How can I configure my router to prevent connections bypassing it?

Question

I am trying to configure my router to control access for several of my devices at home.

I am currently using a linksys router.

Our home consists of three devices (a desktop, a laptop, and a tablet).

The router is currently configured so that the internet connection is disabled at a certain time every day (this applies to all three devices).

But there is a way to get around this if a device connects to an unsecure network close-by.

My question is: Is there a way I can configure my router so that ALL devices lose connection, and are not able to steal internet access from unsecured nearby networks?

Answer 1

My guesses as to your intentions, based on the general nature of the request, are either turning off wireless access while you're at work, and so nobody's supposed to be home and using those devices, or restricting kids' wireless use on gaming consoles/tablets/smartphones during homework time and after bedtime. I will assume, for this answer, the latter situation, because it's the more feasible from my perspective (if someone's in your house using your devices without your permission while you're not there, I posit you may have much bigger security problems).

There's nothing you can do with your router to prevent your kids getting access to someone else's. Not legally, anyway; the best you could do is to jam the channels used by nearby routers, but not only is that a violation of FCC regs, but the routers you're trying to jam will see that jamming noise as interference and switch to an open channel. So unless you're using your equipment to emit a broad-spectrum noise across the entire 2.4GHz band, which is extremely illegal despite the "open" nature of this spectrum, your router can't help you keep your kids off your neighbors' routers.

However, your neighbors can help you keep your kids out of their WLANs. Simply go around to all your neighbors with Wi-Fi hotspots that are visible from inside your house (your own cell phone is your best tool for seeing which house has what network), and ask if they can help you out by securing their WLANs. They should be happy to help; very few homeowners want someone they don't know about piggybacking on their Internet connection, draining bandwidth and possibly doing things that could come back to haunt them. WPA2-PSK wireless authentication/encryption, WPS disabled if available on the WAP, SSID broadcasting turned off, and MAC whitelisting of approved devices (or at least blacklisting of your kids' devices; this will require more maintenance on everyone's part as your kids get new or replacement devices) will provide a decent level of frustration for unauthorized users including your kids.

If one or more of your neighbors simply will not help you keep your kids off their WLAN when they're not supposed to be connected, then there's a second option, which is to configure your kids' devices to prevent them being able to connect to any non-remembered WLAN. As stated in other answers, you basically lock this down with permissions and an administrative account on the device, which your kids will not have access to. This isn't always possible, and it's never easy. With Windows PCs, you'd basically use Group Policy to prevent non-administrative users from connecting to a non-remembered network. Not all Windows versions have this; basically you'd be required to buy the "Professional" or "Business" level of the software, which has all the doodads needed to be an Active Directory client (allowing remote administration, domain logins, etc). Smartphone/tablet OSes like Android/iOS, AFAIK, do not have this ability "out of the box"; the intent of the OS design is to allow WiFi use wherever it may be obtained, to avoid using the cell data plan (and that data plan, if it exists, can still be used even if you prevent all unauthorized WiFi use, unless your provider allows you to turn data access on or off for various devices from a central control panel, like your own smartphone). You may be able to install a "childblocker" app that restricts use of the data plan or certain apps during various times or on command from your phone.

However, there's an even easier solution to the whole problem, which probably should be the first option; confiscate your kids' devices during the times you don't want them used. Simple, effective, free. If they're supposed to be doing homework, then any entertainment consoles that use the Wi-Fi (XBox, PS, Wii, Blu-Ray, Apple TV, Google TV, SmartTV) are turned off, and your kids are in a room that doesn't have them while they are doing their homework. Their tablets and smartphones are in your hands, or a basket next to the entertainment center with all the banned console devices, and if they need their laptops to do their homework (Wikipedia is a legitimate use for Internet during homework hours) then you have monitoring software on said laptops keeping you apprised of what they're actually connected to, or you can simply whitelist websites from the control software. Some may call this draconian and oppressive; I call it tough love and good parenting.

Answer 2

If a user connects to the outside world through your router, then yes - you have complete control over what they can and can't do. If a user is inside your house but connects to the neighbours unsecured WiFi, then no - your router is not even aware of the connection and you have no control over it via your router configutation.

It is just the same as if your neighbour connects to their own WiFi - it is obvious that you cannot prevent them from connecting, and the situation is the same.

The only approach would be to lock down the 3 devices so that they are only able to connect to your specific hotspot. The approach would depend on the operating systems, but in general you would configure the user permissions so that only administrators could add a new WiFi affiliation, and prevent users from logging in as administrators.

Answer 3

The configuration you need is not made in your router. Your router cuts off the internet connection as you instructed it to, but to prevent your desktop, laptop and tablet at home, not to connect to other networks, you will have to perform some sort of voodoo on those devices. On windows OS computers, especially the corporate (i.e. professional) versions of the OS, there are policies that govern the behaviors, such as network selection among many other things. But without knowing what operating system are your devices running, it is hard to tell how to configure them.

Answer 4

Someone with the proper knowhow and available hardware could write a program to broadcast deauthentication frames to every client, from every access point that is not yours. This is essentially discriminating against all other networks and not allowing anyone to connect to them for longer than it takes the program to detect and broadcast.

This is of course not a practical or reasonable idea as it would render the other Access points (which are totally legitimate) useless. It's really just a thought experiment in the interest of rigorously thinking about your question.

Answer 5

You would need to be able to configure the devices to prevent them from accessing another network. The router can only prevent actions that are taken through it. It doesn't actually control the devices that attach to it or alter them in any way, so if they change to using a different router, it has no impact.

Answer 6

Note - I attempt to demonstrate a completely paranoid method, because this seems to be a paranoid question.

I am assuming that your situation is similar to what @KeithS said: you are trying to keep your kids from using internet when they are not supposed to, or something like that. I am also assuming that the restrictions cannot be placed on the devices themselves, because your kids could easily get around any passwords or access controls by simply booting the computers off of flash drives to different operating systems, which do not have these settings.

There is nothing that the router can do to prevent devices from connecting to other networks. (At least not without totally reprogramming the firmware, which would be extremely complicated.) However, there is an alternative.

Probably the best option is to set up a small devices such as a Raspberry Pi, with a wireless adaptor and the aircrack-ng suite of tools installed. Write a script that automatically puts the adaptor in monitor mode, scans all nearby devices to search for your kids' devices' MAC addresses, and if it finds any then it launches a continual deauthentication attack against them. Include this script in the root crontab, and have include a check at the start of the script that only continues at certain times of the day (when you don't want them on the internet.) Connect this Raspberry Pi to a USB battery pack and put it in a carbon fiber safe. (A metal safe would block the wireless signals). Lock the safe, and take the key with you when you leave.

There are only three ways that the above system can fail:

1. Your kids can carry your safe a ways away from your house, so the raspberry pi is out of range of their devices. This could be prevented by using steel cabling to lock the safe to an immovable object, such as a pipe in your house.
2. Your kids could cover the safe in aluminum foil, thus blocking all signals. This is pretty much unpreventable.
3. Your kids could boot the computer of off a flash drive into linux, and then use a utility to change the wireless card's MAC address. This could only be prevented by sending the deauthentication packets to all nearby devices, not just your kids'. However, this would probably bother your neighbors, and is less than ideal.

Based on the above factors, my conclusion is this: if your kids are smart enough to circumvent this setup, then you should probably give them more freedom on the internet to learn and explore.