0

Motivation: I want to be able to create different outbound traffic rules for different devices on my network e.g. my laptop can create VPN tunnels, whereas my kids' laptops can only connect DNS/HTTP/HTTPS, and they are locked to a specific DNS server. I can create different firewall rules on my router for different IP address blocks, but don't want this to be easily subverted by devices being able to select their own IP address in the "allow" range.

So this question is about whether it is typically possible and practical to prevent a device on a home wifi network from selecting its own IP address (from within the network range), using commonly-installed home wifi/internet routers. In other words, can you prevent devices from assuming any static IP address in the WLAN's normal range.

Assume that I already have and know:

  • wifi router configuration for DHCP pool ranges
  • wifi router configuration for DHCP static IP addresses
  • wifi router MAC-address filtering etc.

I can add a static-lease for the device based on its MAC address, and when the device is configured for DHCP it assumes this address. But assume that I don't have 100% control of the device's networking settings, that some other user can change those - for example they could switch from DHCP to static and configure an IP address of their choosing.

My observation is that whatever static IP address is chosen works and the router will route packets for that client (it has wifi-level access e.g. WPA2 credentials of course), regardless of whether the IP-address chosen is within the router's DHCP range or some reserved range.

My conclusion is that you cannot create firewall rules which prevent outbound traffic for certain clients based on an IP-address range, since clients are free to grab a free static IP address within that range. This seems to happen irrespective of whether a DHCP reservation exists for that client's MAC address, which makes sense because DHCP is inactive for the client at that point.

It seems to me that either multiple routers or multiple VLANs are the only way this can be achieved?

Example: I want to prevent an allowed but only partially-trusted device on my WLAN with MAC 12:34:56:78:9a:bc from routing packets with source in the CIDR range 10.1.1.0/25, which is reserved and outside my DHCP range.

2
  • 2
    The challenge is you're trying to do it with home gear. What you want is literally a single setting on a Cisco Wireless LAN Controller. In fact, they even have a feature (IP Helper) that rewrites a packets from client using an unassigned IP address into one that is authorized.
    – user71659
    Nov 6, 2018 at 8:17
  • @user71659 I agree that this is beyond the capabilities of home gear - that was what I suspected, but wondered if I'd missed some common tricks or approaches. I've highlighted the home-equipment mention in the question now too.
    – javabrett
    Nov 6, 2018 at 10:35

1 Answer 1

1

There is no way to force IP addresses on clients in an Ethernet network as such, as they can simply opt not to use DHCP at all. Clients can pick and use any valid IP address. Furthermore, static leases by MAC address will not guarantee an IP assignment even if DHCP is used as MAC address not static and can be chosen arbitrarily (equal to MAC filtering in the first place). More intelligent firewalls will usually force the source address of packets to belong to the interface subnet. You could also really make a firewall rule to at least enforce that only some range of IP addresses are routed.

Embedded router devices are spectacularly non-versatile and preventing some devices form accessing the internet is not a particularly common usage case. Forcing IP addresses to devices is kind of an XY fallacy for the problem. This task is definitely impossible, but your objective is fairly straightforward.

For example, you could use another NAT router for the restricted devices and give it a static LAN IP address on the WAN interface. Then make rules preventing that LAN address on WAN interface from reaching the internet on the main router. This works because the devices behind the internal router have their addresses translated to the single WAN address which they can not change. They would still be able to access the main LAN addresses through the default route of the internal router. To communicate back to them you would need to add port forwards. Another possibility would be to use 1-to-1 NAT with a pool of addresses.

As stated, using a VLAN per SSID capable AP would at least allow a router running a full version of Linux to trivially segregate the traffic between VLAN segments (I recommend Ubuntu w/ Shorewall). Some "open source" firmware images for home routers supposedly can do VLAN/SSID and firewall rules based on VLAN tag, but they tend to be horrible and I strongly do not suggest them.

Perhaps a sincere analysis of the threat model would be helpful as well. Why is it important that these devices can not reach the internet. How strident will attempts to circumvent these controls be? Is a MAC whitelist not good enough? You say the devices are partially trusted... are you sure you trust them to have unprotected access to your trusted machines anyways?

3
  • The first paragraph isn't correct. Enterprise level Ethernet switches and Wi-Fi systems have a feature that snoops DHCP assignments and then limits the client to the assigned IP, dropping everything else. For example, this is called Cisco IP Source Guard and is available on Wi-Fi as well. Now doing this with home-level gear, I don't know.
    – user71659
    Nov 6, 2018 at 8:06
  • Good advice here and answer accepted. I have a solution now in-line with this advice - my router has additional Guest SSIDs which are automatically on their own VLAN, which is perfect. I added a motivation block to the question also - it's not that the devices should be blocked from the internet, but that they shouldn't be able to do specific things, such as create VPN tunnels etc.
    – javabrett
    Nov 6, 2018 at 10:37
  • 1
    @javabrett I think that the guest mode of a consumer router is basically what you are looking for. Depending on how sophisticated of traffic rules/inspection you want to apply to children traffic, using a more expensive firewall product might actually be really helpful. Something like a Cisco Meraki Z3 (home office gateway) might be more accessible than you think and definitely provides a lot better access control than a plain IP firewall. Nov 6, 2018 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .