{"id":124,"date":"2017-11-21T06:02:35","date_gmt":"2017-11-21T06:02:35","guid":{"rendered":"https:\/\/blog.lns.com\/?p=124"},"modified":"2018-02-12T04:26:18","modified_gmt":"2018-02-12T04:26:18","slug":"blocking-traffic-by-mac-address-on-ubiquiti-edgerouters-by-time-of-day","status":"publish","type":"post","link":"https:\/\/blog.lns.com\/?p=124","title":{"rendered":"Blocking traffic by MAC address on Ubiquiti EdgeRouters by Time of Day"},"content":{"rendered":"

See the update at the bottom of this post – Tim 20180211<\/span><\/p>\n

I have an Ubiquiti EdgeRouter PoE<\/a> at the house as my main router. \u00a0In order to manage “resources” at the house, \u00a0I wanted a way to block a couple of MAC addresses at a certain time each day. \u00a0 I created a filter that blocks by MAC address that looks something like:<\/p>\n

set firewall name SWITCH0_IN default-action accept\r\nset firewall name SWITCH0_IN description 'Used for blocking local users'\r\nset firewall name SWITCH0_IN rule 1 action drop\r\nset firewall name SWITCH0_IN rule 1 description APhone\r\nset firewall name SWITCH0_IN rule 1 disable\r\nset firewall name SWITCH0_IN rule 1 log disable\r\nset firewall name SWITCH0_IN rule 1 protocol all\r\nset firewall name SWITCH0_IN rule 1 source mac-address '66:55:44:33:22:11'\r\nset firewall name SWITCH0_IN rule 2 action drop\r\nset firewall name SWITCH0_IN rule 2 description iPhone\r\nset firewall name SWITCH0_IN rule 2 disable\r\nset firewall name SWITCH0_IN rule 2 log disable\r\nset firewall name SWITCH0_IN rule 2 protocol all\r\nset firewall name SWITCH0_IN rule 2 source mac-address '11:22:33:44:55:66'\r\nset firewall name SWITCH0_IN rule 3 action drop\r\nset firewall name SWITCH0_IN rule 3 description Desktop\r\nset firewall name SWITCH0_IN rule 3 disable\r\nset firewall name SWITCH0_IN rule 3 log disable\r\nset firewall name SWITCH0_IN rule 3 protocol all\r\nset firewall name SWITCH0_IN rule 3 source mac-address '12:34:56:78:90:ab'<\/pre>\n
I applied this rule to the “switch0” interface that talks to my LAN interfaces at eth2, eth3 and eth4.<\/p>\n
For the rulesets above, I want to enable rule #2 and #3 for the devices “iPhone” and “Desktop” to block traffic from them. \u00a0Two hours later, I want to disable this rule to pass traffic again. \u00a0This script does just that…<\/p>\n
#!\/bin\/vbash \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\r\n# A script to disable access for two MAC addresses at\u00a0 \u00a0 \u00a0\r\n# 0330 to 0530 UTC (1930 to 2130 Pacific) everyday.\r\nunblock=0\r\nif [ $# == 1 ]; then\r\n\u00a0 unblock=1\r\nfi\r\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\r\nWR=\"\/opt\/vyatta\/sbin\/vyatta-cfg-cmd-wrapper\"\r\n$WR begin\r\nif [ $unblock == 1 ]; then\r\n\u00a0 $WR set firewall name SWITCH0_IN rule 2 disable\r\n\u00a0 $WR set firewall name SWITCH0_IN rule 3 disable\r\nelse\r\n\u00a0 $WR delete firewall name SWITCH0_IN rule 2 disable\r\n\u00a0 $WR delete firewall name SWITCH0_IN rule 3 disable\r\nfi\r\n$WR commit\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\r\n$WR end<\/pre>\n
There are a couple of ways to configure the router with scripts. \u00a0Ubiquiti suggests<\/a> using the\u00a0\/opt\/vyatta\/etc\/functions\/script-template script like:<\/p>\n
 <\/p>\n
#!\/bin\/vbash\r\n     \r\nif [ $# == 0 ]; then\r\n  echo usage: $0 \r\n  exit 1\r\nfi\r\nnew_ip=$1;\r\n     \r\nsource \/opt\/vyatta\/etc\/functions\/script-template\r\nconfigure\r\nset interfaces tunnel tun0 local-ip $new_ip\r\ncommit\r\nsave\r\nexit<\/pre>\n
This actually breaks due to a bug. \u00a0I have had to use the\u00a0\/opt\/vyatta\/sbin\/vyatta-cfg-cmd-wrapper<\/a> as part of my script. \u00a0Works just fine.<\/p>\n
The CRON entries that will run the scripts at 0330 and 0530 UTC…<\/p>\n
30 3 * * * \/home\/joeuser\/block_mac.sh\r\n30 5 * * * \/home\/joeuser\/block_mac.sh unblock<\/pre>\n
\n
Updated on Feb 11th 2018..<\/strong>.<\/p>\n
It seems that either I missed this feature or Ubiquiti just added it. \u00a0You can add times to enable and disable the rule. \u00a0For instance, in the case of Rule #2 above, you would add starttime<\/strong> and stoptime<\/strong> statements. \u00a0You can also specify date of the week or date such as day\/month\/year. \u00a0This has been in Vyatta for a while now<\/a>.<\/p>\n
set firewall name SWITCH0_IN rule 2 action drop\r\nset firewall name SWITCH0_IN rule 2 description iPhone\r\nset firewall name SWITCH0_IN rule 2 disable\r\nset firewall name SWITCH0_IN rule 2 log disable\r\nset firewall name SWITCH0_IN rule 2 protocol all\r\nset firewall name SWITCH0_IN rule 2 source mac-address '11:22:33:44:55:66'\r\nset firewall name SWITCH0_IN rule 2 time starttime '21:00:00'\r\nset firewall name SWITCH0_IN rule 2 time stoptime '22:00:00'\r\nset firewall name SWITCH0_IN rule 2 time utc<\/pre>\n","protected":false},"excerpt":{"rendered":"
See the update at the bottom of this post – Tim 20180211 I have an Ubiquiti EdgeRouter PoE at the house as my main router. \u00a0In order to manage “resources” at the house, \u00a0I wanted a way to block a couple of MAC addresses at a certain time each day. \u00a0 I created a filter … Continue reading “Blocking traffic by MAC address on Ubiquiti EdgeRouters by Time of Day”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/posts\/124"}],"collection":[{"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lns.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=124"}],"version-history":[{"count":4,"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/posts\/124\/revisions"}],"predecessor-version":[{"id":149,"href":"https:\/\/blog.lns.com\/index.php?rest_route=\/wp\/v2\/posts\/124\/revisions\/149"}],"wp:attachment":[{"href":"https:\/\/blog.lns.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lns.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lns.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}