OPNsense Forum

English Forums => General Discussion => Topic started by: fox983 on October 11, 2015, 02:18:51 pm

Title: [SOLVED] Block mac address
Post by: fox983 on October 11, 2015, 02:18:51 pm

Hi, is there a way to block navigation on wan to a specific mac address? I don't find anything, eg. in firewall rule I can only set an IP address...

Title: Re: Block mac address
Post by: weust on October 11, 2015, 03:00:05 pm

AFAIK a MAC address isn't known outside the internal network. Meaning, it's not visible on the internet?
I could be wrong though.

Title: Re: Block mac address
Post by: franco on October 11, 2015, 04:47:48 pm

Packet filters normally don't allow filtering below the IP layer[1]. If you still want to do it, you will maybe have luck by modifying the ARP table manually.

[1] https://www.freebsd.org/doc/en/articles/filtering-bridges/article.html

Title: Re: Block mac address
Post by: fox983 on October 11, 2015, 11:01:54 pm

Inside LAN mac address is known and I think it could be possible block or allow navigation through firewall. So through GUI isn't possible to block navigation? Many domestic router have this function. It could be nice also allocate more or less bandwidth, but this is another story  ;D

Title: Re: Block mac address
Post by: franco on October 12, 2015, 07:16:46 am

I was thinking you could use the captive portal MAC filtering and just have no accounts active on the login page?

Title: Re: Block mac address
Post by: fox983 on October 12, 2015, 12:02:25 pm

Captive Portal seems working BUT I think it could be improved: if a user has internet access (without authentication) and I block his mac address, the only way is reboot the firewall, if not  PC continues to navigate. Trying to reboot Pc or Captive Portal with no success... If I reboot firewall, navigation on PC is denied.
Is it possible block navigation without rebooting?
Thank you

Title: Re: Block mac address
Post by: weust on October 12, 2015, 12:06:30 pm

And if that person changes the MAC address?

Title: Re: Block mac address
Post by: fox983 on October 12, 2015, 12:45:04 pm

Change IP is easier than change mac address, rather best known...
Obviously changing mac address or IP is the way to bypass the block.

Title: Re: Block mac address
Post by: fox983 on October 12, 2015, 12:47:22 pm

In Captive Portal - Allowed IP addresses is there a way to insert a range of IP instead of a single IP?

Title: Re: Block mac address
Post by: franco on October 13, 2015, 07:21:58 am

Not yet, but I will record this as a feature request for the all new captive portal:

https://github.com/opnsense/core/issues/430