6

I am setting up my friend's network for his kids. I have Tomato firmware running on their Linksys with OpenDNS filtering as well as timed Access Restrictions (ie, no more internet access after 11:30pm). That's all fine and dandy as long as my friend's son's phone stays on his network. However, he is getting access to a friend's router nearby (however, he does not have data on his phone; so I don't need to worry about that).

In Tomato, I can go to Tools > Wireless Survey and I can see all the BSSID's that are all around their house.

I also have rooted my friend's son's Android phone. Is there any way to block the phone from connecting to specific BSSID's? I have AirDroid installed and can access the root files from my house. Is there some file in there that I can edit?

  • I am not 100% sure if you can actually block the device from hooking up to the network nearby, if the wifi is activated on the device, it will pick up all access points, but to tell it to forcefully just use one access point seems tricky to do, I'll investigate in a while. – t0mm13b Feb 26 '14 at 19:07
  • What if I download a firewall app and use a custom script to do the job? I tried using Droidwall and entering a custom IP table according to its instructions: code.google.com/p/droidwall/wiki/CustomScripts This was my script: $IPTABLES -A "droidwall" -m --mac-source 00:00:00:00:00:00 -J "droidwall-reject" However, it didn't work (of course, I used the actual MAC address of the wireless access point, and not just 00:00:00:00:00:00) . I don't really understand what I'm doing. – threehappypenguins Feb 26 '14 at 19:36
  • Thing is, DroidWall is no longer maintained, you might be better trying AFWall+ instead. – t0mm13b Feb 26 '14 at 20:14
4

Might be worth a shot to try this:

$IPTABLES -A "afwall-reject" -m mac --mac-source 00:00:00:00:00:00 -j DROP

the switches in iptables are case-sensitive.

Replace 00:00:00:00:00:00 that with the MAC address of the BSSID that is transmitting wifi beacon packets, and password protect it to prevent mitigation attempts in trying to override it.

  • Thanks. I actually uninstalled DroidWall and installed Android Firewall instead. The developer of Android Firewall told me to put this: $IPTABLES -A INPUT -m mac --mac-source 00:00:00:00:00:00 -j REJECT However, it's still not working. What is happening is that I am testing this at home before I implement it on my friend's son's phone. But when I go in my router, I can't find my own BSSID. So I tried WAN, LAN and Wireless MAC addresses. Not sure if one of those is the same as the BSSID. Either way, none of them worked. The developer said that tonight he would look at it if he has time. – threehappypenguins Feb 26 '14 at 20:57
  • I downloaded an app called Network Info II and it showed me that my BSSID is the exact same as my Wireless MAC address. So that answers my question. Now I just need to figure out how to prevent the phone from accessing this specific network... – threehappypenguins Feb 26 '14 at 21:40
1

I figured things out. For one, after I added the iptable rule, I needed to REBOOT my phone for it to apply (which I wasn't doing). Secondly, I needed to use the LAN Mac Address (NOT the BSSID/Wireless MAC address) in order for the iptable rule to work.

Thirdly, I downloaded AFWall+. It allowed me to set it as administrator to prevent uninstallation. The only thing missing is that the developer needs to password protect removing the app as administrator.

Then I downloaded Android Terminal Emulator. In order to find the LAN MAC address for the connection that I am looking to block, I typed this into the emulator:

arp -n

Then I used the MAC address that was given in the terminal and put that into this rule here to be place in "custom scripts" in the firewall:

$IPTABLES -A INPUT -m mac --mac-source 00:00:00:00:00:00 -j DROP
  • What this does is break TCP/IP networking, but does not stop 802.11x association. – cde Jul 5 '15 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.