Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Restricting internet access by IP and time range

    Scheduled Pinned Locked Moved Firewalling
    43 Posts 5 Posters 14.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • _
      _ToXIc_
      last edited by

      hey all i can only find options to totally block internet or using schedules but you have to choose a month.

      how can i just create the restriction by day of week and time?

      i've attached what i had setup on the router i'm replacing

      thanks in advance.

      ![access rules old 2.jpg](/public/imported_attachments/1/access rules old 2.jpg)
      ![access rules old 2.jpg_thumb](/public/imported_attachments/1/access rules old 2.jpg_thumb)

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        Click on the day column and it will highlight all of those days for every week & month.  You also want to be aware that you must block via firewall rule and then set schedule to allow, instead of the other way around.

        1 Reply Last reply Reply Quote 0
        • _
          _ToXIc_
          last edited by

          @KOM:

          Click on the day column and it will highlight all of those days for every week & month.  You also want to be aware that you must block via firewall rule and then set schedule to allow, instead of the other way around.

          i'll try that thanks..

          1 Reply Last reply Reply Quote 0
          • _
            _ToXIc_
            last edited by

            what you think of this method?

            https://www.youtube.com/watch?v=0lBxhHbKScM

            1 Reply Last reply Reply Quote 0
            • KOMK
              KOM
              last edited by

              Sorry, I don't have the time to watch a 15 minute YouTube video on this.  What was the gist of it?

              1 Reply Last reply Reply Quote 0
              • _
                _ToXIc_
                last edited by

                @KOM:

                Sorry, I don't have the time to watch a 15 minute YouTube video on this.  What was the gist of it?

                he created schedules the created rules for each to block then reject. i tried it but i didnt work

                then tried to do a total block the the allow with the schedule and couldn't get that to work either

                1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM
                  last edited by

                  The way I've done it in the past (going from memory here) was to create a schedule for the time period where you want to allow access.  Then you create a LAN blocking rule for the IP addresses that you want to have no Internet access by default, and link that schedule into the block rule under Advanced features - Schedule.

                  1 Reply Last reply Reply Quote 0
                  • 2
                    2chemlud Banned
                    last edited by

                    As a starter:

                    https://forum.pfsense.org/index.php?topic=77168.msg440274;topicseen#msg440274

                    https://forum.pfsense.org/index.php?topic=90368.msg500528;topicseen#msg500528

                    https://forum.pfsense.org/index.php?topic=72648.msg396340;topicseen#msg396340

                    Groundhog day! :-)

                    1 Reply Last reply Reply Quote 0
                    • _
                      _ToXIc_
                      last edited by

                      @KOM:

                      The way I've done it in the past (going from memory here) was to create a schedule for the time period where you want to allow access.  Then you create a LAN blocking rule for the IP addresses that you want to have no Internet access by default, and link that schedule into the block rule under Advanced features - Schedule.

                      cant see to get the LAN blocking rule to work. this is what i have set but its still connecting to the internet

                      Capture.JPG
                      Capture.JPG_thumb

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        Did you reset the states when you tested?  Existing states won't be blocked.  What's up with the funny Source?  Can you show a screen shot of your block rule?  I notice you don't have the schedule linked in.

                        1 Reply Last reply Reply Quote 0
                        • _
                          _ToXIc_
                          last edited by

                          sorry what do you mean "reset the states" and whats so funny about the source? its the IP of the phone i'm testing the block on.

                          didnt put the schedule in yet, was testing every step as i implement

                          Capture.JPG
                          Capture.JPG_thumb

                          1 Reply Last reply Reply Quote 0
                          • KOMK
                            KOM
                            last edited by

                            sorry what do you mean "reset the states"

                            Diagnostics - States - Reset States

                            whats so funny about the source?

                            Looks like you're trying to block an entire network as opposed to a single host.

                            1 Reply Last reply Reply Quote 0
                            • _
                              _ToXIc_
                              last edited by

                              @KOM:

                              sorry what do you mean "reset the states"

                              Diagnostics - States - Reset States

                              thanks

                              whats so funny about the source?

                              Looks like you're trying to block an entire network as opposed to a single host.

                              ah.. that explains a bunch.. gotta look up blocking

                              1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM
                                last edited by

                                Please post a screenshot of your block rule as I requested previously.

                                1 Reply Last reply Reply Quote 0
                                • _
                                  _ToXIc_
                                  last edited by

                                  @KOM:

                                  Please post a screenshot of your block rule as I requested previously.

                                  i posted the block rule in reply#10  been reading and reading trying this and that but i can get the basic block to work.

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    The rule you have in #10 should block all traffic from 192.168.1.0/24 into the LAN interface (and out to the internet).

                                    If it is not doing so, then LAN net is not 192.168.1.0/24

                                    Post Status > Interfaces

                                    At least the LAN interface.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • _
                                      _ToXIc_
                                      last edited by

                                      so i should put the IP i'm trying to block in the Destination field instead of Source? i tried that also and reset the states but my test device was still getting to the internet

                                      1 Reply Last reply Reply Quote 0
                                      • KOMK
                                        KOM
                                        last edited by

                                        i posted the block rule in reply#10

                                        Sorry, don't know how I missed that  :P

                                        so i should put the IP i'm trying to block in the Destination field instead of Source?

                                        No, you want to use the client IP you're testing with as the Source.  Please post your interface details as Derelict requested.  Once we see what we're working with, it will take away a lot of the guesswork.

                                        1 Reply Last reply Reply Quote 0
                                        • _
                                          _ToXIc_
                                          last edited by

                                          @KOM:

                                          No, you want to use the client IP you're testing with as the Source.  Please post your interface details as Derelict requested.  Once we see what we're working with, it will take away a lot of the guesswork.

                                          but isnt that how its setup in the rule?

                                          attached are the interfaces

                                          Capture.JPG
                                          Capture.JPG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • KOMK
                                            KOM
                                            last edited by

                                            OK, at least now we know your LAN really is 192.168.1.0/24.  I assume your test client is 192.168.1.112?  Edit your block rule to make the Source a Single host or alias, save it, clear the states and try again.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.