 08:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
Jadmin@RT-AC86U-07F8:/tmp/home/root#
Jadmin@RT-AC86U-07F8:/tmp/home/root#
Jadmin@RT-AC86U-07F8:/tmp/home/root#
Jadmin@RT-AC86U-07F8:/tmp/home/root# iptables -vnL FORWARD
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  195 14028 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            source IP range 192.168.81.211-192.168.81.214
12173 4284K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 other2wan  all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
  116  5683 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
  634 48095 NSFW       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  634 48095 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
    0     0 OVPN       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 DNSFILTER_DOT  tcp  --  br+    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:853
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Jadmin@RT-AC86U-07F8:/tmp/home/root#
 
eibgrad said:
Sorry, I had it wrong. It's the INPUT chain.

Code: 
iptables -vnL INPUT
Click to expand...
Thanks,

Not sure what I'm looking at, does this look OK?

Code: 
Jadmin@RT-AC86U-07F8:/tmp/home/root# iptables -vnL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445,8200 TIME from 00:00:00 to 08:00:00 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445,8200 TIME from 22:00:00 to 00:00:00 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445,8200 TIME from 22:00:00 to 00:00:00 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445 TIME from 00:00:00 to 08:00:00 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445 TIME from 22:00:00 to 00:00:00 reject-with icmp-port-unreachable
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:51194
   40  2800 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
 331K  465M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  409 27499 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
 4552 1040K PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0           
 4901  776K PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
 4901  776K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
 4026  714K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
  526  326K OVPN       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
   12  4002 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    1    40 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.81.1         ctstate DNAT tcp dpt:8443
    0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
  513  322K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Jadmin@RT-AC86U-07F8:/tmp/home/root#
 
Yeah, you messed up a bit. You have rules w/ 139,445 and rules w/ 139,445,8200.

You could execute the following to clean things up, or just reboot and try again.

Code: 
iptables -D INPUT 3; iptables -D INPUT 3; iptables -D INPUT 3
 
I'm not competing in the uptime contest...I did the reboot.

How's this look?

Thanks

Code: 
ASUSWRT-Merlin RT-AC86U 386.5_0 Wed Mar  2 16:37:00 UTC 2022
Jadmin@RT-AC86U-07F8:/tmp/home/root#
Jadmin@RT-AC86U-07F8:/tmp/home/root#
Jadmin@RT-AC86U-07F8:/tmp/home/root# iptables -vnL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445,8200 TIME from 00:00:00 to 08:00:00 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  br0    *       192.168.81.180       0.0.0.0/0            multiport dports 139,445,8200 TIME from 22:00:00 to 00:00:00 reject-with icmp-port-unreachable
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:51194
    0     0 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
95610  138M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
   93  5459 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
  353 50587 PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0           
  442 52563 PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
  442 52563 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
  296 44287 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
   57  6300 OVPN       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW
    1   328 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.81.1         ctstate DNAT tcp dpt:8443
    0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
   56  5972 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Jadmin@RT-AC86U-07F8:/tmp/home/root#
 
Just realize this is NOT currently persistent. You need to make it part of a firewall-start script to make it persistent. But it's good enough now to just test it.
 
I put it in the firewall-start script before the reboot, so that's what the above was from. Therefore, I think I should be good to go.
 
eibgrad said:
Anything done from the command line will NOT show in the GUI. That's just the way it works.
Click to expand...

Just wondering if you know if one of the AMTM addons (or maybe a non-AMTM addon) allows you to see these firewall rules added by the command line?
 
JohnD5000 said:
Just wondering if you know if one of the AMTM addons (or maybe a non-AMTM addon) allows you to see these firewall rules added by the command line?
Click to expand...

If by seeing them you mean in the GUI, No. The GUI doesn't offer a means to examine the firewall except for those features it directly manages (e.g., Network Services Filter). That's why it's preferable to NOT use the command line unless you have no other choice. And that was the case here. The best you can do is use a command line tool like SSH to dump the firewall, as I showed you.

That said, if some script writer comes along and adds a GUI feature for creating and managing firewall rules for purposes NOT currently available, that's a different story. Sometimes script writers make it a point to integrate their scripts into the GUI to satisfy this type of need (e.g., YazFi). But that requires a LOT of effort, and is only feasible when you have a well-defined feature requirement that will benefit a large number of users.

For one-off situations like yours, you just have to live w/ the fact the GUI doesn't make these changes visually evident.
 
What would be the best way to stack 4 addresses (say 192.168.81.180, 192.168.81.185, 192.168.81.192, 192.168.81.200)?

Would I just create the 2 lines 4 times (with the addresses), or is there a way to combine the addresses in the 2 lines?


iptables -I INPUT -i br0 -s 192.168.81.180 -p tcp -m multiport --dports 139,445,8200 -m time --timestart 22:00 --timestop 00:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
iptables -I INPUT -i br0 -s 192.168.81.180 -p tcp -m multiport --dports 139,445,8200 -m time --timestart 00:00 --timestop 08:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
 
Use an ipset.
Bash: 
ipset -! -q create sonsdevs hash:ip
ipset -! -q add sonsdevs 192.168.81.180
ipset -! -q add sonsdevs 192.168.81.185
ipset -! -q add sonsdevs 192.168.81.192
ipset -! -q add sonsdevs 192.168.81.200

iptables -I INPUT -i br0 -m set --match-set sonsdevs src -p tcp -m multiport --dports 139,445,8200 -m time --timestart 22:00 --timestop 00:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
iptables -I INPUT -i br0 -m set --match-set sonsdevs src -p tcp -m multiport --dports 139,445,8200 -m time --timestart 00:00 --timestop 08:00 --weekdays Mon,Tue,Wed,Thu,Fri,Sat,Sun --kerneltz -j REJECT
 
You must log in or register to reply here.

Similar threads

K
How to block LAN access for a wired device on ASUS Merlin (Firmware 3004.388.8_2)?
Replies
12
Views
692
webreaper
W
U
Loss of access to user interface after application of VPN rule and Killswitch (3004.388.8)
Replies
14
Views
1K
SaBl
S
M
Firewall rule to allow only a specific domain name
Replies
13
Views
1K
ColinTaylor
C
R
Disable Intranet access for a LAN port (not the WiFi Guest network)?
Replies
13
Views
635
Tech9
Tech9
D
GT-AX6000 - 3004_388.6_0 - Wireguard client - No Access to Servers local LAN
Replies
5
Views
1K
Drihha
D
Similar threads
Thread starter Title Forum Replies Date
T [Solved]Configure Policy based routing for transparent proxy Asuswrt-Merlin 6
r000t Hardcoded Google DNS IPTABLES rule Asuswrt-Merlin 6
U Loss of access to user interface after application of VPN rule and Killswitch (3004.388.8) Asuswrt-Merlin 14
L question of vpn director rule Asuswrt-Merlin 7
B Solved What VPN Director rule should i use to be able to connect outside my home to my VPN provider? Asuswrt-Merlin 2
GShlomi Using Dual-WAN failover but using the passive with a rule Asuswrt-Merlin 0
N IPv6 6RD tunnel block/allow by mac/IP Asuswrt-Merlin 3
A How to allow incoming WAN connections for WireGuard clients? Asuswrt-Merlin 5
postoronnim-v How to prevent WireGuard VPN server clients from accessing the local network (allow only Internet access)? Asuswrt-Merlin 18
B Asus - RT-AX88U - USB Application - Network Place (Samba) Share / Cloud Disk - Problem when enabling Allow guest login Asuswrt-Merlin 4

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 655 (members: 24, guests: 631)
Top