Blackholing a MAC address with Ubiquiti EdgeRouter-4
Recently, I was digging around in the DHCP table of my EdgeRouter-4. I do this from time to time, mostly out of curiosity but also as a simple audit. With so many IoT devices floating about, it can be difficult to keep track of what devices I’ve allowed onto the network.
All IoT devices in my home only get to use the guest WiFi network. This network does not allow devices to talk to other devices - only the Internet. The exception to this are multimedia devices like Apple HomePods and Apple TV. This ensures that they’re not snooping on their neighbors and they only have access to what they need.
In my most recent review of the DHCP table, I noticed a device name I didn’t remember: “August Doorbell Cam”. Doing a little digging online, it seemed like a valid device but I couldn’t figure what it was. More importantly, we don’t have a doorbell camera.
Given that the device was connected to the 2.4GHz guest WiFi network, it wasn’t much of a threat to any devices on the network. However, I still didn’t like the idea of an unknown device sitting on the network.
As a starting point, I decided to create an outbound firewall rule to drop all packets from the source MAC address of the device. I figured if the device was something important, I’d get a notification that it was offline. However, when I went digging on how to do this properly, I ran in to a few bumps. What follows is a brief explanation on how to implement a MAC address ban using the ER-4 interface.
First, a new WAN_OUT ruleset with a default action of accept needs to be created:
A crucial piece of creating the ruleset is setting the proper interfaces in Actions -> Interfaces. You’ll want to select the WAN interfaces, in my case pppoe0 and the Direction field should be set to out:
After saving, you should see the ruleset:
Next you’ll need to click Action -> Edit Ruleset -> Add New Rule to create a new rule. The action should be set to drop and select All protocols:
Next, click the Advanced tab and check New and Established check boxes for the State selection:
Finally, click the Source tab and enter the source MAC address to ban:
Once you’ve saved the rule, it should take effect almost immediately. For testing, I duplicated the rule and MAC-banned my iPhone after disabling Cellular data to make sure I got it setup correctly.
If you want to check for a more detailed view of whether or not packets are getting blocked, you can login to the EdgeRouter-4 via SSH and enter the command show firewall. You should get some output like this:
ubnt@edgerouter:~$ show firewall
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_IN":
Inactive - Not applied to any interfaces, zones or for content-inspection.
rule action proto packets bytes
---- ------ ----- ------- -----
10 accept all 52636183 8146382022
condition - state RELATED,ESTABLISHED
20 drop all 0 0
condition - state INVALID
10000 drop all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_LOCAL":
Inactive - Not applied to any interfaces, zones or for content-inspection.
rule action proto packets bytes
---- ------ ----- ------- -----
10 accept all 2204313 349770930
condition - state RELATED,ESTABLISHED
20 drop all 61777 6153803
condition - state INVALID
10000 drop all 580087 54348289
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_OUT":
Inactive - Not applied to any interfaces, zones or for content-inspection.
rule action proto packets bytes
---- ------ ----- ------- -----
1 drop all 203 24598
condition - state NEW,ESTABLISHED MAC AA:BB:CC:DD:EE:FF
10000 accept all 1941515 221596597
Note near the bottom, under the section titled IPv4 Firewall "WAN_OUT", there’s a rule with id 1. That’s the rule that is blocking outbound traffic from the device - it blocked 203 packets for a total of 24598 bytes.
Happy MAC banning!
Postscript
Turns out the device was a motion sensor camera for our SimpliSafe system. Oops. I unbanned it.
—–Posted on: 2021-01-06
Tagged as: networking, howto