Blackholing a MAC address with Ubiquiti EdgeRouter-4

Recently, I was digging around in the DHCP table of my EdgeRouter-4. I do this from time to time, mostly out of curiosity but also as a simple audit. With so many IoT devices floating about, it can be difficult to keep track of what devices I’ve allowed onto the network.

All IoT devices in my home only get to use the guest WiFi network. This network does not allow devices to talk to other devices - only the Internet. The exception to this are multimedia devices like Apple HomePods and Apple TV. This ensures that they’re not snooping on their neighbors and they only have access to what they need.

In my most recent review of the DHCP table, I noticed a device name I didn’t remember: “August Doorbell Cam”. Doing a little digging online, it seemed like a valid device but I couldn’t figure what it was. More importantly, we don’t have a doorbell camera.

Given that the device was connected to the 2.4GHz guest WiFi network, it wasn’t much of a threat to any devices on the network. However, I still didn’t like the idea of an unknown device sitting on the network.

As a starting point, I decided to create an outbound firewall rule to drop all packets from the source MAC address of the device. I figured if the device was something important, I’d get a notification that it was offline. However, when I went digging on how to do this properly, I ran in to a few bumps. What follows is a brief explanation on how to implement a MAC address ban using the ER-4 interface.

First, a new WAN_OUT ruleset with a default action of accept needs to be created:

A crucial piece of creating the ruleset is setting the proper interfaces in Actions -> Interfaces. You’ll want to select the WAN interfaces, in my case pppoe0 and the Direction field should be set to out:

After saving, you should see the ruleset:

Next you’ll need to click Action -> Edit Ruleset -> Add New Rule to create a new rule. The action should be set to drop and select All protocols:

Next, click the Advanced tab and check New and Established check boxes for the State selection:

Finally, click the Source tab and enter the source MAC address to ban:

Once you’ve saved the rule, it should take effect almost immediately. For testing, I duplicated the rule and MAC-banned my iPhone after disabling Cellular data to make sure I got it setup correctly.

If you want to check for a more detailed view of whether or not packets are getting blocked, you can login to the EdgeRouter-4 via SSH and enter the command show firewall. You should get some output like this:

ubnt@edgerouter:~$ show firewall
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_IN":

 Inactive - Not applied to any interfaces, zones or for content-inspection.

rule  action   proto     packets  bytes
----  ------   -----     -------  -----
10    accept   all       52636183 8146382022
  condition - state RELATED,ESTABLISHED

20    drop     all       0        0
  condition - state INVALID

10000 drop     all       0        0

--------------------------------------------------------------------------------
IPv4 Firewall "WAN_LOCAL":

 Inactive - Not applied to any interfaces, zones or for content-inspection.

rule  action   proto     packets  bytes
----  ------   -----     -------  -----
10    accept   all       2204313  349770930
  condition - state RELATED,ESTABLISHED

20    drop     all       61777    6153803
  condition - state INVALID

10000 drop     all       580087   54348289

--------------------------------------------------------------------------------
IPv4 Firewall "WAN_OUT":

 Inactive - Not applied to any interfaces, zones or for content-inspection.

rule  action   proto     packets  bytes
----  ------   -----     -------  -----
1     drop     all       203      24598
  condition - state NEW,ESTABLISHED MAC AA:BB:CC:DD:EE:FF

10000 accept   all       1941515  221596597

Note near the bottom, under the section titled IPv4 Firewall "WAN_OUT", there’s a rule with id 1. That’s the rule that is blocking outbound traffic from the device - it blocked 203 packets for a total of 24598 bytes.

Happy MAC banning!

Postscript

Turns out the device was a motion sensor camera for our SimpliSafe system. Oops. I unbanned it.

Posted on 2021-01-06