add jail mac feature

[seancmalloy]

is there anyone out there that would help me add simple feature to this add-on. I need to drop traffic from certain mac addresses. this feature is required for localtuya so tuya devices dont have internet access.

heres what i got so far, still testing

dockerfile -

apk add --no-cache bash jq iw hostapd networkmanager networkmanager-cli net-tools sudo dnsmasq iptables ipset && \

COPY jail.txt /

config.json -

options
"deny_mac_internet": [],

schema
"deny_mac_internet": ["str"],

run.sh -

JAIL=/jail.txt
DENY_MAC_INTERNET=$(jq --raw-output '.deny_mac_internet | join(" ")' $JAIL)

if [ ${#DENY_MAC_INTERNET} -ge 1 ]; then
echo "$deny_mac_internet"$'\n' >> /jail.txt
ipset create JAIL hash:mac
ipset add JAIL -f /jail.txt
iptables-nft -A FORWARD -i $INTERFACE -m set --match-set JAIL -o eth0 -j DROP
fi

any help is appreciated

update - its seems that ipset set types support is not in the kernel

plan b

if [ ${#DENY_MAC_INTERNET} -ge 1 ]; then            
            MACDENIED=($DENY_MAC_INTERNET)
            for maclist in "${MACDENIED[@]}"; do
                echo "$maclist"$'\n' >> /jail.txt
                iptables-nft -A FORWARD -i $INTERFACE -m mac  ! --mac-source $maclist -o eth0 -j DROP
            done
fi

update - i included nano in add-on and confirmed that its not writing mac addresses to file. why? anyone have any ideas?

update - so i gave up on trying do it like this, so just added sh file with iptables rules that runs if new option is selected in config. it prevents tuya devices from accessing the internet so i can just use localtuya. if anyone is interested...

dockerfile -

COPY jail.sh /
RUN chmod a+x /jail.sh

jail.sh -

iptables-nft -A FORWARD -i wlan1 -m mac ! --mac-source xx:xx:xx:xx:xx -o eth0 -j DROP

config -

"options": {
"deny_mac_internet": "0",

"schema": {
"deny_mac_internet": "int",

run.sh -

DENY_MAC_INTERNET=$(jq --raw-output ".deny_mac_internet" $CONFIG_PATH)

if [ $DENY_MAC_INTERNET -eq 1 ]; then
   sh /jail.sh
   sleep 5
fi

[mattlongman]

Hi @seancmalloy - it's a good idea, just wondering if you had any other thoughts on how to get it to work or made any progress? I'll take a look, but I suspect I'm less familiar with the components than you are.

[seancmalloy]

I abandoned it. It looks like the kernel in ha doesn't support ipset types, rules would have be added for every mac. This may be possible but would require a different way. I'm not a professional coder. I believe it's possible and makes sense for localtuya devices.

[mattlongman]

A couple of other potential approaches: if the tuya devices use a web address instead of direct IP, block those using the syntax address=/example.com/0.0.0.0 (in the dnsmasq override config option). This would block all devices from accessing that domain, but I guess that wouldn't be an issue.

Install Pihole or adguard addon and set the client_dns_override addon option to be the IP of the pihole/adguard IP. Then you'll have more control of the DNS blocking options.

If the tuya devices use hardcoded IP addresses, another firewall addon, or you home router could be used to block those IPs as destinations.

You're right - for someone who knows the underlying host config tools better, this might be quite simple, and a useful option.

[seancmalloy]

That is probably the only workable solution as is. I would like a more granular method to block tuya devices while leaving other wifi devices alone. Plus when you add new tuya devices you would need to change dummy dns to real to activate. Unless I am misunderstanding.

The curent iptables pkg looks like it has limitations (no --mac-source) maybe it will work with future update.

[ROBOT0-VT]

Heyo, I'm looking into doing this with iptables, alongside other networking changes