Orbi RBR850 access control - what does it actually do?

[jftobolski]

I have an Orbi RBR850.  Everything working well, have >100 devices with IP reservations, hence I have only a small DHCP address range set aside for "other devices".  Recently I've been seen an apple device (with a private MAC address, always the same though) attaching to my network.  ALL of my devices are accounted for - it's not one I own.  So, I blocked that MAC address in Access Control.

However, I still see it attaching to my network and getting an IP address.  If i change the address range of the DHCP, that rogue device still shows as attached with a new address in the new range.  I want to block it from attaching to my network, period.  Yes, I know I can change the SSID or SSID password but with the number of IoT devices I have, I don't prefer that solution as it will be a huge pain in the arse.

So, forum, what does access control actually *do*?  Just block internet access?  If so, how does one put a MAC address on a disallow list so it cannot attach to the network.  Again, I know I can change SSID password or name - that's not an easy change given the number of devices I'd have to deal with

Thanks in advance

Joe

Hardware Version RBR850
Firmware Version V4.6.14.3_2.3.12
GUI Language Version V3.0.1.54_2.1.30.3
Operation Mode Router

[CrimpOn]

---

@jftobolski wrote:

So, forum, what does access control actually *do*?  Just block internet access? 

---

An opportunity for experimentation

• Does this device respond to ICMP (Ping)?
• If Enable LAN/WAN Packet Capture is done on the Orbi debug page (http://orbilogin.net/debug.htm ) does resulting lan.pcap file show any data packets from this IP address?

My hypothesis is

• the process of associating with the WiFi takes place at the "radio level" (before Orbi code is aware the device exists)
• An IP address is assigned to the device because
• Blocking is done by placing an entry in linux iptables that says, "delete any packets from this device."

Is this device always connected to the same Orbi access point? (i.e. it appears to be in one location?)

[jftobolski]

Thanks for the reply - it does respond to ping, but only intermittently (meaning there might be 50-100 unsuccessful attempts, then 5-10 replies... repeat.

The log files weren't terribly self explanatory - the IP address in question shows up in the files, but not sure where exactly to look for actual packet traffic - anything you can suggest would be appreciated.

Good thought on the satellite that this device links to.  It does move around.  then again, so does a WEMO in-wall light switch so I wouldn't consider that high-grade information.

[jftobolski]

Sorry - an addendum.  There is no lan.pcap file.  There is an eth4.pcap and and BR.pcap.  Neither are in plaintext though.

[CrimpOn]

---

@jftobolski wrote:

Sorry - an addendum.  There is no lan.pcap file.  There is an eth4.pcap and and BR.pcap.  Neither are in plaintext though.

---

Oh, joy.  Looks like Netgear decided to change how packet capture works in the AX products. (sigh)

pcap files are indeed binary files that can be displayed using a number of free programs. For Windows, I use Wireshark.

[SLK-Purdue]

Pcap files are for Wireshark. It is a free download and will decode the file. You like want the BR.pcap info

Scott

[FarmerBob1]

Maybe a bit offf topic. But when I have had that happen, if you can get a MAC Address I've put it in "Access Control". Blocked it.

[jftobolski]

Update - have the packet capture running, and Wireshark installed.  Will let it go for a bit

On the access control, yes I have blocked the MAC - but it's still getting onto the Wifi so want to see what it's talking to, if anything.  I'd prefer if Access Control MAC filtering disallowed access to Wifi entirely.

On a side note, I foolishly turned on parental controls and not Access Control went away.  Is there an easy fix?

[CrimpOn]

Experiment 1 - Partial Success:

• Charged up my old Moto e phone (no SIM card)
• In the Orbi Access Control, enabled Access Control, changed the MAC address for this phone from Allowed to Blocked (and "Applied" - I nearly always forget that step)
• Turned on the Moto e.
• Moto e booted up and reported:
  • Network connected at 5G
  • Connection Excellent
  • Regular IP assigned from the LAN assignment table (192.168.1.31)
  • No Internet
• Opened a command window on a PC and attempted to ping the Moto e.
  Ping "timed out".  No response.
• After "undoing" all this, Moto e works normally.  (Now has 29 apps to update - has been in a drawer for quite some time).

So far, this supports the idea that "Blocked" means:

• The device can connect to the network and get an IP assignment, but
• The device cannot access (or be accessed by) the local network or the internet.

Hypothesis about iptables* - (meh)

*  https://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/ 

My older Orbi can be accessed with telnet, so I attempted to see if turning on Access Control and blocking the Moto e made any change.

• Before enabling Access Control, I dumped out the iptables rules.
• After enabling Access Control, dumped the iptables rules again.
• Put the two results into WinMerge (a program that compares two files for differences).
• Could not find any difference.  No reference to 192.168.1.31.  No additional rules.  Nada.

This definitely does not support the hypothesis that Netgear uses iptables to block the device.  This could be because:

• They use some other mechanism to block devices, or
• I am not sophisticated enough to discover how iptables is working.  (very good chance of that!)

Whatever this rogue device is, it must be plugged into electricity.  (a battery powered device would have gone silent by now.)

Is there a chance that it is not an Apple device?  This business of randomizing MAC addresses has spread to Android and Windows (laptops for sure).

[FURRYe38]

Try to disable SPC using the Orbi app under Settings from the top left menu in the app...

Power off the RBR for 1 minute then back ON after applying the setting...should make the controls re-appear in the UI again? 

---

@jftobolski wrote:

Update - have the packet capture running, and Wireshark installed.  Will let it go for a bit

On the access control, yes I have blocked the MAC - but it's still getting onto the Wifi so want to see what it's talking to, if anything.  I'd prefer if Access Control MAC filtering disallowed access to Wifi entirely.

On a side note, I foolishly turned on parental controls and not Access Control went away.  Is there an easy fix?

---

[jftobolski]

Thanks to all for the help - the rogue device is still showing as connected, but packet trace shows no traffic to or from other than the orbi doing name queries.  I'm going to keep an eye on it for now.  It's annoying though - block ought to mean "don't allow connectivity"