Restricting internet access by IP and time range
-
@KOM:
The way I've done it in the past (going from memory here) was to create a schedule for the time period where you want to allow access. Then you create a LAN blocking rule for the IP addresses that you want to have no Internet access by default, and link that schedule into the block rule under Advanced features - Schedule.
cant see to get the LAN blocking rule to work. this is what i have set but its still connecting to the internet
-
Did you reset the states when you tested? Existing states won't be blocked. What's up with the funny Source? Can you show a screen shot of your block rule? I notice you don't have the schedule linked in.
-
sorry what do you mean "reset the states" and whats so funny about the source? its the IP of the phone i'm testing the block on.
didnt put the schedule in yet, was testing every step as i implement
-
sorry what do you mean "reset the states"
Diagnostics - States - Reset States
whats so funny about the source?
Looks like you're trying to block an entire network as opposed to a single host.
-
@KOM:
sorry what do you mean "reset the states"
Diagnostics - States - Reset States
thanks
whats so funny about the source?
Looks like you're trying to block an entire network as opposed to a single host.
ah.. that explains a bunch.. gotta look up blocking
-
Please post a screenshot of your block rule as I requested previously.
-
@KOM:
Please post a screenshot of your block rule as I requested previously.
i posted the block rule in reply#10 been reading and reading trying this and that but i can get the basic block to work.
-
The rule you have in #10 should block all traffic from 192.168.1.0/24 into the LAN interface (and out to the internet).
If it is not doing so, then LAN net is not 192.168.1.0/24
Post Status > Interfaces
At least the LAN interface.
-
so i should put the IP i'm trying to block in the Destination field instead of Source? i tried that also and reset the states but my test device was still getting to the internet
-
i posted the block rule in reply#10
Sorry, don't know how I missed that :P
so i should put the IP i'm trying to block in the Destination field instead of Source?
No, you want to use the client IP you're testing with as the Source. Please post your interface details as Derelict requested. Once we see what we're working with, it will take away a lot of the guesswork.
-
@KOM:
No, you want to use the client IP you're testing with as the Source. Please post your interface details as Derelict requested. Once we see what we're working with, it will take away a lot of the guesswork.
but isnt that how its setup in the rule?
attached are the interfaces
-
OK, at least now we know your LAN really is 192.168.1.0/24. I assume your test client is 192.168.1.112? Edit your block rule to make the Source a Single host or alias, save it, clear the states and try again.
-
i used "Network" instead of "Single host or alias" because network gave me an option to change the subnet with "Single host or alias" its greyed out and wouldnt let me change it.
trying now..
edit: attached the new rule
-
still had internet after restarting the states… so i rebooted the firebox and the test device (iPhone) but still had internet.
-
No %&&^&^ idea what you've done.
Reset to factory and start over. Start simple. One thing at a time. Test. Move on.
-
Verify that your test client is really at 192.168.1.112? Your LAN rule should block all traffic from that IP address.
-
its crazy.. so after testing last night i disabled the rule and played some xbox live..
then sometime this morning around 5am or so all internet was blocked..
so I deleted the rule rebooted and everything came back. -
No %&&^&^ idea what you've done.
Reset to factory and start over. Start simple. One thing at a time. Test. Move on.
'
this is my 3rd time starting over i've been implementing slowly and testing as i go.@KOM:
Verify that your test client is really at 192.168.1.112? Your LAN rule should block all traffic from that IP address.
it is.. its not static tho but its the IP currently leased..
-
OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all. Are you sure it isn't flipping to cellular?
-
@KOM:
OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all. Are you sure it isn't flipping to cellular?
no i have the wifi assist is turned off.. and this morning i was getting time outs on everything
