Time based rules for current connections

Feature Requests
1

Please can we have a firewall rule grammar element that means we can apply a time-based rule to apply to a current connection.

I set up time and MAC based rules to force my kids off their devices late evening to morning but the rules only stop NEW connections. Another element to the rule should allow existing connections to be terminated on the time limit
e.g. something like:
option force-close 'true'
or
option end-lease 'force-close'

The idea being it would be part of a rule that specifies clients (by MAC) with open lan or wireless connections and closes the connection, so that the time based rule that rejects traffic applies.

This may be naive or wrong application of the tech but SOMETHING that achieves this goal seems like it needs implementing for many/most home networks where kids are using gaming, social media surfing or other typical teenager late night activities :wink:

2

Is an alternative (seems non-optimal) to define a static IP for their devices and can I force close those IP addresses at a given time irrespective of whether they're in use?

3

You need a captive portal like opennds.

4

For whatever solution, it would be nice to be able to emit a 'coming up to time' message (a different but complementary time based rule, say 15mins ahead), using a basic protocol, such as MQTT publish, that the target machine could display in notifications (via a custom MQTT client or perhaps Home Assistant)

5

@brada4 Got any good links? I have no idea what opennds is. I can DuckDuck it but good links would be appreciated :slight_smile:

6

It is this thing:
https://openwrt.org/docs/guide-user/services/captive-portal/opennds
People have clock on their PC to track time.

7

OK tried that and it immediately locked me and my family out of my router. before I even knew I should or could configure it. What kind of tech obsessed wierdo makes their product unusable by default!

Had to use (something like) https://about.opennds to get back in and uninstall openNDS.

TBH, I think my initial instinct was correct. A rule that wants to reject traffic on the network should just work, whether or not the connection's in use and if the firewall only checks for rules on new connections then it should be open to feature requests to change that for a more user-task oriented approach!

I speak as a UX designer on mainframes where, despite what people may think we put the user experience at the centre of what we do, whatever type of user and whatever level of expertise they have.

Sorry @brada4, not having a go at you but that was a frustrating experience!

8

https://openwrt.org/docs/guide-user/firewall/fw3_configurations/dns_ipset#established_connections

9

Just for the record, once I installed opennds, which I thought just captures port 80 and intercedes with a login splash page, I couldn't even ssh into my router on a custom specified ssh port!

10

opennds seems like overkill, when the router could just apply a rule to a connection irrespective of its connection status

11

Thanks @krazeh . That looks promising. I'll have a read

12

Appreciated :slight_smile: I speak as an IT-dino, who almost half a century ago got a comment from a client (mayor airline): "UI must be intuitive; no need for an operator guide. We have a lot of temp workers, we can not afford to teach the usage of the terminal." And another statement: "There is no such issue like user error ..."

13

What's the custom port?

14

I'm prity sure my one cuts off existing connections, but specifying clients by mac often ends in disaster with mac spoofing being the default in apple and android devices.
Enabling devices with known mac might be a better idea?

I'n my setup I have two dnsmasq instances and have an isolated kids wifi and I just kill the wifi in crontab:

# 0/10 23 * * * uci set wireless.wifinet2.disabled=1; uci commit; wifi
# 0/10 23 * * * uci set wireless.wifinet3.disabled=1; uci commit; wifi
# 0/10 7 * * * uci set wireless.wifinet2.disabled=0; uci commit; wifi
# 0/10 7 * * * uci set wireless.wifinet3.disabled=0; uci commit; wifi

This will turn it off and on a schedule.

but i had to do this to make time rules work in the firewall:

chain time_rule_fix {
     type filter hook forward priority -1
     iifname "br-adults_lan" counter jump forward_adults_zone
     iifname "br-kids_lan" counter jump forward_kids_zone
     iifname "wan" counter jump forward_wan_zone
}
1 Like