Topic: Block local IP or MAC outbound access

[BossHog]

Howdy,
apologies for such a simple question.
Trying to block a few Chinese security cameras and 2 LG tvs from having access outbound to the WAN via my SME Server.
It may have been a contrib I have used in the past where this could be config'ed through a SM Panel.
I am okay with doing blocks via IP or MAC from the commandline but could use a little coaching to find a safe customization.
Yes, all of the devices need internal access(LAN) as we use NAS for media and a Zoneminder servers for IP cams.
Thanks in advance,
Joe

[Jean-Philippe Pialasse]

Code: [Select]

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
vim /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40Denywebcam
then add something like that

Code: [Select]

/sbin/iptables -t filter -I FORWARD -m mac --mac-source B0:C5:54:42:F2:0A -j DROP

by blocking the forward you will still be bale to have access to them from the lan, but should block all access to it from outside and won't be able to download anything.
if you need to  have acces from other subnet or vpn, then you need also to add the wan interface in the chain

Code: [Select]

/sbin/iptables -t filter -I FORWARD -m mac --mac-source B0:C5:54:42:F2:0A -o  {$OUTERNET||"eth0"} -j DROP

of course change to your mac

[BossHog]

Thanks JP !

Joe

[philippe971]

Bonjour
J'ai adapté un template venant du site de smeserver.fr https://web.archive.org/web/20220705033145/https://smeserver.fr/astuces.php?astuce=net_masq_block pour bloquer les adresses MAC en utilisant une liste dans un fichier

Code: [Select]

mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
nano /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40Denywebcam


Code: [Select]

# Static drop MAC start (Internet only)
{
        open (F_DROP, "</etc/masq_DenyListMAC") || warn "Impossible d'ouvrir le fichier /etc/masq_DenyListMAC: $!\n";
        while ($line = <F_DROP>) {
                chomp($line);
                $line =~ s/#.*//;          # ignore les commentaires
                $line =~ s/^\s+|\s+$//g;   # trim espaces
                if ($line ne "") {
                        if ($line =~ /^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$/) {
                                $OUT .= "    /sbin/iptables -I FORWARD -m mac --mac-source $line -j DROP\n";
                        } else {
                                warn "Adresse MAC invalide ignorée : $line\n";
                        }
                }
        }
        close(F_DROP);
}
# Static drop MAC end



Code: [Select]

nano /etc/masq_DenyListMAC
Dans le fichier, on met la liste des adresses MAC

Code: [Select]

# Caméras
B0:C5:54:42:F2:0A
B0:C5:54:42:F2:0B #Camera garage
B0:C5:54:42:F2:0C
etc

Code: [Select]

expand-template /etc/rc.d/init.d/masq
service masq restart
signal-event remoteaccess-update
Pour vérifier

Code: [Select]

iptables -L FORWARD -n -v --line-numbers | head -20

Code: [Select]

watch -n 1 'iptables -L FORWARD -n -v --line-numbers | head -10'
Fonctionne avec sme10, je n'ai pas encore essayé avec sme11
Désolé de ne pas répondre en anglais, mais si quelqu'un veut traduire ma réponse en anglais ou améliorer, corriger cette template, je suis preneur ou peut-être en faire un panel du serveur-manager

Cordialement
Philippe