# Block All except MAC address list **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [April 9, 2022, 5:00pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879 "2022-04-09T17:00:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mdp716](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mdp716/32/51452_2.png) [@mdp716](https://forum.openwrt.org/u/mdp716)\ **Post date:** [April 9, 2022, 5:00pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/1 "2022-04-09T17:00:55Z")
New to OpenWRT and am looking to do MAC address filtering. How would I set up a Firewall Rule to Block ALL Outbound traffic to the internet EXCEPT from a list of MAC Addresses? I've seen a few posts that will block specific MAC addresses from accessing the WAN (Internet) and otherwise allow all others access but I wish to do the inverse of that - block all outbound except a specific list of MAC addresses. ---
**Author:** ![mdp716](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mdp716/32/51452_2.png) [@mdp716](https://forum.openwrt.org/u/mdp716)\ **Post date:** [April 9, 2022, 5:35pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/6 "2022-04-09T17:35:29Z")
Thanks, but there is plenty out there to do this for wireless interfaces and that was not what I asked. I wish to block ALL LAN traffic (Wi-Fi and Wired) EXCEPT a list of MAC addresses. And I wish to NOT have to manage numerous lists for each node as well. Just ONE list of MAC addresses that are allowed internet access. More correctly, I do not have ANY devices connected via the OpenWRT wireless interface as my wireless connectivity is provided by a separate access point that is connected as a wired device as far as the OpenWRT device is concerned. Here is a basic idea of how my network is set up: Cable Modem --\> OpenWRT Device --\> Network Switch --\> Everything else. And the network switch has wired devices connected to it to include the Access Point that provides Wi-Fi access. ---
**Author:** ![mbo2o](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mbo2o/32/5465_2.png) [@mbo2o](https://forum.openwrt.org/u/mbo2o)\ **Post date:** [April 9, 2022, 6:02pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/7 "2022-04-09T18:02:08Z")
Change the default rule for the WAN zone from allow to reject to block all outgoing traffic . Then in the firewall rules add one rule per MAC address and set that rule to allow for the WAN zone ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [April 9, 2022, 6:16pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/8 "2022-04-09T18:16:43Z")
> [@mbo2o](#): > > Change the default rule for the WAN zone from allow to reject to block all outgoing traffic . This will block the router, not the lan. @mdp716 delete forwarding from lan to wan. Then create a rule to allow the desired source mac addresses from lan to wan. ```plaintext uci add firewall rule uci add_list firewall.@rule[-1].proto='all' uci set firewall.@rule[-1].name='test' uci set firewall.@rule[-1].dest='wan' uci set firewall.@rule[-1].target='ACCEPT' uci set firewall.@rule[-1].src='lan' uci add_list firewall.@rule[-1].src_mac='00:11:22:33:44:55' uci add_list firewall.@rule[-1].src_mac='00:66:77:88:99:AA' uci add_list firewall.@rule[-1].src_mac='MORE_MACS' uci -q delete firewall.@forwarding[0] uci commit firewall service firewall restart ``` ---
**Author:** ![mdp716](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mdp716/32/51452_2.png) [@mdp716](https://forum.openwrt.org/u/mdp716)\ **Post date:** [April 9, 2022, 9:16pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/9 "2022-04-09T21:16:18Z")
@trendy That sounds like what I am looking for. Any chance those MAC addresses land in a file somewhere that I would be able to edit? ---
**Author:** ![mdp716](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mdp716/32/51452_2.png) [@mdp716](https://forum.openwrt.org/u/mdp716)\ **Post date:** [April 9, 2022, 9:29pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/10 "2022-04-09T21:29:38Z")
@trendy Also, when you say "delete forwarding from lan to wan" do you mean I should change the lan ==\> wan Zone to Accept Accept Reject from what it is currently as depicted? ![image](https://forum.openwrt.org/uploads/default/original/3X/a/0/a055657d44714791dfc043c816c28199009d0839.png) ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [April 9, 2022, 10:08pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/11 "2022-04-09T22:08:47Z")
> [@mdp716](#): > > Any chance those MAC addresses land in a file somewhere that I would be able to edit? `/etc/config/firewall` > [@mdp716](#): > > Also, when you say "delete forwarding from lan to wan" do you mean I should change the lan ==\> wan Zone to Accept Accept Reject from what it is currently as depicted? No, this is forward, not forwarding. Edit lan zone, look at the bottom and remove **wan** zone from `Allow forward to destination zones:` Or you can run the commands I posted previously. ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [June 3, 2022, 2:00pm UTC](https://forum.openwrt.org/t/block-all-except-mac-address-list/124879/12 "2022-06-03T14:00:40Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.