How to limit a specific IP address to 2 hours per day?

routerrooter · Thu Apr 06, 2023 5:17 am

I am looking to limit a specific internal IP address of my router to 2 hours of access per day. I have "asked" both Google Bard and ChatGPT but the suggestions they provide don't work. I figured the experts here might know how to set this up in a router running v6.48.2 (stable).

Thu Apr 06, 2023 7:29 am

Kid control.
https://help.mikrotik.com/docs/display/ROS/Kid+Control

(you really thought you would get answers from chatbots, seriously ??)

PS and you might want to consider to upgrade to at least 6.48.6 long term or 6.49.7 stable. Bots didn't tell you that ?

rextended · Thu Apr 06, 2023 11:44 am

I have "asked" both Google Bard and ChatGPT but the suggestions they provide don't work.

"Pay someone to monitor users."

Fantasy Novels don't work in real life...

routerrooter · Thu Apr 06, 2023 4:31 pm

Kid control.
https://help.mikrotik.com/docs/display/ROS/Kid+Control

Kid Control only allows for certain hours per day (noon to 2, etc) as opposed to 2 hours of general usage. I am trying to limit access to 2 hours regardless of when that access starts.

routerrooter · Thu Apr 06, 2023 4:34 pm

I have "asked" both Google Bard and ChatGPT but the suggestions they provide don't work.
"Pay someone to monitor users."

Fantasy Novels don't work in real life...

You would be shocked at what they came back with actually. They provided very detailed ways to use command line and the GUI to make the requested changes that looked like they should work (but didn't!). For instance this is what ChatGPT suggested:

Login to your MikroTik router's GUI interface using your web browser.

Click on the "IP" menu on the left-hand side of the screen, and then click on "Firewall".

Click on the "Filter Rules" tab.

Click on the "Add New" button to create a new filter rule.

In the "General" tab, set the following parameters:
Chain: forward
Src. Address: (enter the specific IP address you want to block)
Protocol: tcp
Dst. Port: 80 (or the port number of the service you want to limit)
Action: accept
Comment: (enter a comment for the rule, if desired)

In the "Extra" tab, add the following parameter:
Timeout: 2h (specify the time limit in hours)

Click on the "OK" button to save the new filter rule.

This rule will allow the specified IP address to access the service (e.g. HTTP) for two hours, after which the connection will be terminated. You can modify this rule to suit your specific requirements by adjusting the source address, protocol, port, action, and timeout parameters.

Below is what Google Bard suggested would work (also did not!)

Log in to your Mikrotik router and go to the IP > Firewall > NAT tab.
Click on the Add button to create a new rule.
In the General tab, set the Protocol to TCP, the Destination Port to Any, and the To Address to the IP address of the device you want to limit.
In the Action tab, select Queue.
In the Queue tab, set the Limit to 2 hours.
Click on the OK button to save your changes.

Once you have created this rule, the device will only be able to access the internet for two hours at a time. After two hours, the device will be disconnected from the internet until the next day.

You can also use this method to limit the amount of time a device can access certain websites or applications. To do this, you would need to create a new rule for each website or application you want to limit. In the Action tab, you would select Application and then select the website or application you want to limit.

rextended · Thu Apr 06, 2023 4:50 pm

ChatGPT is just a means of entertainment, you have to believe in what it tells you, so it writes it and invents it in a plausible way.
Is like watching a science fiction film, it must be at least plausible, but then in reality everything is not always possible...

Can't you see it's all bullshit?

And can't you see that there are invented instructions?
"Timeout" as you mean (2h/day) doesn't exist...

And if for hypotesys that "Timeout" parameter actually exists, it's to limit only THAT link to download that single item...
Every time you open something else the timer would start from zero...

Larsa · Thu Apr 06, 2023 5:11 pm

But there is, just not with accumulated/consumed but only absolute time.

rextended · Thu Apr 06, 2023 5:12 pm

But really? I hope you're joking....

This rule is used to time the validity of the rule, not to count the time elapsed since the first use..............

Larsa · Thu Apr 06, 2023 5:14 pm

Just like I explained (ie "time" not "timeout"). But anyhow, never ever trust ChatGPT to provide correct facts!

rextended · Thu Apr 06, 2023 5:26 pm

Yes, is why
viewtopic.php?t=194143

pe1chl · Thu Apr 06, 2023 5:29 pm

Kid control.
https://help.mikrotik.com/docs/display/ROS/Kid+Control
Kid Control only allows for certain hours per day (noon to 2, etc) as opposed to 2 hours of general usage. I am trying to limit access to 2 hours regardless of when that access starts.

That will always be difficult, because you will not be able to tell the difference between "device is actually being used" and "device is switched on but has been put aside and kid is doing homework".

Thu Apr 06, 2023 5:33 pm

I think some will call this a game of "whackamole"

Kids (if we're talking about kids here) nowadays will ALWAYS find ways to circumvent restrictions. And then you have new problems to solve when raising new barriers.
Proper education and trust should be more suitable, I think.

If school results are sufficient and kid spends 4 hours a day on smartphone or computer and plays in 2 sports teams weekly, I wouldn't care.
As an example...

routerrooter · Thu Apr 06, 2023 5:35 pm

ChatGPT is just a means of entertainment, you have to believe in what it tells you, so it writes it and invents it in a plausible way.
Is like watching a science fiction film, it must be at least plausible, but then in reality everything is not always possible...

Can't you see it's all bullshit?

And can't you see that there are invented instructions?
"Timeout" as you mean (2h/day) doesn't exist...

And if for hypotesys that "Timeout" parameter actually exists, it's to limit only THAT link to download that single item...
Every time you open something else the timer would start from zero...

I hear you loud and clear, and I am not advocating for any of these AI services in this capacity. I am simply suggesting that I couldn't figure out how to do this on my own, and after searching far and wide in many forums I figured I would give the AI a shot. It completely blew it as you pointed out by asking me to configure settings which don't exist. So now that we all agree AI can't help, is there actually a way to do this?

routerrooter · Thu Apr 06, 2023 5:36 pm

Kid Control only allows for certain hours per day (noon to 2, etc) as opposed to 2 hours of general usage. I am trying to limit access to 2 hours regardless of when that access starts.
That will always be difficult, because you will not be able to tell the difference between "device is actually being used" and "device is switched on but has been put aside and kid is doing homework".

I am fine breaking this down however it is needed. Can a timer be set the moment a packet is sent/received? He will need to understand that "power on" means the timer is ticking, and I have no issue with enforcing that.

routerrooter · Thu Apr 06, 2023 5:39 pm

Would this be easier to do if it was the MAC address of the device being limited to 2 hours per day? Sorry for all the questions, I just feel there must be a way to do this!

Thu Apr 06, 2023 5:41 pm

Hotspot might be able to handle that ?

pe1chl · Thu Apr 06, 2023 5:41 pm

Sure you can set a DHCP client script that fires when the device connects to the network. It is also possible in DHCP client to add the device to an address list.
Then you can schedule a task 2 hours later that blocks the access for that device.

rextended · Thu Apr 06, 2023 5:46 pm

An easier way???

When you are at home and your smartphone is connected to wifi,
also all devices can register wifi,

When you are not at home, so your smartphone is not registered,
wifi is not available for other devices without permanent authorization.

So when you're at home and see the finished homework, you can let the child play with the internet...

Of course, it was an example, if you have to start counting the hours it can be done,
but it's terribly complicated...

optio · Thu Apr 06, 2023 6:37 pm

Kid control.
https://help.mikrotik.com/docs/display/ROS/Kid+Control
Kid Control only allows for certain hours per day (noon to 2, etc) as opposed to 2 hours of general usage. I am trying to limit access to 2 hours regardless of when that access starts.

Is that 2 hours needs to be accumulated in current day or just allow 2 hours period after first connection in current day?

rextended · Thu Apr 06, 2023 6:40 pm

2 hours of access per day

Probably thats'it..

Total 2 cumulative hours, every 24 hours.
Maybe the counter shouldn't restart at a time like 24:00 otherwise it would "surf" for 4 hours in a row... (and nothing for the remaining hours of the day)

optio · Thu Apr 06, 2023 6:54 pm

Total 2 cumulative hours, every 24 hours.
Maybe the counter shouldn't restart at a time like 24:00 otherwise it would "surf" for 4 hours in a row... (and nothing for the remaining hours of the day)

But then you need to detect which traffic needs to be accumulated as active time because devices are generating trafic on idle (background services, push...). This will be hard to accomplish, unless to cumulate dhcp lease time, then it will be cumulative hours of assigned device on dhcp, which means for home static devices (eg. computer connected over wire) it will worn out 2h immediately after reset if they are always plugged and powered.

rextended · Thu Apr 06, 2023 6:58 pm

I don't think it has to be extremely accurate to the minute, and nowadays with all the parasitic traffic,
it's obvious that the device has to be completely turned off,
otherwise the count continues even if it's not being used by the user (but the device it using itself) ...

A DHCP lease with expire time of 5 min can do the trick.
Just count the total time that the lease is still active on the day.

optio · Thu Apr 06, 2023 7:11 pm

A DHCP lease with expire time of 5 min can do the trick.
Just count the total time that the lease is still active on the day.

Then lease script can track time by

leaseActMAC=<device MAC>

into some time tracking global variable, on next lease if time is expired it will need to create DHCP static lease entry for that device MAC with some bogus IP. Scheduler also needs to be created to reset global variable and remove static lease on start of a day.

rextended · Thu Apr 06, 2023 7:14 pm

As already writed (but until now I not have on mind what)
the scheduler must not be executed at midnight for the risk to leave the device operative 4h from 22:00 to 02:00

pe1chl · Thu Apr 06, 2023 7:17 pm

The kid is likely supposed to be asleep at that time.

rextended · Thu Apr 06, 2023 7:18 pm

supposed....

We've all been children, then teenagers, etc... we don't kid ourselves

optio · Thu Apr 06, 2023 7:18 pm

Also add-arp shuld be enabled for DHCP interface to avoid using static IP's.

rextended · Thu Apr 06, 2023 7:20 pm

Also add-arp shuld be enabled for DHCP interface to avoid using static IP's.

At this time, is really a child?

optio · Thu Apr 06, 2023 7:22 pm

At this time, is really a child?

Who knows... you are underestimating AI bots recommendations

optio · Thu Apr 06, 2023 7:26 pm

We've all been children, then teenagers, etc... we don't kid ourselves

My dad had simple solution - turn off fuse for power sockets in my room (no on battery internet devices in my time)

Larsa · Thu Apr 06, 2023 8:46 pm

A variation on @pe1chl model that more closely reflects the OP's need to check for "consumed time" could be to check the devices for traffic with a 1 minute interval using "kid-control" and a script which @rextended probably already has up in his sleeves.

Activate a monitor: "/ip/kid-control add name=Monitor mon=0s-1d tue=0s-1d wed=0s-1d thu=0s-1d fri=0s-1d sat=0s-1d sun=0s -1d"
Create an address list of devices and a firewall rule per device.
Match the device ether from the address list with "/ip/kid-control/device" and compare traffic per minute.
When the time spent exceeds 120 minutes, enable the firewall rule for the affected device that prevents internet access.
Reset after a certain time and start over from point 3.

--

Done, easy-peasy!

routerrooter · Thu Apr 06, 2023 10:16 pm

I don't think it has to be extremely accurate to the minute, and nowadays with all the parasitic traffic,
it's obvious that the device has to be completely turned off,
otherwise the count continues even if it's not being used by the user (but the device it using itself) ...

A DHCP lease with expire time of 5 min can do the trick.
Just count the total time that the lease is still active on the day.

Correct, I am trying to track and limit two hours of usage per 24 hour period. The simplest way to think about this is to assume the timer starts as soon as the PC in question boots up.

routerrooter · Thu Apr 06, 2023 10:18 pm

A variation on @pe1chl model that more closely reflects the OP's need to check for "consumed time" could be to check the devices for traffic with a 1 minute interval using "kid-control" and a script which @rextended probably already has up in his sleeves.

Activate a monitor: "/ip/kid-control add name=Monitor mon=0s-1d tue=0s-1d wed=0s-1d thu=0s-1d fri=0s-1d sat=0s-1d sun=0s -1d"

Create an address list of devices and a firewall rule per device.

Match the device ether from the address list with "/ip/kid-control/device" and compare traffic per minute.

When the time spent exceeds 120 minutes, enable the firewall rule for the affected device that prevents internet access.

Reset after a certain time and start over from point 3.

--

Done, easy-peasy!

This is good but seems that I need to manually watch the consumption and then take action if I am reading it correctly? Ideally this would run on its own, whether I am at work or out at the store, to ensure the MAC or IP can't access the internet more than 2 hours in any given 24 period. Basically I don't want to have to manage this, I am looking for "set it and forget it" kind of thing.

reinerotto · Fri Apr 07, 2023 9:29 am

As mentioned already, hotspot functionality should do it. macauth + radius "daily session time".
I am writing "should do it", because standard MT hotspots are not so advanced like coova-chilli hotspots, running on openwrt.

Fri Apr 07, 2023 10:50 am

...I have "asked" both Google Bard and ChatGPT but the suggestions they provide don't work. I figured the experts here might know how to set this up in a router running v6.48.2 (stable).

I've checked the date of the post ... i wished it was the 1st of April. It wasn't.

routerrooter · Fri Apr 07, 2023 6:15 pm

As mentioned already, hotspot functionality should do it. macauth + radius "daily session time".
I am writing "should do it", because standard MT hotspots are not so advanced like coova-chilli hotspots, running on openwrt.

Can you please explain in further detail? This is a wired connection I am trying to manage if that helps.

routerrooter · Fri Apr 07, 2023 6:22 pm

I do see these time settings, can this be the key?

Screenshot 2023-04-07 at 11.19.57 AM.png

pe1chl · Fri Apr 07, 2023 6:32 pm

Check the settings under "IP->kid control", put settings like the above to keep stats on all local devices using internet.
Now you can look in the "devices" tab of that page and see all your devices and how much data they consume.
You can even make them "static" and assign a name to them (when it isn't already obvious from the hostname).
Now the creative work starts, because you want something that this kid control does not support: a 2-hour window per day.
So you will need to write a script that gathers data from here and adjusts the firewall. When your requirement was "he can use the internet each day from 18:00 to 20:00 only" then kid control could already do it by just configuring that time range.

routerrooter · Fri Apr 07, 2023 6:36 pm

Check the settings under "IP->kid control", put settings like the above to keep stats on all local devices using internet.
Now you can look in the "devices" tab of that page and see all your devices and how much data they consume.
You can even make them "static" and assign a name to them (when it isn't already obvious from the hostname).
Now the creative work starts, because you want something that this kid control does not support: a 2-hour window per day.
So you will need to write a script that gathers data from here and adjusts the firewall. When your requirement was "he can use the internet each day from 18:00 to 20:00 only" then kid control could already do it by just configuring that time range.

The bold part above is the issue as I can't figure it out.

pe1chl · Fri Apr 07, 2023 7:21 pm

There is no ready-made solution in MikroTik routers for what you want, it will require programming. When you cannot figure it out and others don't step in, that is where it ends.

Fri Apr 07, 2023 9:02 pm

3th time : hotspot

routerrooter · Fri Apr 07, 2023 11:30 pm

3th time : hotspot

Can you be more specific?

rextended · Fri Apr 07, 2023 11:53 pm

I'll be very specific:
If you don't find someone who practically builds for you this solution from scratch, guiding you hand in hand,
you have to study and arrange everything by yourself, maybe finding something ready (I don't know if there is) here on the forum.

Often these comments of mine are stimuli for others, just for the sake of contradicting me, so maybe someone can help you in this endeavor.
( It's not the first time I've written so on purpose, even if it's the truth...

)