time-boxed internet access for certain MACs or IPs

[adk20]

Dear forum,

I am trying to implement time-based restrictions for some IPs on my network that can be bypassed with a password or similar. I.e. for normal users, internet access should be terminated at a certain time. For some users, though, it should be possible to bypass this restriction. However, I haven't found a viable solution yet.

Time-triggered firewall rules do not appear to be suitable since they cannot be bypassed.

A captive portal is also not ideal as it is AFAIK always active.

Setting up a VPN server just for a few internal IPs to bypass time-based restrictions seems to be a bit over the top .

Any suggestions are highly welcome.

Cheers,
adk