Forbid one ip to access the wan

Question

I'm trying to configure my DLink DI524 to do the following: I've got a PS3 on the LAN trough cable and my router is configured with MAC filters (this part is OK and working).

But now I'm trying to do this: I want this PS3 to connect but it will only have traffic at the LAN, never be allowed to get WAN data or even NAT.

I thought that I could do that with subnet mask, but I'm not so sure about this.

Do anyone with expertise could help me a bit?

Thanks in advance, Andre

Answer 1

Look at the page "Advanced - Filters - IP Filters", where you can enable/disable internet access for the specified range of IP addresses and ports.

Just add a rule that denies internet access for the IP address of your PS3.

If your PS3 has a dynamically assigned IP address (i.e. is using DHCP) then you should change it's network configuration and give it a static IP address. Look at the router's "Home - DHCP" configuration and make sure that your chosen static IP address does not belong to the DHCP start - end addresses range.

Answer 2

You can control the number of available IP's through a subnet mask.

Example: If I use 192.168.0.0 as my network, I can use a /30 so that 192.168.0.0 through 192.168.0.4. Making it a /29 would allow through 192.168.0.8. /28 goes through 192.168.0.16. The pattern continues (doubling the number) up through /24 which would get you 192.168.0.255. What this would do is stop any number outside the range (not just one IP).

If you are mac filtering, this should only allow the devices you expect to see on the network (unless someone MAC spoofs you). I'm not really familiar with a way to disallow a single IP in a range (unless you are using a high end router, not a SoHo one).

Answer 3

Can you hard-code the IP address of the PS3, (instead of using DHCP) and not set a gateway? Or set the gateway to the same IP as the PS3? It would then be able to talk on the LAN using Ethernet Broadcasts, but wouldn't know how to route to devices that don't respond to broadcast.