Block internet by IP and tme ver 2.3

  • hey group i just came back to pfsense created a VM with two passthrough nics. Everything is working great, but now i have to create restrictions for the kids.

    i need to restrict their portable devices for bedtime and also the xbox. can someone point me in a direction/article on how to complete this?

  • I've been Searching around and found this isn't a popular topic. Also found some older ways to do this but was wondering if there are some easier ways since 2.3

  • Rebel Alliance Global Moderator

    What do you mean popular - there is prob not a lot of topics on it because its so easy..

    Setup your devices to get a specific IP via dhcp reservation.  Now setup rule for access to these IP(s) on schedule.

  • thanks i already have the clients setup static, i'll look over the link and implement.

  • not sure if i did this correctly but it didnt work.. i also reset the states and nothing

  • Netgate

    Make rules that pass traffic according to the schedule you want traffic passed followed by a block rule for the same traffic without a schedule on it.

  • ok so i'm trying to just do the block part and i can even get that working..

    the device can still get to the internet even with the state type to none and resetting states.

  • Rebel Alliance

  • thanks. ppt..

    i moved it up reset states and now it works kinda.. if i go to a site i havent been before it will time out. but some apps and web still work for eg still works and i can search and click on the link but the link may or may not open..

    i do have squid so i dont know if somehow the caching is affecting the block

  • Netgate

    Why do you have squid?

  • i was reading about popular addons and was testing out its caching abilities to speed up browsing.

    edit: on the main LAN rule to allow should i change the state type to none?

  • Netgate


    Unless you REALLY need caching, squid generally does more harm than good.

  • i just dont understand why the firewall isnt firewalling.. my old linksys RV042 was soo easy to block and by time but its 10/100 ports are throttling me.

    ![access rules old.JPG](/public/imported_attachments/1/access rules old.JPG)
    ![access rules old.JPG_thumb](/public/imported_attachments/1/access rules old.JPG_thumb)

  • Netgate

    So you post an RV042 screen? That'll help.

  • sorry i was just hoping for a similarly easy way to block

    is there anything else i can post to make it easier to troubleshoot?

  • You may be seeing cached content from either squid or your browser.  Do what Derelict said.  Create a schedule time that access is allowed.  Create a LAN rule to allow access for the required IP address with your schedule.  Immediately below that rule, create a block rule for the same IP address but no schedule.  Clear states and test.

  • i'm using my iPhone to test wanted to take it one step at a time to was just testing the block, but that wasnt working..

    i removed SquidGuard then Squid and rebooted..

    then tried the block.. and same results.. some sites are blocked and some still allowed..

    then i made a rule for the pc i'm on see screenshot then reset states  and about the same thing.. some sites work i can relaod get new items like on facebook but anything new it wont load.

    edit: i even posted that^^ and this while the pc block was in effect and it worked.. :/

  • Rebel Alliance Global Moderator

    I am not sure what what is so hard understand here..

    Create a rule that allows your traffic for the schedule you want.. Then below that create a block for that IP..  Its really that simple!!

    You are trying to block on a schedule.. But not blocking ipv6..  You have a any rule for IPv6..  You do understand browser caches right?

  • i understand, but like i said before i'm just trying to take the process one step at a time and i'm just testing the total block part.. and after getting that working i'll do the allow.
    it wasnt the cache on the browser, i was getting new posts about walking dead for eg from facebook and also pulling other feeds and instagram from the mobile tester and also email notifications about posts on this thread.

    and you've mentioned IPV6  could that be it? i'm gonna disable IPV6 internally, i'll report back.

  • Rebel Alliance Global Moderator

    I don't know could it ;)  You have a any any rule for it..

    The proper use of the schedules is for allow time..  So create a rule that allows the traffic to your schedule, then after that rule there should be a specific deny if that allow rule on your schedule is not the last rule.

  • Netgate

    Why not just install a timer that turns off the electricity?

  • Rebel Alliance Global Moderator

    If you wanted to test block then test block.. Why did you have a schedule set on your block rule?

    Put in your block.. Clear you states, then for sure that IP is blocked NO internet for it… Then create a allow rule on the schedule you want and put above the block rule.. Unless you turn the feature off, it will clear the states when the schedule stops.

    This really is like 10 seconds to setup.

  • ahhhh epic frigging facepalm!!! so i disabled the the IPv6 allow rule then turned off IPv6 dhcp server, released and renewed IP and everything finally blocked..

    it was right in front of my face if it was a snake it could of bitten me.

    now i can test the schedule

    @derelict that would be hard on the spinning disk and defeatus on mobile devices.
    @johnpoz initially it was for a schedule.. but after getting the advice on how to i wanted to take it one step at a time, if not i would of still had an IPv6 crack.

  • Netgate

    Then schedule the WAP to shut off the SSID.

    Not sure what people are going to do when their devices are changing IPv6 addresses deliberately and constantly.

  • Is there a way to create schedules by just time? Or to use wild cards to include all months and like day of week?

  • Netgate

    Click the week day header to select all occurrences that day like it says in the text there.

  • Rebel Alliance Global Moderator


    Not sure what people are going to do when their devices are changing IPv6 addresses deliberately and constantly.

    Yeah most ipv6 devices do that now for outgoing connections.. That is the temp IPv6 addresses..

    My advice - which some people don't agree with.  But hey until your fully up to speed on all the things ipv6 brings to the table - it is way more than just a longer IP address ;)  I don't see it as a good thing to have enabled from a security standpoint or just plain reliability standpoint.

    Security 101 tells us if your not using a protocol then that protocol should not be on.  So if you don't know how to proper use and security ipv6 then you really should not have it enabled.. While yes it is the future, and its here to stay.  There is currently NO services that are only available via ipv6 that anyone would actually need.

    While I do run ipv6 in my network, It is very limited - I run a tunnel, so my isp can not change my prefix on a whim.  And my machines are either static ipv6 or they get a specific ipv6 address via dhcpv6.  I have temp addresses off, etc.  And to be honest for my machine I have it off unless I am specifically playing with something ipv6 based.