1

My DSL-WiFI router provides MAC address filtering. This is used for access restrictions, e.g for parental controls to keep certain devices off-line during certain hours. A device on the restriction list remains associated with the WiFi AP (router), but access to the internet is prevented by the router.

HOWEVER, when a device on my WLAN uses VPN, the traffic simply seems to tunnel straight through the restrictions. In other words, during restricted hours, a device ordinarily has no access to the internet, but when the VPN is switched on, access is provided.

I understand MAC address filtering, and how a WiFi router uses the MAC address to address 802.11 devices and route traffic in the WLAN/subnet. The MAC address is part of the packet header. The IP traffic, incl. VPN application data, resides within that packet. So how can this even fail?

Any thoughts on what might be going on here? Is the VPN possibly robbing a MAC address and overriding the one on the device? (It's an iPhone and my understanding is that the MAC address cannot be changed -by the user or an app-, although it can change randomly with MAC address randomization)

UPDATE: after some experimentation I can confirm that the MAC address does not change with VPN on/off, contrary to what I was thinking. What DOES change is the LAN Status IPv6 entries. They disappear with VPN "on". I posted it as a separate question: When using VPN, why do LAN IPv6 Addresses disappear in router LAN status?

Improve this question
9
  • Perhaps because the MAC filter is on the WiFi part and not the LAN?
    – schroeder ♦
    Mar 12, 2020 at 19:45
  • The WiFi is part of the LAN. There are no wired ethernet devices connected.
    – P2000
    Mar 12, 2020 at 19:50
  • That's not how you made it sound: "when a device on my LAN uses VPN" - you mean "when a device on my WiFi uses VPN"? WiFi is not LAN
    – schroeder ♦
    Mar 12, 2020 at 20:01
  • How is the VPN set up?
    – schroeder ♦
    Mar 12, 2020 at 20:04
  • 1
    @schroeder, IEEE 802.11 is part of the IEEE 802 set of LAN protocols. As for the VPN, I don't know, it's not my device. I'd have to find out. Why do you ask? What should I look for? Cydia?
    – P2000
    Mar 12, 2020 at 20:38

2 Answers 2

Reset to default
1

The WiFi parental controls might be focused on certain protocol traffic (e.g. HTTP) and not other protocol traffic, like VPN. Meaning that the controls are not on the hardware level, but the traffic level (i.e. "this device accessing the web at this time").

The router manual might have clues as to how the filtering works.

Improve this answer
6
  • Yes, good point, but a severe shortcoming of the router. I a beginning to think it's MAC address robbing (see my other comment under the reply by Anonymous), where the VPN picks an existing MAC address, asks the user to reboot to configure with the new MAC address, and uses its own WiFi AES credentials to access the WiFi and circumvent the filter.
    – P2000
    Mar 12, 2020 at 20:53
  • "robbing"? I think you mean "spoofing". The VPN would not take a MAC in use: it would cause instability.
    – schroeder ♦
    Mar 12, 2020 at 20:55
  • If the VPN is forcing a new MAC, that would be easy to detect on the router logs, but I highly doubt that's what it is doing
    – schroeder ♦
    Mar 12, 2020 at 20:57
  • Yes, rob then spoof: i.e. pretending to be a different MAC but only after determining which MAC addresses are getting traffic during restricted hours. And yes, instability is a side effect. Until I know whether the VPN is tame or rogue, I won't know whether the VPN is at all concerned about instability or it's doing all it can to just get though.
    – P2000
    Mar 12, 2020 at 21:05
  • 1
    "rob" would mean that the original device doesn't have it anymore, so it's not an accurate term. "instability is a side effect" is an understatement. If a VPN tried this, there is a high chance that it could never establish connection. So, no, I don't think this is likely.
    – schroeder ♦
    Mar 12, 2020 at 21:09
0

The MAC address can be spoofed quite easily. A live distribution like Tails will even spoof it by default. So MAC address filtering is not considered an effective security measure in itself, but may be good enough for your purpose.

Also, in the case of wifi clients, the radio traffic can be sniffed passively over the air using tools like airodump, and it's possible to observe the MAC addresses connecting to the access point.

The behavior is quite OS- and device-dependent. Nowadays you see devices doing randomization for privacy reasons (a static MAC address is a potent tracking tool). Some devices use a random MAC address when scanning wifi channels, and then may use another random address when the connection is established, or the real MAC address.

Why not go to the router interface, or on the client and see for yourself what the current MAC address is after launching VPN ? Either the MAC address has changed or it hasn't.

I am speculating a bit, but maybe the VPN configuration is causing a restart or reload of some network service components, and the change of MAC address may be a feature or some unintended consequence.

Also, not knowing your router type, perhaps the filtering is enforced on wifi connections but not on ethernet cable connections.

Improve this answer
2
  • "The MAC address can be spoofed quite easily." on a non-rooted iphone? Yes I am aware of sniffing, which is how robbing happens. You mention airodump , I use Fing. There are no wired ethernet devices. I am going through the logs to see what device connects when. I have a suspicion the MAC address is robbed then spoofed, because I see paired "connect" entries, one for the device in question, and one for another device. The second one could be robbed.
    – P2000
    Mar 12, 2020 at 19:56
  • I updated the question with an interesting finding. Thanks for the discussion so far!
    – P2000
    Mar 13, 2020 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .