# Filter Internet access by MAC **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [August 18, 2021, 3:52pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020 "2021-08-18T15:52:17Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 18, 2021, 3:52pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/1 "2021-08-18T15:52:17Z")
Hi there, there are a lot of topics regarding blocking connection by MAC, however I couldn't find how to perform easy clearance by mac. We are using internet connection for our Lab and the school blocked our internet. They demand that connection must be allowed by MAC! I don't much have a choice. So far, I'm using `/etc/config/wireless` to perform that: ``` list maclist '60:03:08:9E:60:AA' ``` However, it doesn't block ethernet and VPN. I think the correct way is to use firewall rules. I'm terrible with that. We have, around 50 devices. Would be easy just to fill a list with MAC. Any help is really welcome. ---
**Author:** ![16F84](https://forum.openwrt.org/user_avatar/forum.openwrt.org/16f84/32/36135_2.png) [@16F84](https://forum.openwrt.org/u/16F84)\ **Post date:** [August 18, 2021, 4:18pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/2 "2021-08-18T16:18:25Z")
If you connect to the network by ethernet you would MAC clone your WAN interfaces to an allowed address. LuCI--\>Network--\>Interfaces--\>WAN/WAN6--\>Override MAC address If you connect by WiFi you would accomplish the same thing by connecting via WiFi as a client (AP-STA) with a cloned MAC address of an allowed device by adding this line... option macaddr 'xx:xx:xx:xx:xx:xx' ....to the appropriate WiFi network listed under: vim /etc/config/wireless ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 18, 2021, 4:31pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/3 "2021-08-18T16:31:15Z")
> [@16F84](#): > > ou connect by WiFi you would accomplish the same thing by connecting via WiFi as a client (AP- Thanks @16F84, however I did not make myself clear. They will only allow our router to access the school network if I filter all connection to the router. The school will not see those MACs since they are all behind the NAT, however I need to present to them that I'm doing that. The solution you proposed regards the WAN interface, which is not the problem. I must filter (allow) LAN and radio0 connection by MAC. In other words, If an unauthorized person plugs his notebook with ethernet cable, but his MAC is not in the whitelist, he will not be able to connect. ---
**Author:** ![16F84](https://forum.openwrt.org/user_avatar/forum.openwrt.org/16f84/32/36135_2.png) [@16F84](https://forum.openwrt.org/u/16F84)\ **Post date:** [August 18, 2021, 4:36pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/4 "2021-08-18T16:36:06Z")
> [@thalesmaia](#): > > MAC is not in the whitelist LuCI--\>Network--\>Wireless--\>edit SSID--\>MAC-Filter--\>Allow listed only ...and then further to that you may want to disable masquerading on your WAN firewall to show the net admin what clients are connected - that I am not to sure about as you are disabling major security features etc. - you may want to confirm that with them / get a second opinion. ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 18, 2021, 4:53pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/5 "2021-08-18T16:53:33Z")
Hi @16F84, that is exactly what I'm doing. ``` /etc/config/wireless list maclist '60:03:08:9E:60:AA' ``` However, it only works for Wifi, not for eth0 or tun0 (VPN). ---
**Author:** ![16F84](https://forum.openwrt.org/user_avatar/forum.openwrt.org/16f84/32/36135_2.png) [@16F84](https://forum.openwrt.org/u/16F84)\ **Post date:** [August 18, 2021, 6:22pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/6 "2021-08-18T18:22:13Z")
That I do not know. [Here](https://bokunokeiken.wordpress.com/2015/06/27/how-to-block-device-on-openwrt-based-on-mac-address/) is an older solution. Maybe someone else knows? HTH ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [August 18, 2021, 8:57pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/7 "2021-08-18T20:57:21Z")
[Parental controls \> Restrict access to Wi-Fi by MAC address](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_parent_controls#restrict_access_to_wi-fi_by_mac_address) ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 18, 2021, 10:40pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/8 "2021-08-18T22:40:56Z")
Hi @vgaetera, your suggestions follows the same problem. I don't want to block specific MACs. I want to block all, except MAC1, MAC2, MAC3,... ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 18, 2021, 11:08pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/10 "2021-08-18T23:08:24Z")
Sorry, but I'm still confused. Allow listed only is for Wifi only, or am I missing something? Sorry, but I'm still confuse of firewall usage. ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [August 18, 2021, 11:25pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/11 "2021-08-18T23:25:33Z")
1. Navigate to **LuCI \> Network \> Firewall \> Traffic Rules**. 2. Click **Add** and specify: - Name: `Allow-Internet-Access` - Protocol: Any - Source zone: `lan` - Destination zone: `wan` - Action: accept 3. On the **Advanced Settings** tab specify: - Source MAC address: - `11:22:33:44:55:66` - `aa:bb:cc:dd:ee:ff` 4. Click **Save**. 5. Navigate to **LuCI \> Network \> Firewall \> General Settings \> Zones**. 6. Click **Edit** next to the `lan` zone. 7. On the **General Settings** tab specify: - Allow forward to destination zones: Uncheck all 8. Click **Save** , then **Save & Apply**. ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 26, 2021, 4:03pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/12 "2021-08-26T16:03:16Z")
I have one more question. > [@vgaetera](#): > > Click **Add** and specify: > > - Name: `Allow-Internet-Access` > - Protocol: Any > - Source zone: `lan` > - Destination zone: `wan` > - Action: accept This is working, however the VPN connection can't access internet as well. Should I add Source zone with wan as well? ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [August 26, 2021, 9:55pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/13 "2021-08-26T21:55:44Z")
You can assign the VPN interface to the WAN firewall zone. This should apply the same restrictions by MAC for VPN users. ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 26, 2021, 10:19pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/14 "2021-08-26T22:19:57Z")
You mean here: ![image](https://forum.openwrt.org/uploads/default/original/3X/f/c/fc38cf8be3c63384143b4cd347c93bd8fbb149b9.png) It's unspecified. Just add tun0? ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 26, 2021, 10:33pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/15 "2021-08-26T22:33:46Z")
I couldn't get it to work. At least changing the WAN zone. I was looking under LAN zone and found that tun+ is included. ![image](https://forum.openwrt.org/uploads/default/original/3X/0/d/0d6702696181939e7832c459f668a156c4c93c8f.png) Doesn't that mean that if I connect with VPN I'm inside the LAN? Shouldn't I have internet connection? I can't understand. ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [August 26, 2021, 10:48pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/16 "2021-08-26T22:48:37Z")
The LAN zone is typically used when you run a VPN server on your router. If you run a VPN client with a commercial VPN provider, then use the WAN zone. ---
**Author:** ![thalesmaia](https://forum.openwrt.org/user_avatar/forum.openwrt.org/thalesmaia/32/6249_2.png) [@thalesmaia](https://forum.openwrt.org/u/thalesmaia)\ **Post date:** [August 26, 2021, 11:04pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/17 "2021-08-26T23:04:38Z")
Sorry, I didn't explain correctly. I have a VPN server running inside Openwrt. When I connect (externally) to the Openwrt, I can access LAN but my internet connection is not redirected. My internet connection is blocked. ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [August 26, 2021, 11:25pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/18 "2021-08-26T23:25:55Z")
1. Navigate to **LuCI \> Network \> Firewall \> Traffic Rules**. 2. Click **Add** and specify: - Name: `Allow-Internet-Access-VPN` - Protocol: Any - Source zone: `lan` - Source address: VPN subnet, e.g. `192.168.8.0/24` - Destination zone: `wan` - Action: accept 3. Click **Save** , then **Save & Apply**. ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [September 5, 2021, 11:26pm UTC](https://forum.openwrt.org/t/filter-internet-access-by-mac/104020/19 "2021-09-05T23:26:49Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.