Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Restricting internet access by IP and time range

    Firewalling
    5
    43
    9131
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • _
      _ToXIc_ last edited by

      hey all i can only find options to totally block internet or using schedules but you have to choose a month.

      how can i just create the restriction by day of week and time?

      i've attached what i had setup on the router i'm replacing

      thanks in advance.

      ![access rules old 2.jpg](/public/imported_attachments/1/access rules old 2.jpg)
      ![access rules old 2.jpg_thumb](/public/imported_attachments/1/access rules old 2.jpg_thumb)

      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        Click on the day column and it will highlight all of those days for every week & month.  You also want to be aware that you must block via firewall rule and then set schedule to allow, instead of the other way around.

        1 Reply Last reply Reply Quote 0
        • _
          _ToXIc_ last edited by

          @KOM:

          Click on the day column and it will highlight all of those days for every week & month.  You also want to be aware that you must block via firewall rule and then set schedule to allow, instead of the other way around.

          i'll try that thanks..

          1 Reply Last reply Reply Quote 0
          • _
            _ToXIc_ last edited by

            what you think of this method?

            https://www.youtube.com/watch?v=0lBxhHbKScM

            1 Reply Last reply Reply Quote 0
            • KOM
              KOM last edited by

              Sorry, I don't have the time to watch a 15 minute YouTube video on this.  What was the gist of it?

              1 Reply Last reply Reply Quote 0
              • _
                _ToXIc_ last edited by

                @KOM:

                Sorry, I don't have the time to watch a 15 minute YouTube video on this.  What was the gist of it?

                he created schedules the created rules for each to block then reject. i tried it but i didnt work

                then tried to do a total block the the allow with the schedule and couldn't get that to work either

                1 Reply Last reply Reply Quote 0
                • KOM
                  KOM last edited by

                  The way I've done it in the past (going from memory here) was to create a schedule for the time period where you want to allow access.  Then you create a LAN blocking rule for the IP addresses that you want to have no Internet access by default, and link that schedule into the block rule under Advanced features - Schedule.

                  1 Reply Last reply Reply Quote 0
                  • 2
                    2chemlud Banned last edited by

                    As a starter:

                    https://forum.pfsense.org/index.php?topic=77168.msg440274;topicseen#msg440274

                    https://forum.pfsense.org/index.php?topic=90368.msg500528;topicseen#msg500528

                    https://forum.pfsense.org/index.php?topic=72648.msg396340;topicseen#msg396340

                    Groundhog day! :-)

                    1 Reply Last reply Reply Quote 0
                    • _
                      _ToXIc_ last edited by

                      @KOM:

                      The way I've done it in the past (going from memory here) was to create a schedule for the time period where you want to allow access.  Then you create a LAN blocking rule for the IP addresses that you want to have no Internet access by default, and link that schedule into the block rule under Advanced features - Schedule.

                      cant see to get the LAN blocking rule to work. this is what i have set but its still connecting to the internet


                      1 Reply Last reply Reply Quote 0
                      • KOM
                        KOM last edited by

                        Did you reset the states when you tested?  Existing states won't be blocked.  What's up with the funny Source?  Can you show a screen shot of your block rule?  I notice you don't have the schedule linked in.

                        1 Reply Last reply Reply Quote 0
                        • _
                          _ToXIc_ last edited by

                          sorry what do you mean "reset the states" and whats so funny about the source? its the IP of the phone i'm testing the block on.

                          didnt put the schedule in yet, was testing every step as i implement


                          1 Reply Last reply Reply Quote 0
                          • KOM
                            KOM last edited by

                            sorry what do you mean "reset the states"

                            Diagnostics - States - Reset States

                            whats so funny about the source?

                            Looks like you're trying to block an entire network as opposed to a single host.

                            1 Reply Last reply Reply Quote 0
                            • _
                              _ToXIc_ last edited by

                              @KOM:

                              sorry what do you mean "reset the states"

                              Diagnostics - States - Reset States

                              thanks

                              whats so funny about the source?

                              Looks like you're trying to block an entire network as opposed to a single host.

                              ah.. that explains a bunch.. gotta look up blocking

                              1 Reply Last reply Reply Quote 0
                              • KOM
                                KOM last edited by

                                Please post a screenshot of your block rule as I requested previously.

                                1 Reply Last reply Reply Quote 0
                                • _
                                  _ToXIc_ last edited by

                                  @KOM:

                                  Please post a screenshot of your block rule as I requested previously.

                                  i posted the block rule in reply#10  been reading and reading trying this and that but i can get the basic block to work.

                                  1 Reply Last reply Reply Quote 0
                                  • Derelict
                                    Derelict LAYER 8 Netgate last edited by

                                    The rule you have in #10 should block all traffic from 192.168.1.0/24 into the LAN interface (and out to the internet).

                                    If it is not doing so, then LAN net is not 192.168.1.0/24

                                    Post Status > Interfaces

                                    At least the LAN interface.

                                    Chattanooga, Tennessee, USA
                                    The pfSense Book is free of charge!
                                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • _
                                      _ToXIc_ last edited by

                                      so i should put the IP i'm trying to block in the Destination field instead of Source? i tried that also and reset the states but my test device was still getting to the internet

                                      1 Reply Last reply Reply Quote 0
                                      • KOM
                                        KOM last edited by

                                        i posted the block rule in reply#10

                                        Sorry, don't know how I missed that  :P

                                        so i should put the IP i'm trying to block in the Destination field instead of Source?

                                        No, you want to use the client IP you're testing with as the Source.  Please post your interface details as Derelict requested.  Once we see what we're working with, it will take away a lot of the guesswork.

                                        1 Reply Last reply Reply Quote 0
                                        • _
                                          _ToXIc_ last edited by

                                          @KOM:

                                          No, you want to use the client IP you're testing with as the Source.  Please post your interface details as Derelict requested.  Once we see what we're working with, it will take away a lot of the guesswork.

                                          but isnt that how its setup in the rule?

                                          attached are the interfaces


                                          1 Reply Last reply Reply Quote 0
                                          • KOM
                                            KOM last edited by

                                            OK, at least now we know your LAN really is 192.168.1.0/24.  I assume your test client is 192.168.1.112?  Edit your block rule to make the Source a Single host or alias, save it, clear the states and try again.

                                            1 Reply Last reply Reply Quote 0
                                            • _
                                              _ToXIc_ last edited by

                                              i used "Network" instead of "Single host or alias" because network gave me an option to change the subnet with "Single host or alias" its greyed out and wouldnt let me change it.

                                              trying now..

                                              edit: attached the new rule




                                              1 Reply Last reply Reply Quote 0
                                              • _
                                                _ToXIc_ last edited by

                                                still had internet after restarting the states… so i rebooted the firebox and the test device (iPhone) but still had internet.

                                                1 Reply Last reply Reply Quote 0
                                                • Derelict
                                                  Derelict LAYER 8 Netgate last edited by

                                                  No %&&^&^ idea what you've done.

                                                  Reset to factory and start over. Start simple. One thing at a time. Test. Move on.

                                                  Chattanooga, Tennessee, USA
                                                  The pfSense Book is free of charge!
                                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                  1 Reply Last reply Reply Quote 0
                                                  • KOM
                                                    KOM last edited by

                                                    Verify that your test client is really at 192.168.1.112?  Your LAN rule should block all traffic from that IP address.

                                                    1 Reply Last reply Reply Quote 0
                                                    • _
                                                      _ToXIc_ last edited by

                                                      its crazy.. so after testing last night i disabled the rule and played some xbox live..

                                                      then sometime this morning around 5am or so all internet was blocked..
                                                      so I deleted the rule rebooted and everything came back.

                                                      1 Reply Last reply Reply Quote 0
                                                      • _
                                                        _ToXIc_ last edited by

                                                        @Derelict:

                                                        No %&&^&^ idea what you've done.

                                                        Reset to factory and start over. Start simple. One thing at a time. Test. Move on.

                                                        '
                                                        this is my 3rd time starting over i've been implementing slowly and testing as i go.

                                                        @KOM:

                                                        Verify that your test client is really at 192.168.1.112?  Your LAN rule should block all traffic from that IP address.

                                                        it is.. its not static tho but its the IP currently leased..

                                                        1 Reply Last reply Reply Quote 0
                                                        • KOM
                                                          KOM last edited by

                                                          OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all.  Are you sure it isn't flipping to cellular?

                                                          1 Reply Last reply Reply Quote 0
                                                          • _
                                                            _ToXIc_ last edited by

                                                            @KOM:

                                                            OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all.  Are you sure it isn't flipping to cellular?

                                                            no i have the wifi assist is turned off.. and this morning i was getting time outs on everything

                                                            1 Reply Last reply Reply Quote 0
                                                            • KOM
                                                              KOM last edited by

                                                              I don't know what else to tell you.  This normally just works.  Being able to allow/block traffic is the basis for any firewall, and pfSense wouldn't be much good if it couldn't do at least that much.

                                                              1 Reply Last reply Reply Quote 0
                                                              • _
                                                                _ToXIc_ last edited by

                                                                right i'm baffled..

                                                                edit: unless this is related
                                                                https://forum.pfsense.org/index.php?topic=73012.0

                                                                1 Reply Last reply Reply Quote 0
                                                                • _
                                                                  _ToXIc_ last edited by

                                                                  thx for the assists over there KOM.. i'll try the block this evening to see it that outbound rule was messing with it..

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • _
                                                                    _ToXIc_ last edited by

                                                                    dang.. no change setting a single block rule like the screen shot i posted previously breaks the internet for everyone..

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • KOM
                                                                      KOM last edited by

                                                                      I'm not sure how blocking a single host would interfere with everyone…

                                                                      Can you post updated shots of your LAN firewall rules?  Hopefully you just disabled the problem rule instead of deleting it.

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • _
                                                                        _ToXIc_ last edited by

                                                                        i deleted it but its the same as whats posted in #20

                                                                        here my lan and wan rules

                                                                        the only other firewall changes that have been made is whats in the post#29 to get my xbox NAT to open




                                                                        1 Reply Last reply Reply Quote 0
                                                                        • Derelict
                                                                          Derelict LAYER 8 Netgate last edited by

                                                                          It's blocking everyone because you're using a /24, dude.  It's single host or /32

                                                                          Chattanooga, Tennessee, USA
                                                                          The pfSense Book is free of charge!
                                                                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • _
                                                                            _ToXIc_ last edited by

                                                                            sorry forgot about that, did the single hosts reboots and it kinda works.. cant dont anything on the phone but Facebook works lol

                                                                            no web and mostly the other apps i tried but facebook works

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • Derelict
                                                                              Derelict LAYER 8 Netgate last edited by

                                                                              Like I said, reboot to factory and start over.  No idea what you have where.

                                                                              Look at your firewall rules on LAN and see what rule is blocking what.

                                                                              Chattanooga, Tennessee, USA
                                                                              The pfSense Book is free of charge!
                                                                              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • kesawi
                                                                                kesawi last edited by

                                                                                If you have the transparent proxy enabled in pfsense then you may also need to add a custom ACL to the proxy settings to limit access during specific times if you're still finding you have web access.

                                                                                Below is a rule I use for my kid's devices at night while allowing their devices to still download updates:

                                                                                ##  day-abbrevs:
                                                                                #	S - Sunday
                                                                                #	M - Monday
                                                                                #	T - Tuesday
                                                                                #	W - Wednesday
                                                                                #	H - Thursday
                                                                                #	F - Friday
                                                                                #	A - Saturday
                                                                                
                                                                                ###Domains used for downloading google and itunes updates
                                                                                ##YouTube domain used for other account login
                                                                                acl gLogin dstdomain accounts.youtube.com
                                                                                ##Google Playstoe
                                                                                acl gStore dstdomain .gvt1.com .googleusercontent.com .ggpht.com .google.com .gstatic.com .android.com .googleapis.com
                                                                                ##iTunes Store
                                                                                acl iTunes dstdomain .apple.com .apple.com.edgesuite.net mzstatic.com
                                                                                
                                                                                ## Deny access from kids devices late at night
                                                                                acl KidsDevices src 192.168.1.40/29 192.168.1.48/31
                                                                                acl night time 22:00-24:00
                                                                                acl morning time 00:00-6:00
                                                                                http_access deny KidsDevices night !gStore !iTunes !gLogin
                                                                                http_access deny KidsDevices morning !gStore !iTunes !gLogin
                                                                                
                                                                                ##Deny access from kids devices after 8:45pm on school nights
                                                                                acl school_night time SMTWH 20:45-22:00
                                                                                http_access deny KidsDevices school_night !gStore !iTunes !gLogin 
                                                                                
                                                                                
                                                                                1 Reply Last reply Reply Quote 0
                                                                                • _
                                                                                  _ToXIc_ last edited by

                                                                                  WOW so now i'm really clueless.. instead of resetting and doing a factory reset. took out the CF card and wrote a fresh copy of 2.2.6-RELEASE (i386) onto it.

                                                                                  went trough the initial wizard and and then tested the block rule then reset stats and ever rebooted and same thing.. the test device which is my phone was still able to connect to the internet.

                                                                                  it makes no sense. if it wasnt for the performance bandwidth wise i getting out of this i would of chucked it by now..

                                                                                  why is blocking so hard?


                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • kesawi
                                                                                    kesawi last edited by

                                                                                    Is your phone getting the same IP address each time it connects to your WiFi? Have you turned off mobile data on your phone when performing the test (if your phone gets blocked on your WiFi network it may be switching to the mobile network)?

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post