1

I have a Mac OS X Server which also runs a DHCP and DNS server for my network. I would like to have a simple way (possibly even bash script) to temporarily prevent internet access for specific devices. For example I would like to deactivate the kid's Apple TV from streaming content from the internet, when I am working remotely.

Thanks

Improve this question
0

4 Answers 4

Reset to default
0
+50

Set up your server as an internal gateway similar to the network configuration in this question:

Router <-- ethernet (or Wi-Fi) --> Server <-- ethernet --> switch <-> internal network

Then adjust all settings as outlined in my answer there:

I assume the following IP-adresses/netmasks:

Router: 192.168.0.1/24
Server: en0: 192.168.0.2/24 gateway 192.168.0.1 en1: 192.168.1.2/24
Internal network: 192.168.1.0/24

  1. First you have to enable forwarding on your server computer with following commands:

    sudo sysctl -w net.inet.ip.forwarding=1
sudo sysctl -w net.inet.ip.fw.enable=1

  2. In order to do NAT you have to create a pfctl rule. Create a file called "nat-rules" with the following content:

    nat on en0 from en1 to any -> (en0)

  3. Save the file and now start pfctl using the rule from the file we have created earlier:

    sudo pfctl -d #disables pfctl
sudo pfctl -F all #flushes all pfctl rules
sudo pfctl -f /Path/to/file/nat-rules -e #starts pfctl and loads the rules from the nat-rules file

  4. Now configure a static route on your router:

    192.168.1.0/24 (the internal network) -> 192.168.0.2 (server IP-address of the external interface connected to the router)

  5. Enable the DHCP-service on your server:

    • Name: choose a name
    • Network Interface: en1
    • Starting IP address: 192.168.1.10
    • Ending IP address: 192.168.1.100
    • Subnet Netmask: 255.255.255.0
    • Router: 192.168.1.2
    • DNS: some or your DNS-server (e.g. 8.8.8.8 or 192.168.1.2)

  6. Now use pfctl to add rules or get a pfctl-GUI like IceFloor or Murus to configure your firewall. Both apps should also allow you to enable NAT (step 2/3). You may define two different rulesets: one which only allows your computer to access the internet from the internal network and a different one which doesn't restrict internet access.

Improve this answer
1

You could possibly alter the DHCP reservation for the device(s) you wish to prevent internet access in such a way to make the DNS pointer point to something invalid, 127.0.0.1

Not sure if it's what you're after but it could be worth looking into. If I had OS X server myself, I'd write you up an applescript snippet to do the switching quickly and automagically.

Improve this answer
2
  • But wouldn't that take to long, since the DNS pointer would update after the DHCP lease was renewed?
    – Joseph
    Jun 9, 2015 at 6:41
  • 1
    Maybe, you could force a renewal or change the IP address in the DHCP associated with the MAC of the iDevice(s). Not sure the best way to go about it, but this is what comes to my mind, there are probably better or more elegant ways of doing it.
    – TGYK
    Jun 9, 2015 at 13:44
0

You can do this directly from any router with DD-WRT firmware, or a router with sufficient admin privileges.

If you have an Airport router, the process is even simpler:

http://www.macworld.com/article/1161672/limit_internet_access.html

Improve this answer
1
  • Thanks. I am using an Airport router. This is a more up to date link: 9to5mac.com/2013/10/06/… The only problem is, that I can't seem to set port-forwarding rules in bridge mode, which I definitely need. Maybe I can chain two airports behind each other. One for the port forwarding and one for the access control. The question/problem however is more going towards a immediate solution and not a time solution (which is interesting none the less).
    – Joseph
    Jun 15, 2015 at 5:26
0

The solution I found was to add a switch in between and to simple pull the cable when I want to restrict internet access for the others.

Sadly there is no easy software solution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .