Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #170720 > unrolled thread

Limiting internet access by time

Back to article view | Back to linux.debian.user

Contents

  Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 02:10 +0200
    Re: Limiting internet access by time Lars Noodén <lars.nooden@gmail.com> - 2016-08-05 09:30 +0200
      Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 17:40 +0200
    Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 12:50 +0200
      Re: Limiting internet access by time Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-05 13:10 +0200
        Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 16:10 +0200
          Re: Limiting internet access by time David Wright <deblis@lionunicorn.co.uk> - 2016-08-05 18:00 +0200
          Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 18:00 +0200
            Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-05 19:50 +0200
              Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 21:10 +0200
                Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-06 03:40 +0200
              Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-06 07:30 +0200
                Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-07 03:00 +0200
                  Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-07 05:40 +0200
                    Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-07 20:20 +0200
                      Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-08 02:10 +0200
                    Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-09 19:30 +0200
                      Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-09 21:20 +0200
                        Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-10 15:40 +0200
                          Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-10 17:00 +0200
                            Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-10 18:10 +0200
                              Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-10 22:40 +0200
            Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 20:50 +0200
              Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-06 07:30 +0200
        Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 16:30 +0200
          Re: Limiting internet access by time pv29@gatech.edu - 2016-08-08 01:10 +0200
            Re: Limiting internet access by time Curt <curty@free.fr> - 2016-08-08 09:00 +0200
              Re: Limiting internet access by time pascalv@sdf.org - 2016-08-08 10:30 +0200
                Re: Limiting internet access by time Karol Augustin <karol@augustin.pl> - 2016-08-08 12:00 +0200

Page 2 of 2 — ← Prev page 1 [2]

#170944

On Wed, Aug 10, 2016 at 10:51:03AM -0400, Stefan Monnier wrote:
> > a maximum consumption of about 3W, and has no configuration at
> [...]
> > A typical AP needs 10-20W,
> 
> What kind of AP would consume 20W?  Mine consumes around 5W and that includes
> a 2TB disk attached to it (and spinning).

An Asus RT-N56U needs 30W max. A Linksys EA6900 needs 42W. 

Your 2TB spinning disk probably uses 4-5W when it is awake but
not reading/writing.

> > and has an expected lifetime of 1-4 years.
> 
> Where do you get those numbers?  In my world, if it dies on you before
> 5 years, then it was just a really bad quality AP.

In my world, a warranty defines the expected lifetime. Do you
have any 5 year warranted APs that aren't campus-grade units?

As it happens, I have APs which have outlived their warranty
period... which means that I expect to have to replace them
at any point, and am happy each month that goes by without a
failure. 

-dsr-

[toc] | [prev] | [next] | [standalone]

#170957

>> What kind of AP would consume 20W?  Mine consumes around 5W and that includes
>> a 2TB disk attached to it (and spinning).
> An Asus RT-N56U needs 30W max. A Linksys EA6900 needs 42W.

I'm not concerned about max consumption.  I'm talking about 24/7
consumption (i.e. the impact on the monthly kWh).  These 30W are
probably/hopefully only reachable in *very* unusual circumstances (at
least unusual for a home-router situation).

> Your 2TB spinning disk probably uses 4-5W when it is awake but
> not reading/writing.

No, the 5W I mention above is the consumption as measured by yours truly
on the 110V plug when the disk is spinning (but otherwise idle, as is
the case most of the time) and that includes the power used by the rest
of the machine.

>> > and has an expected lifetime of 1-4 years.
>> Where do you get those numbers?  In my world, if it dies on you before
>> 5 years, then it was just a really bad quality AP.
> In my world, a warranty defines the expected lifetime.

Most consumer products come with the minimum legal warranty simply
because the customers don't care about this part of the specs.  In that
market I don't think it's strongly related to "expected lifetime": they
could make it significantly longer without suffering significantly
higher "return under warranty", but there's no motivation to do so,
because no matter how small it cost it would impose it would still be
higher than the benefit of getting marginally more customers.


        Stefan

[toc] | [prev] | [next] | [standalone]

#170753

On Fri 05 Aug 2016 at 15:49:28 +0000, Mark Fletcher wrote:

> On Fri, Aug 5, 2016 at 11:04 PM Brian <ad44@cityscape.co.uk> wrote:
> 
> > Sticking with the idea of using a systemd service file, the script it
> > runs would check the time and alter the routing table when necessary.
> > Neither cron nor iptables need come into the picture.
> >
> Thanks Brian. My thinking was that although this machine won't be on all
> the time, it will be started and stopped at unpredictable times. I wanted
> to have a situation where if it is brought up during allowed hours, the
> internet works. If it is brought up during not-allowed hours, it doesn't,
> until 9am arrives, at which point it starts working. So if my son gets out
> of bed at 3am and fires up the computer, he gets nowhere (at least until he
> figures out how to hack into my own machine and run an ssh session with X
> forwarding... but if he figures that out without my help I'm almost
> inclined to reward him by turning a blind eye :-) )
> 
> Similarly, if he is surfing away on it at 9pm, well by then he is supposed
> to be at least in the bath if not in bed, so the computer's internet
> connection sets an example by going to sleep...
> 
> If he leaves it on, I want it to connect and disconnect automatically at
> the appropriate times, and if he doesn't, I want it to come up in the right
> state. If I leave a hole in this that can be exploited without strong
> technical skills, I'm confident he'll find it...

Without the root password or sudo he should be unable to influence the
routing. The machine will always come up with a route to the internet
because you are using DHCP. But that shouldn't last for more thn thirty
seconds if we can get systemd to do its stuff.

We'll forget about a fixed IP. DHCP gets you an address and a default
route when it boots. Check the latter with 'ip route'. You want a
default route to the internet between 9am and 9pm but not otherwise.
Consider this script

  #!/bin/bash
  while :
  do
  HOUR=$(date +%H)
  if ((9 <= $HOUR && $HOUR <= 21)); then
     echo "Help with the washingup, tidy your room, make yourself useful."
  else 
     echo "Have a bath. Go to bed."
  fi
  sleep 30
  done

The first echo line would be replaced with

  ip route add default via <gateway IP> dev <interface>

You need this in the event the machine is left on overnight and the
second echo line

  ip route del default via <gateway IP> dev <interface>

is in force.

The script would go in /user/local/bin and be run by a systemd service
file with its Exec directive. You should run the script first and check
that it does do what you want. Altering the "9" and the "21" will help.
You probably want a "one-shot" service file. You're ok with devising
that?

> I could give the box a fixed IP but I have always used DHCP on my local
> network and don't want to disturb my habits more than necessary for this.

It wasn't a important suggested change.

> Also this would get rid of the need for DHCP but wouldn't get rid of NTP
> calls, and then I'd get them vomiting all over the logs when they fail to
> connect. Not a big problem, certainly, but an elegant solution would avoid
> it.

Have the script stop and start the NTP service. Elegant enough?
 
> I didn't mention earlier, and I'm not sure if it is relevant, but the
> computer connects via WiFi to my access point, which is also my network's
> internet gateway -- with an LFS box between it and the cable modem as a
> dedicated firewall. I don't trust the non-free firewall in the AP, although

WiFi or cable shouldn't be a concern. Both set up routing in the same way.

> I have left it on. The rest of my network is not to be subject to this 9pm
> curfew. And I would ideally like connectivity between this machine and the
> rest of my local network to remain even when the internet is denied to this
> machine, so I can do remote maintenance when he's not using the machine,
> for example. If I monkey around with the default routing as you are
> suggesting, does that have any negative implications for connectivity to
> the rest of my local network?

It shouldn't do because you will only be adjusting the route to get off
your network. But that's where testing comes in.

                                Finally, I am afraid I did not understand the
> point you made about how cron can be avoided. If the machine's up when 9pm
> arrives, I want internet connectivity to die so I can prise him off the
> computer and get him to bed. In your idea, how can I make that happen
> without a cron job?

The script run by systemd takes care of what happens at a particular
time. A cron-only solution is possible but I think the systemd way seems
more flexible because the script can be adjusted.

You are after an all-or-nothing solution and iptables is intended for
more finely-grained routing issues. It would probably do the job but
there is more work involved and it's a bugger to debug if the rules are
not quite right.

[toc] | [prev] | [next] | [standalone]

#170770

[Multipart message — attachments visible in raw view] — view raw

On Sat, Aug 6, 2016 at 3:43 AM Brian <ad44@cityscape.co.uk> wrote:

> On Fri 05 Aug 2016 at 15:49:28 +0000, Mark Fletcher wrote:
>
> > On Fri, Aug 5, 2016 at 11:04 PM Brian <ad44@cityscape.co.uk> wrote:
> >
> > > Sticking with the idea of using a systemd service file, the script it
> > > runs would check the time and alter the routing table when necessary.
> > > Neither cron nor iptables need come into the picture.
> > >
> > Thanks Brian. My thinking was that although this machine won't be on all
> > the time, it will be started and stopped at unpredictable times. I wanted
> > to have a situation where if it is brought up during allowed hours, the
> > internet works. If it is brought up during not-allowed hours, it doesn't,
> > until 9am arrives, at which point it starts working. So if my son gets
> out
> > of bed at 3am and fires up the computer, he gets nowhere (at least until
> he
> > figures out how to hack into my own machine and run an ssh session with X
> > forwarding... but if he figures that out without my help I'm almost
> > inclined to reward him by turning a blind eye :-) )
> >
> > Similarly, if he is surfing away on it at 9pm, well by then he is
> supposed
> > to be at least in the bath if not in bed, so the computer's internet
> > connection sets an example by going to sleep...
> >
> > If he leaves it on, I want it to connect and disconnect automatically at
> > the appropriate times, and if he doesn't, I want it to come up in the
> right
> > state. If I leave a hole in this that can be exploited without strong
> > technical skills, I'm confident he'll find it...
>
> Without the root password or sudo he should be unable to influence the
> routing. The machine will always come up with a route to the internet
> because you are using DHCP. But that shouldn't last for more thn thirty
> seconds if we can get systemd to do its stuff.
>
> We'll forget about a fixed IP. DHCP gets you an address and a default
> route when it boots. Check the latter with 'ip route'. You want a
> default route to the internet between 9am and 9pm but not otherwise.
> Consider this script
>
>   #!/bin/bash
>   while :
>   do
>   HOUR=$(date +%H)
>   if ((9 <= $HOUR && $HOUR <= 21)); then
>      echo "Help with the washingup, tidy your room, make yourself useful."
>   else
>      echo "Have a bath. Go to bed."
>   fi
>   sleep 30
>   done
>
> The first echo line would be replaced with
>
>   ip route add default via <gateway IP> dev <interface>
>
> You need this in the event the machine is left on overnight and the
> second echo line
>
>   ip route del default via <gateway IP> dev <interface>
>
> is in force.
>
> The script would go in /user/local/bin and be run by a systemd service
> file with its Exec directive. You should run the script first and check
> that it does do what you want. Altering the "9" and the "21" will help.
> You probably want a "one-shot" service file. You're ok with devising
> that?
>
> > I could give the box a fixed IP but I have always used DHCP on my local
> > network and don't want to disturb my habits more than necessary for this.
>
> It wasn't a important suggested change.
>
> > Also this would get rid of the need for DHCP but wouldn't get rid of NTP
> > calls, and then I'd get them vomiting all over the logs when they fail to
> > connect. Not a big problem, certainly, but an elegant solution would
> avoid
> > it.
>
> Have the script stop and start the NTP service. Elegant enough?
>
> > I didn't mention earlier, and I'm not sure if it is relevant, but the
> > computer connects via WiFi to my access point, which is also my network's
> > internet gateway -- with an LFS box between it and the cable modem as a
> > dedicated firewall. I don't trust the non-free firewall in the AP,
> although
>
> WiFi or cable shouldn't be a concern. Both set up routing in the same way.
>
> > I have left it on. The rest of my network is not to be subject to this
> 9pm
> > curfew. And I would ideally like connectivity between this machine and
> the
> > rest of my local network to remain even when the internet is denied to
> this
> > machine, so I can do remote maintenance when he's not using the machine,
> > for example. If I monkey around with the default routing as you are
> > suggesting, does that have any negative implications for connectivity to
> > the rest of my local network?
>
> It shouldn't do because you will only be adjusting the route to get off
> your network. But that's where testing comes in.
>
>                                 Finally, I am afraid I did not understand
> the
> > point you made about how cron can be avoided. If the machine's up when
> 9pm
> > arrives, I want internet connectivity to die so I can prise him off the
> > computer and get him to bed. In your idea, how can I make that happen
> > without a cron job?
>
> The script run by systemd takes care of what happens at a particular
> time. A cron-only solution is possible but I think the systemd way seems
> more flexible because the script can be adjusted.
>
> You are after an all-or-nothing solution and iptables is intended for
> more finely-grained routing issues. It would probably do the job but
> there is more work involved and it's a bugger to debug if the rules are
> not quite right.
>
>
Thanks for this Brian.

[toc] | [prev] | [next] | [standalone]

#170737

[Multipart message — attachments visible in raw view] — view raw

On Fri, 5 Aug 2016 at 20:00, Lisi Reisz <lisi.reisz@gmail.com> wrote:

> On Friday 05 August 2016 11:40:28 Brian wrote:
> > On Fri 05 Aug 2016 at 00:02:40 +0000, Mark Fletcher wrote:
> > > On a stretch box I have, I want to allow access to the Internet between
> > > the hours of 9am and 9pm and block it between 9pm and 9am. Ideally
> allow
> > > local network access throughout but block Internet access between 9pm
> and
> > > 9am, but I can accept total network blockage in the off times if
> > > necessary.
> >
> > Your ideal is achievable.
> >
> >   ip route del default via <gateway_IP>
> >
> > Plus a cron job.
> >
> > > The machine is used as a desktop, so it is not up all the time. It
> might
> > > be brought up before 9am, in which case it should come up blocked and
> > > unblock at 9am, or it may be brought up after 9am, in which case it
> > > should come up unblocked and block if it is still up at 9pm. Time
> > > precision isn't important.
> >
> > If it came up unblocked before 9am cron could see to it that blocking
> > happens.
> >
> > > An ideal solution would allow dhcp updates, ntp etc to continue but
> block
> > > any normal user access eg web browsing etc.
> >
> > How essential is this? cron could
> >
> >   ip route add default via <gateway_IP>
> >
> > at specific times between 9pm and 9am and then remove the default route.
> > If the machine isn't up all the time it seems unnecessary to me.
>
> Perhaps he wants to stop his children/grandchildren/house guests surfing
> the
> web at 3:00 am.
>
> Lisi
>
> Spot on, Lisi! I recently set up a stretch box for my 12-year-old who's
interested in getting into Android programming, and he quickly developed
the ugly habit of getting up in the middle of the night to watch YouTube
videos of other people playing Wii games... Currently he's on his summer
holiday so it isn't doing much harm, but in a few weeks he'll be back to
school and as a responsible parent I can't let this continue. Simply asking
him to stop doesn't have the desired effect, naturally. My wife is about an
inch away from banning the computer altogether, and I'm trying to find an
acceptable compromise to prevent that...

Mark

[toc] | [prev] | [next] | [standalone]

#170825

[Multipart message — attachments visible in raw view] — view raw

Le 5 août 2016 16:23, "Mark Fletcher" <mark27q1@gmail.com> a écrit :

> On Fri, 5 Aug 2016 at 20:00, Lisi Reisz <lisi.reisz@gmail.com> wrote:

>> Perhaps he wants to stop his children/grandchildren/house guests surfing
the
>> web at 3:00 am.

> Spot on, Lisi!

Hello,
If the computer is not supposed to be connected at all, then maybe:

sudo service network-manager stop

and
sudo service network-manager start

(in cron jobs) would be fine and would do what you wish

Good luck

[toc] | [prev] | [next] | [standalone]

#170830

On 2016-08-07, pv29@gatech.edu <pv29@gatech.edu> wrote:
>
>> On Fri, 5 Aug 2016 at 20:00, Lisi Reisz <lisi.reisz@gmail.com> wrote:
>
>>> Perhaps he wants to stop his children/grandchildren/house guests surfing
> the
>>> web at 3:00 am.
>
>> Spot on, Lisi!
>
> Hello,
> If the computer is not supposed to be connected at all, then maybe:
>
> sudo service network-manager stop
>
> and
> sudo service network-manager start
>
> (in cron jobs) would be fine and would do what you wish

I haven't been following the thread (discussion beyond my technical
reach) but couldn't the little man boot up a live cd or usb drive and
surf his little heart out? Someone talked about targeting the MAC
address of the machine (which I suppose would obviate this workaround).

> Good luck

-- 
Même l’avenir n’est plus ce qu’il était. 
Paul Valéry  

[toc] | [prev] | [next] | [standalone]

#170834

On Mon, 8 Aug 2016, Curt wrote:

> On 2016-08-07, pv29@gatech.edu <pv29@gatech.edu> wrote:
>>
>>> On Fri, 5 Aug 2016 at 20:00, Lisi Reisz <lisi.reisz@gmail.com> wrote:
>>
>>>> Perhaps he wants to stop his children/grandchildren/house guests surfing
>> the
>>>> web at 3:00 am.
>>
>>> Spot on, Lisi!
>>
>> Hello,
>> If the computer is not supposed to be connected at all, then maybe:
>>
>> sudo service network-manager stop
>>
>> and
>> sudo service network-manager start
>>
>> (in cron jobs) would be fine and would do what you wish
>
> I haven't been following the thread (discussion beyond my technical
> reach) but couldn't the little man boot up a live cd or usb drive and
> surf his little heart out? Someone talked about targeting the MAC
> address of the machine (which I suppose would obviate this workaround).

True, however in this case he could also soon or late find how to get 
around using macchanger...

>> Good luck

[toc] | [prev] | [next] | [standalone]

#170841

On 2016-08-08 8:30, pascalv@sdf.org wrote:
> On Mon, 8 Aug 2016, Curt wrote:

>>
>> I haven't been following the thread (discussion beyond my technical
>> reach) but couldn't the little man boot up a live cd or usb drive and
>> surf his little heart out? Someone talked about targeting the MAC
>> address of the machine (which I suppose would obviate this workaround).
> 
> True, however in this case he could also soon or late find how to get
> around using macchanger...
Than the only thing that's left would be whitelisting all the rest of
the mac addresses using iptables (for as long as he won't try changing
the mac addr to something switched off at the time) or RADIUS
authenticated wpa-enterprise wifi network with separate
username/password. Also VLANing his port on the switch + iptables rules
for vlan (eth1.5 for excample). All of this might be even used as
challange mode forcing kid to learn new stuff as he overcomes more
sophisticated measures...

>>> Good luck

-- 
Karol Augustin
karol@augustin.pl
http://karolaugustin.pl/
+353 85 775 5312

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web