How to prevent internet access to specific clients

Question

I have a Mac OS X Server which also runs a DHCP and DNS server for my network. I would like to have a simple way (possibly even bash script) to temporarily prevent internet access for specific devices. For example I would like to deactivate the kid's Apple TV from streaming content from the internet, when I am working remotely.

Thanks

Answer 1

Set up your server as an internal gateway similar to the network configuration in this question:

Router <-- ethernet (or Wi-Fi) --> Server <-- ethernet --> switch <-> internal network

Then adjust all settings as outlined in my answer there:

I assume the following IP-adresses/netmasks:

Router: 192.168.0.1/24
Server: en0: 192.168.0.2/24 gateway 192.168.0.1 en1: 192.168.1.2/24
Internal network: 192.168.1.0/24

1. First you have to enable forwarding on your server computer with following commands:

   sudo sysctl -w net.inet.ip.forwarding=1
   sudo sysctl -w net.inet.ip.fw.enable=1
   

2. In order to do NAT you have to create a pfctl rule. Create a file called "nat-rules" with the following content:

   nat on en0 from en1 to any -> (en0)
   

3. Save the file and now start pfctl using the rule from the file we have created earlier:

   sudo pfctl -d #disables pfctl
   sudo pfctl -F all #flushes all pfctl rules
   sudo pfctl -f /Path/to/file/nat-rules -e #starts pfctl and loads the rules from the nat-rules file
   

4. Now configure a static route on your router:

   192.168.1.0/24 (the internal network) -> 192.168.0.2 (server IP-address of the external interface connected to the router)

5. Enable the DHCP-service on your server:

   • Name: choose a name
   • Network Interface: en1
   • Starting IP address: 192.168.1.10
   • Ending IP address: 192.168.1.100
   • Subnet Netmask: 255.255.255.0
   • Router: 192.168.1.2
   • DNS: some or your DNS-server (e.g. 8.8.8.8 or 192.168.1.2)

6. Now use pfctl to add rules or get a pfctl-GUI like IceFloor or Murus to configure your firewall. Both apps should also allow you to enable NAT (step 2/3). You may define two different rulesets: one which only allows your computer to access the internet from the internal network and a different one which doesn't restrict internet access.

Answer 2

You could possibly alter the DHCP reservation for the device(s) you wish to prevent internet access in such a way to make the DNS pointer point to something invalid, 127.0.0.1

Not sure if it's what you're after but it could be worth looking into. If I had OS X server myself, I'd write you up an applescript snippet to do the switching quickly and automagically.

Answer 3

You can do this directly from any router with DD-WRT firmware, or a router with sufficient admin privileges.

If you have an Airport router, the process is even simpler:

http://www.macworld.com/article/1161672/limit_internet_access.html

Answer 4

The solution I found was to add a switch in between and to simple pull the cable when I want to restrict internet access for the others.

Sadly there is no easy software solution.