Access restrictions for everyone except two PCs?

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi all,

I'm currently using the following rule in /etc/config/firewall:

config rule
	option name 'Access-Restrictions'
	option src 'lan'
	option dest 'wan'
	option proto 'all'
	option target 'REJECT'
	option extra '-m time --kerneltz --weekdays Sun,Mon,Tue,Wed,Thu,Fri,Sat --timestart 00:30 --timestop 6:00'
	option src_mac '!D0:50:99:A8:D9:42'

I'd like to add another mac to the exceptions list (D0:50:99:5E:65:0E). Changing to '!D0:50:99:A8:D9:42' to '!D0:50:99:A8:D9:42 !D0:50:99:5E:65:0E' didn't seem to work.

2

Did you ever figure out a way to do this? I was just setting up the same thing on my FW, Timed Restrictions for the kid's devices. Doing it through Luci, there wasn't a way to do multiple MAC addresses per timed entry.

I also noticed that the firewall seemed to default to UTC instead of the system time.

I entered my times as 21:00:00 through 06:30:00 (9pm - 6:30am Eastern), however when I looked at the Firewall status, I saw the times entered with UTC following it.

So, with DST now, we're -4 UTC, so I've checked the "Time in UTC" box and modified my times to be 01:00:00-10:30:00.

My rules look like this:
MAC 5C:AD:CF:D3:0A:9C TIME from 01:00:00 to 10:30:00 on Mon,Tue,Wed,Thu,Sun UTC /* !fw3: iPad Timed Restrictions */
Source lan desk wan - REJECT

3

Why not simply add a new rule earlier to the chain that explicitly allows traffic from that MAC?

So that there would first be the whitelist rule for some MACs, and only then the time based restrictions for everybody else.

1 Like
4

Thank you, that worked wonderfully. Here is the config I'm using for anyone else interested:

config rule
	option name 'Access-Permits'
	option src 'lan'
	option dest 'wan'
	option proto 'all'
	option target 'ACCEPT'
	option src_mac 'D0:50:99:A8:D9:42 d0:50:99:5e:65:0e 00:16:eb:65:74:2b'

config rule
	option name 'Access-Restrictions'
	option src 'lan'
	option dest 'wan'
	option proto 'all'
	option target 'REJECT'
	option extra '-m time --kerneltz --weekdays Sun,Mon,Tue,Wed,Thu,Fri,Sat --timestart 00:30 --timestop 6:00'

@alex You might find this reply relevant.

Sorry for the late reply. I was busy with other stuff and this wasn't super high priority.

5

As a side-note, if anyone wants to kill already-established connections for time-based rules, check out this thread: https://forum.openwrt.org/viewtopic.php?id=65807