TomatoUSB

Has anyone used Tomato with MAC filtering for more than say 40 MAC addresses??? I will be using an Asus RT-N16 with K2.6 Ext Tomato. I currently am using DD-WRT and am having problems with more than 32 MAC addresses. I actually need to enter about 150 addresses total with a simultaneous usage of about 30 or less.

Please let me know what you've found when using MAC Filtering

thanks :)

bump

I use it with more than 140 - see the links below to get hold of a copy of Tomato that will handle it. The older routers can't be modded to allow much more than 100 without running into problems with overwriting parts of memory and killing the router. If you are using an RT-N16 then memory isn't a problem, but NVRAM may be limited for storage.

The current mod release is 7445, and this is set to allow 250 500 because several people are using it for >250. It hasn't been tested that far, obviously. Usually the NVRAM will fill up before you get that far, but it was done because Ray and Fedor are currently working on a method to enable another 32K of unused NVRAM space which will solve a lot of configuration storage space problems.

The number of people simultaneously using the router isn't important, provided you set short conntrack connection timeouts and set up QOS as necessary. Sounds like you may be in a residential complex of some sort, in which case you should find the QOS thread http://www.linksysinfo.org/forums/showthread.php?t=60304 useful.

http://toastman.dyndns.org
ftp://toastman.dyndns.org
info:
http://www.linksysinfo.org/forums/showthread.php?t=63486

Toastman,

Thanks for the info. The setup is as follows:
Currently: DSL ISP -> we are working on going to Cable
Asus RT-N16 wireless router
approx. 150 users
Internet usage: web browsing, Hulu, Netflix, email (really nothing much more than that)
We have approx. 20-40 simultaneous users at any given time

I would like to lock down the wireless with a WPA2 Personal logon and MAC Filtering.
The MAC filtering is primarily to keep smartphones/ipods/ipads off. Additionally, it will be used as a filter to keep unwanted individuals off.

What would you suggest the conntrack timeout to be? As far as QOS I will review the link you posted, I need to learn a lot about QOS.

create a text file at /jffs something like this "macaccess.sh" and put these lines:

iptables -A rdev01 -m mac --mac-source 00:8c:c3:de:67:8a -j RETURN #User Michael
iptables -A rdev01 -m mac --mac-source 00:1c:b0:df:12:44 -j RETURN #User  Charlie
iptables -A rdev01 -j DROP

You can repeat the first line with mac ids of different users, whom you want to allow access, as many times you want. But the last line should come always last. One necessary thing you need to do is you need to enable "access restriction" in the tomato gui, and add MAC id of one user by selecting "allow these computers" from the drop down menu(This id done to enable access restriction so that the text file will work without any errors).

do this at the tomato ssh shell:

chmod +x /jffs/macaccess.sh

Add this line at "firewall script" at gui:

cd /jffs && ./macaccess.sh

reboot or restart the firewall with this command:

service firewall restart

Currently my list contains 600 users, soon, in few months it will 1000!!!

What exactly is the text file going to do… Is it going to be doing the MAC Filtering… I guess what I'm wondering is … is this how I am going to have to add all of the MAC's.. or is this just going to return the 'name' of the person that MAC belongs to?

I thought there would be a GUI way to add the MAC's.. but I assume that it does not have a field for me to enter a corresponding name… correct???

Actually, what I do is to use static DHCP to assign an IP to each room, then identify them by entering the room number into the hostname field. I enter the MAC addresses into the access restrictions GUI. So it's a two-stage thing for me to keep track of users.

So now you have choice to do it either with the GUI and use NVRAM - or with the above text file method if you are comfortable with editing a text file in /jffs. That is a really great idea, but probably couldn't be used by untrained desk staff at my sites. It allows comments next to the MAC address to show you who they are, and it keeps NVRAM clear too.

I'm using Tomato 1.28 TeddyBear's version Ext. —> Tomato Firmware v1.28.9054 MIPSR2-beta K26 USB Ext

There is an area in the web GUI under Administration —> Scripts with (4) headers: 'Init' 'Shutdown' 'Firewall' 'WanUp'

Could I just type the iptable scripting there… under 'Init' ? and then the firewall part under 'firewall' ? instead of telnet'ing in, creating a txt file and saving it under /jffs?

also,

I tried enabling access restriction with an itouch so that it cldn't get on.
Then added all of the MAC's that I want to be able to get on under 'Basic' —> 'Wireless Filter' I saved that info out. However, everyone was kicked off and could not reconnect. Should I have rebooted the router? I am assuming this is probably not dynamic.

I have created a text file.. haven't actually uploaded anything yet but had a question about this section of your directions.

"One necessary thing you need to do is you need to enable "access restriction" in the tomato gui, and add MAC id of one user by selecting "block these computers" from the drop down menu."

Why would I select "Block These Computers" … when This is a list of computers I'm trying to "Allow" on the system. I want to "Block" everyone else. ???

Also what is the -j switch ?

bump