How can I get these simple quality of life features?

  1. an easy and simple way to get a list of all the currently connected devices, all devices connected to the network through WiFi and Ethernet

  2. I'm once again asking for an easy and simple way to get real-time BW statistics for every single connected device whether it's connected through Ethernet or WiFi, I want them all.

  3. An easy and simple way to set a download and/or upload speed limit for any device I want whether it is connected to the network through WiFi or Ethernet.

  4. An easy and simple way to block internet access to any device that's connected to the network whether it is connected to the network through WiFi or Ethernet.

Very important note: I have the 2nd router which isn't running OpenWrt setup as a repeater but the problem is that the devices that are connected to it don't show up on the main router overview page

You have many advanced requests in combination with easy here.

The only way I know that can do this and some of your other requests is a IEEE 802.1X RADIUS network setup.

Configure the OpenWrt as an AP

2 Likes

You can get a list of leases with ubus call luci-rpc getDHCPLeases, then scan that and do equivalent of ping on each IP to see if they are alive. Shortcoming is that it will show neither true-static IPs (reserved IPs are just DHCP, so no issue there), nor SLAAC addresses, so you will not catch all "currently connected" hosts. You could augment this with a table of the true static IPs to get around that limitation, but SLAAC is a much more difficult issue that you'll need to research.

I think there's some collectd plugin that does this, so look there first. Once you get the stats collection working, you can integrated it into luci-app-statistics using one of the already supported plugins as a model.

That's easy if you know the MACs of the devices in question. Just add some nft rate limiting rules in the appropriate chain.

ether saddr <MAC>   limit rate 10 mbytes/second burst 9000 kbytes   counter   accept

This one is the same as above, just write a rule that drops all packets from the appropriate ether address when oifname is eth0 or whatever your WAN device name is...

Appropriate use of nft sets will allow you to add and remove MACs from those rules quickly and easily without having to refresh the firewall at all.

Thank you but how can I do these in the GUI, I don't want to use the CLI

There's no canned solution to what you want to do; this is a programming task and you'll need to write code to accomplish it.

It is set as an AP, the problem is that by default OpenWrt for the currently connected devices it only shows the ones that are connected directly to the router on WiFi (in the associated station section in the status page and the wireless settings page in the GUI LuCI), for everything else I'll have to rely on the 'active DHCP leases' and 'Active DHCPv6 leases' which is ofc not intended to show the currently connected devices and I can't therefore as easily (using the GUI) block a device that's connected to the network through Ethernet or the 2nd router that set as an extender

For the devices that 're connected to the OpenWrt router through WiFi I can easily block anyone of them through Network -> wireless -> click edit on one of the wireless networks -> mac filter -> add or select the mac address of the device I wanna block)

Can't I block a device from the internet in the firewall settings in the LuCI GUI?!

Yes, you can.

Find the MAC of the device and add a block rule. But, if the device has randomized MAC enabled (usually phone or tablet, but sometimes various other devices), then this will be unreliable as the MAC may change. (One of my workstations has an MSI mobo with a randomized MAC on an Intel AX200 that rotates whenever the machine is rebooted, never looked to see if there was some BIOS setting to make it stable.)

If you try to block by IP, you will have an even worse time, as most user devices these days use SLAAC with privacy settings enabled, and hence generate new IPv6 GUAs every 24 hours, so even if the IPv4 is somewhat stable, you'll be chasing the device constantly. (You can, of course, disable IPv6, but that's like ripping the electronic fuel injection off your car and installing a mechanical carburetor.)

The most robust method is to create a subnet or VLAN, where you can control all access irrespective of what devices are connected through it, and restrict that part of the network as a whole.