RADIUSdesk

logo
Trace:

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
meshdesk:nft-block [2023/02/20 09:33]
admin [Slowing Junior Down] 		meshdesk:nft-block [2023/02/25 23:24] (current)
admin [Going Back In Time]
Line 34: Line 34:
 {{ :meshdesk:filtered.png |}} {{ :meshdesk:filtered.png |}}
   * Speedtest with 1Mbps Upload and 1Mbps Download speed limit applied   * Speedtest with 1Mbps Upload and 1Mbps Download speed limit applied
 +
 +===== Going Back In Time =====
 +  * You might have noted that up to now we only offered the opportunity for you to select recently connected devices and apply a block or speed limit on them.
 +  * If you blocked someone and a month pass by we still give you an applet with which you can manage these devices.
 +  * Under **Meshes** and **AP Profiles** is a **Blocked and Speed Limited Devices** button.
 +{{:meshdesk:blocked_and_speed_limit_applet.png?nolink|}}
 +  * When you click the button a new closable tab will open.
 +{{:meshdesk:blocked_and_speed_limit.png?nolink|}}
 +  * Here you can see the current entries for the Cloud and Meshes and AP Profiles falling under the selected Cloud.
 +  * This applet allows you to Add, Edit and Delete entries.
 +{{:meshdesk:blocked_and_speed_limit_edit.png?nolink|}}
 +
 +===== Technical Details =====
 +  * If you are an old hand with Linux you are probably very familiar with **iptables**.
 +  * In the old days firewalls were done using **iptables** and in case you needed to do packet management on layer two you would use **ebtables**.
 +  * Fast forward to today and we have the much more advanced and user friendly **nftables**.
 +  * nftables allows you to do packet management on layer three and layer two.
 +  * OpenWrt version 22.03 migrated to use nftables instead of iptables.
 +  * We took the opportunity to take advantage of this improvement with our per device block and speed limit feature.
 +  * This means that the feature will require OpenWrt version 22.03 or higher based firmware to work correct.
 +  * One aspect which makes our implementation unique is the fact that we work on layer two and not layer three.
 +  * The reason for this is that MESHdesk and APdesk allows you to create <wrap em>bridged networks</wrap> where the IP Address management (DHCP) can be done by another device on the network.
 +  * By working on layer two it allows us to block and apply speed limits without the requirement to know the IP Address of a device.
 +  * You will need the compulsory <wrap em>kmod-nft-bridge</wrap> nftable module . Make sure it is included with the OpenWrt based firmware.
 +  * Every time you apply or remove a block or speed limit the affected Access Points will be instructed to fetch their latest firewall settings from the controller.
 +  * The utility script that does this is **/etc/MESHdesk/utils/fetch_firewall.lua**.
 +  * If MQTT (Real time) support is enabled this will happen in real time else it should happen on the next heartbeat that the Access Point sends through which is typically in less than one minute.
 +  * The meshdesk bridge table is where things are happening.
 +  * You can inspect the table using the following command **nft -e -a list table bridge meshdesk**.
 +  * During startup the Access Point will also, as part of the configuration data sent to it, have a firewall section included (if there is devices that needs to be blocked or speed limited).
 +  * This will then be applied as part of the setup routine.
 +
  
  
  
  
Last modified: 2023/02/20 09:33