Block internet by IP and tme ver 2.3

_ToXIc_

hey group i just came back to pfsense created a VM with two passthrough nics. Everything is working great, but now i have to create restrictions for the kids.

i need to restrict their portable devices for bedtime and also the xbox. can someone point me in a direction/article on how to complete this?

_ToXIc_

I've been Searching around and found this isn't a popular topic. Also found some older ways to do this but was wondering if there are some easier ways since 2.3

johnpoz

What do you mean popular - there is prob not a lot of topics on it because its so easy..

Setup your devices to get a specific IP via dhcp reservation. Now setup rule for access to these IP(s) on schedule.

https://doc.pfsense.org/index.php/Firewall_Rule_Schedules

_ToXIc_

thanks i already have the clients setup static, i'll look over the link and implement.

_ToXIc_

not sure if i did this correctly but it didnt work.. i also reset the states and nothing

Capture.JPG_thumb

Capture2_0.JPG_thumb

Capture2_1.JPG_thumb

Capture2_2.JPG_thumb

Capture2_3.JPG_thumb

Capture3.JPG_thumb

Derelict

Make rules that pass traffic according to the schedule you want traffic passed followed by a block rule for the same traffic without a schedule on it.

_ToXIc_

ok so i'm trying to just do the block part and i can even get that working..

the device can still get to the internet even with the state type to none and resetting states.

Capture4.JPG_thumb

ptt

Your rules order is wrong ;)

https://doc.pfsense.org/index.php/Firewall_Rule_Basics

https://doc.pfsense.org/index.php/Firewall_Rule_Processing_Order

https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

Rules_Order.png_thumb

_ToXIc_

thanks. ppt..

i moved it up reset states and now it works kinda.. if i go to a site i havent been before it will time out. but some apps and web still work for eg google.com still works and i can search and click on the link but the link may or may not open..

i do have squid so i dont know if somehow the caching is affecting the block

Derelict

Why do you have squid?

_ToXIc_

i was reading about popular addons and was testing out its caching abilities to speed up browsing.

edit: on the main LAN rule to allow should i change the state type to none?

Derelict

no

Unless you REALLY need caching, squid generally does more harm than good.

_ToXIc_

i just dont understand why the firewall isnt firewalling.. my old linksys RV042 was soo easy to block and by time but its 10/100 ports are throttling me.

![access rules old.JPG](/public/imported_attachments/1/access rules old.JPG)
![access rules old.JPG_thumb](/public/imported_attachments/1/access rules old.JPG_thumb)

Derelict

So you post an RV042 screen? That'll help.

_ToXIc_

sorry i was just hoping for a similarly easy way to block

is there anything else i can post to make it easier to troubleshoot?

KOM

You may be seeing cached content from either squid or your browser. Do what Derelict said. Create a schedule time that access is allowed. Create a LAN rule to allow access for the required IP address with your schedule. Immediately below that rule, create a block rule for the same IP address but no schedule. Clear states and test.

_ToXIc_

i'm using my iPhone to test wanted to take it one step at a time to was just testing the block, but that wasnt working..

i removed SquidGuard then Squid and rebooted..

then tried the block.. and same results.. some sites are blocked and some still allowed..

then i made a rule for the pc i'm on see screenshot then reset states and about the same thing.. some sites work i can relaod get new items like on facebook but anything new it wont load.

edit: i even posted that^^ and this while the pc block was in effect and it worked.. :/

Capture5.JPG_thumb

johnpoz

I am not sure what what is so hard understand here..

Create a rule that allows your traffic for the schedule you want.. Then below that create a block for that IP.. Its really that simple!!

You are trying to block on a schedule.. But not blocking ipv6.. You have a any rule for IPv6.. You do understand browser caches right?

_ToXIc_

i understand, but like i said before i'm just trying to take the process one step at a time and i'm just testing the total block part.. and after getting that working i'll do the allow.
it wasnt the cache on the browser, i was getting new posts about walking dead for eg from facebook and also pulling other feeds and instagram from the mobile tester and also email notifications about posts on this thread.

and you've mentioned IPV6 could that be it? i'm gonna disable IPV6 internally, i'll report back.

johnpoz

I don't know could it ;) You have a any any rule for it..

The proper use of the schedules is for allow time.. So create a rule that allows the traffic to your schedule, then after that rule there should be a specific deny if that allow rule on your schedule is not the last rule.