<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">I have an OpenWrt 10.03 router [ IP: 192.168.1.1 ], and it has a DHCP server pool: 192.168.1.0/24 - clients are using it through wireless/wired connection. Ok!</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">Here's the catch: I need to separate the users from each other.</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">How i need to do it: by IPTABLES rule [ /etc/firewall.user ]. Ok!</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><meta http-equiv="content-type" content="text/html; charset=utf-8">"Loud thinking": So i need a rule something like this [on the OpenWrt router]: </span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- DROP where SOURCE: 192.168.1.2-192.168.1.255 and DESTINATION is 192.168.1.2-192.168.1.255</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">The idea is this. Ok!</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">Questions! </span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- Will i lock out myself if i apply this firewall rule?</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- Is this a secure method? [ is it easy to do this?: hello, i'm a client, and i say, my IP address is 192.168.1.1! - now it can sniff the unencrypted traffic! :( - because all the clients are in the same subnet! ]</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- Are there any good methods to find/audit for duplicated IP addresses?</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- Are the any good methods to find/audit for duplicated MAC addresses?</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">- Are there any good methods to do this IPTALBES rule on Layer2?:</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">`$ wget -q "http://downloads.openwrt.org/backfire/10.03/ar71xx/packages/" -O - | grep -i ebtables`</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">`$ `</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">p.s.: The rule would be [is it on a good chain?]: </span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">iptables -A FORWARD -m iprange --src-range 192.168.1.2-192.168.1.255 --dst-range 192.168.1.2-192.168.1.255 -j DROP</span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div><font class="Apple-style-span" face="Verdana, arial, Helvetica, sans-serif"><span class="Apple-style-span" style="font-size: 12px;">Thank you!</span></font></div><div id="" style="font-family: Verdana, arial, Helvetica, sans-serif; font-size: 12px; "></div></body></html>