I have several roommates who split my internet bill with me each month. On occasion they forget to pay me, and I have to pester them for the money.

If after 3 days of pestering they still haven't paid, I create a firewall rule in my unix based router that blocks traffic to their mac address. This proves to be very effective at getting delinquent roommates to pony up the cash.

How could I automate the adding / removing of a mac address to a firewall rule on the 3rd of every month? I'd like a simple way to unblock them for the rest of the month once they pay.

I'm currently using pfsense. While there is a captive portal module, it doesn't support regulating access per user / per month.

How could I automate blocking/unblocking roommate internet access?

  • 14
    What you're doing right now sounds like the most efficient way about it -- I can't imagine a captive portal solution being anything more than complete overkill. If anything, you could make a simple shell script to automate the rule adds themselves.
    – NReilingh
    Jan 2, 2014 at 2:42
  • 8
    MAC address are very, very, easy to change and should not be used to form any measure of security. Windows requires one registry edit. Linux requires one command. With one command in Linux he could even copy your MAC address. Seems to me that a better solution would be automate a password change once a month. Restrict access based on your knowledge rather than his lack of there of.
    – Mark Lopez
    Jan 2, 2014 at 8:22
  • 3
    @Nikolay you're right, MAC address changing might be a more advance topic. However, I just wanted to stress that for reference by our posterity - MAC filtering is unreliable. Additionally, MAC filtering in most cases is not the best solution. I want to displace the numerous tutorials online that say MAC filtering is a good security practice.
    – Mark Lopez
    Jan 2, 2014 at 20:39
  • 6
    Bear in mind, everyone, this is a ROOMMATE situation. Instead of trying to block their addresses by MAC, @spuder, I would recommend that you ALLOW only your MAC addresses, and exclude all others. If you have 4 devices then you only allow those. All other MAC addresses (even spoofed) would be excluded. Remember this ONLY an apartment, right? Then, when your sly roomies try to MAC addy spoof... and it doesn't work... you smile. Remember kids: Sometimes it pays to "invert" your thinking... Jan 6, 2014 at 22:08
  • 11
    I'm surprised nobody has mentioned the Upside-Down-Ternet yet. Way more fun then just blocking.
    – SQB
    Jan 13, 2014 at 9:53

3 Answers 3

  1. Make a bash script which adds restrictive iptables rule.
  2. Put this script in monthly cron.
  3. Inside the bash script make a condition - if file ~/do_not_block_friends exists and its modification time is within of month period (stat -c %y filename) - do not run the script.
  4. Once they pay you do touch ~/do_not_block_friends.

Script will run and see that do_not_block_friends was modified, so it will not run iptables command.

If they did not pay you - script will block them.

Once they have paid you run another prepared script to unlock them.

This is general plan without much details, but I do not think it will be hard to figure out rest of it.


Here is more simple way of writing such script:


count=`find ~ -maxdepth 1 -type f -name do_not_block_friends -mtime -31 | wc -l`

if [ "$count" -eq 1 ]; then

# Friends have paid. Do nothing;


# Friends have not paid. Run iptables command;


We use find command with following options:

  • maxdepth 1 - Do not search recursive
  • type f - Search for file
  • name - Search for this name
  • mtime -31 - Find file which was modified less than 31 days ago

wc -l will count amount of rows generated by the command. It will be 0 if friends have not paid (nothing found) and it will be 1 if friends did pay and we did touch control file.

This script does not calculate amount of days in the month and defaults to 31, I think it is fine since we are not building commercial billing system, but I believe even that can be calculated in bash.

  • Cron job is definitely the way to go!
    – Rob
    Jan 15, 2014 at 13:46

It might be more than you're looking for, but have you considered looking into setting up wireless credentials using 802.1x authentication against RADIUS as a backend?

RADIUS can be set up to check whatever validator you desire (something you'll probably have to script and store in a database or something) to see if your roomies have paid their rent. When they authenticate and have paid, the RADIUS authenticates them. Otherwise, it doesn't. The positive aspect to this is that you're not relying on filtering on MAC addresses. That way if you have tech savvy roomies, they won't easily be able to bypass the controls you've put in place.

  • best solution for real life. and would easily be adaptable to new/more roommates or other people like adding your significant other so it wouldnt block them
    – PsychoData
    Jan 14, 2014 at 17:25
  • sounds simple enough, better than mac filtering and simpler than a portal
    – MDT Guy
    Jan 14, 2014 at 18:09

Check whether your bank account or another transaction solution you may use (PayPal?) provides any way of automatic payment notification, like:

  • per-transaction e-mail notification
  • daily transaction summary e-mail
  • some decent API

If any such method is available, all that's left is writing some simple script that would monitor for payments. You may just parse the e-mails from bank seeking for the monthly payments from your friends. You would need a configuration file storing each friend's account number or ID, sum to pay (might also be a global constant) and MAC address.

The script would then adjust firewall entries according to the monthly payment status.

Afterwards, inform your friends of available payment options and - while configuring your firewall - remember to provide your friends with access to the payment mechanism so that they can still pay when missed the 3-day grace period :)

  • yea, but then he'll have to pay processing fees, since hes in college thats no good
    – iamkrillin
    Jan 14, 2014 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .