Smart Hub 2 - control wifi access open to abuse

[GREYHORSE]

Smart Hub2 isnt that smart.

I have set up wi-fi access restrictions using the my BT app. Using the control wi-fi access.

Restrictions on access by device eg mobile phone, xbox etc for my teenage children. 

Access restrictions set to stop wifi access at bed time 10pm.

Unfortunately both of my kids have worked out if they change the mac address on the android phone or xbox they login again without having to type in the network password and they then have no restrictions.

The BT app now has  now several version of the same device every time the mac address is changed!!

So as quick as I shut the device down my kids change the mac address!

Any advice on how to stop this as I cant see any settings in the Smart Hub2 to stop this.

[Keith_Beddoe]

@GREYHORSE 

There is no answer to that problem, and in fact, IOS devices randomise their MAC address, making access controls using MAC addresses, unworkable on any of the BT home hubs.

The only solution is to use a router which has a firewall which only allows traffic to specific MAC addresses, so if they change the MAC address, they would lose Internet access totally.

I am not sure if there is an option on the home hub controls, to block all devices to start with, then add access rules for specific devices based on their MAC address. If they change the MAC address, then access would be blocked.

MAC address filtering is an option on many routers, which only allow specific MAC addresses to connect to it, all others are blocked. This approach involves creating a whitelist  of permitted devices, and not a blacklist of blocked devices.

[gg30340]

---

@GREYHORSE wrote:

Any advice on how to stop this as I cant see any settings in the Smart Hub2 to stop this.

---

Remove their devices until they learn the house rules.

Any computer savy child will learn via the Internet how to overcome parental controls. You will find it easier to push water up hill than use technology to prevent access to the Internet.

[GREYHORSE]

Unfortunately the Smart Hub2 doesn't have these functions. I believe previous versions did.

[Keith_Beddoe]

---

@GREYHORSE wrote:

Unfortunately the Smart Hub2 doesn't have these functions. I believe previous versions did.

---

Yes, the home hub 1 had this feature, you had to allow access to specific devices.

Perhaps the answer is to turn off the wifi on the home hub, and plug a separate wireless access point into a LAN port of the home hub. Wireless access points normally have MAC filtering options, which only allow specific MAC addresses to connect.

You could in fact use both wireless networks, by changing the wireless password on the home hub, and not revealing it, then use the wireless access point for other users.

Some wireless access points allow multiple SSIDs, each with their own password and MAC filtering.

Using that method would stop the parental controls being defeated, as if they changed the MAC address, they would get no connection.

[GREYHORSE]

@gg30340 Remove their devices until they learn the house rules.

Any computer savy child will learn via the Internet how to overcome parental controls. You will find it easier to push water up hill than use technology to prevent access to the Internet.

Hmm I need to remove and take away every online device, smart phones, xbox, ipads, chromebooks, I'm dealing with teenagers.

I also want to highlight to other users of this hub, that this spoof is a well known playground hack!! Im sure a lot of parents would know that once they had set the restrictions up they can be spoofed.

[Stu_H]

Shame it can’t handle tagged Vlans so you could restrict the limit on one while the other Vlans use separate credentials. 

There’s a lot of ways round it but I don’t think the BT router can really achieve these. You would need to step up to more advanced routers. 

[licquorice]

---

@Stu_H wrote:

You would need to step up to more advanced routers. 

---

And a step down to less tech savvy teenagers! They will always find a way.

[Stu_H]

Teens are clever but without admin rights or the various credentials for the other Vlans they don’t stand a chance .

I run 4 Vlans and an open guest vlan with password locked on a timer based setup. There’s no way they can crack any of it as it’s all based on 64 digit passwords unless they find out the passwords and even then you can create a radius setup for even more security if you really wanted to go over the top.
trouble is to set it up you need to understand vlan tagging and firewalls and that might be beyond the OP as we are into enterprise level setups however a few routers based on home use do have this. 
If there’s no access to credentials then no matter what they try they will not be able to get into restricted Vlans. Even admin log in requires a two factor authentication and isolation on each vlan stops discovery. These setups are very secure and well beyond a simple Mac change. 

[spile]

Dialogue rather than blocking is a far more sustainable and effective approach to this issue.