See the update at the bottom of this post – Tim 20180211
I have an Ubiquiti EdgeRouter PoE at the house as my main router. In order to manage “resources” at the house, I wanted a way to block a couple of MAC addresses at a certain time each day. I created a filter that blocks by MAC address that looks something like:
set firewall name SWITCH0_IN default-action accept set firewall name SWITCH0_IN description 'Used for blocking local users' set firewall name SWITCH0_IN rule 1 action drop set firewall name SWITCH0_IN rule 1 description APhone set firewall name SWITCH0_IN rule 1 disable set firewall name SWITCH0_IN rule 1 log disable set firewall name SWITCH0_IN rule 1 protocol all set firewall name SWITCH0_IN rule 1 source mac-address '66:55:44:33:22:11' set firewall name SWITCH0_IN rule 2 action drop set firewall name SWITCH0_IN rule 2 description iPhone set firewall name SWITCH0_IN rule 2 disable set firewall name SWITCH0_IN rule 2 log disable set firewall name SWITCH0_IN rule 2 protocol all set firewall name SWITCH0_IN rule 2 source mac-address '11:22:33:44:55:66' set firewall name SWITCH0_IN rule 3 action drop set firewall name SWITCH0_IN rule 3 description Desktop set firewall name SWITCH0_IN rule 3 disable set firewall name SWITCH0_IN rule 3 log disable set firewall name SWITCH0_IN rule 3 protocol all set firewall name SWITCH0_IN rule 3 source mac-address '12:34:56:78:90:ab'
I applied this rule to the “switch0” interface that talks to my LAN interfaces at eth2, eth3 and eth4.
For the rulesets above, I want to enable rule #2 and #3 for the devices “iPhone” and “Desktop” to block traffic from them. Two hours later, I want to disable this rule to pass traffic again. This script does just that…
#!/bin/vbash # A script to disable access for two MAC addresses at # 0330 to 0530 UTC (1930 to 2130 Pacific) everyday. unblock=0 if [ $# == 1 ]; then unblock=1 fi PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin WR="/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper" $WR begin if [ $unblock == 1 ]; then $WR set firewall name SWITCH0_IN rule 2 disable $WR set firewall name SWITCH0_IN rule 3 disable else $WR delete firewall name SWITCH0_IN rule 2 disable $WR delete firewall name SWITCH0_IN rule 3 disable fi $WR commit $WR end
There are a couple of ways to configure the router with scripts. Ubiquiti suggests using the /opt/vyatta/etc/functions/script-template script like:
#!/bin/vbash
if [ $# == 0 ]; then
echo usage: $0
exit 1
fi
new_ip=$1;
source /opt/vyatta/etc/functions/script-template
configure
set interfaces tunnel tun0 local-ip $new_ip
commit
save
exit
This actually breaks due to a bug. I have had to use the /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper as part of my script. Works just fine.
The CRON entries that will run the scripts at 0330 and 0530 UTC…
30 3 * * * /home/joeuser/block_mac.sh 30 5 * * * /home/joeuser/block_mac.sh unblock
Updated on Feb 11th 2018...
It seems that either I missed this feature or Ubiquiti just added it. You can add times to enable and disable the rule. For instance, in the case of Rule #2 above, you would add starttime and stoptime statements. You can also specify date of the week or date such as day/month/year. This has been in Vyatta for a while now.
set firewall name SWITCH0_IN rule 2 action drop set firewall name SWITCH0_IN rule 2 description iPhone set firewall name SWITCH0_IN rule 2 disable set firewall name SWITCH0_IN rule 2 log disable set firewall name SWITCH0_IN rule 2 protocol all set firewall name SWITCH0_IN rule 2 source mac-address '11:22:33:44:55:66' set firewall name SWITCH0_IN rule 2 time starttime '21:00:00' set firewall name SWITCH0_IN rule 2 time stoptime '22:00:00' set firewall name SWITCH0_IN rule 2 time utc