Disable hotspot login from some IP

Hey people,

  1. How to disable some hotspot logins from some IP-address?
    (i.e. I want to disable ‘user1’ hotspot login from X.X.X.X IP but ‘user2’ login must be enabled from this IP!)

  2. How to disable some hotspot login from some MAC? (as above).

Thanks.

One of the option is to use ‘ip binding’, where you can specify ‘type=blocked’ for the specific IP address(‘address’) or MAC-address(‘MAC-address’).
You can specify ‘address’, ‘mac-address’ for the HotSpot user, then login will be possible only from specified IP/MAC address.

If I use the IP-binding I can define only one IP/MAC per account.
There is a ploblem because login must be possible from several IP simultaneously - it’s ‘shared’ account. How to allow login to ‘shared’ account from one IP-list and disable login from another - that’s the question.

Thanks.

So now I think that MT can’t do it because there is no any ideas at all!

You can specify ‘range’ on ‘/ ip hotspot ip-binding’,
/ ip hotspot ip-binding add address=
IP address of client
Address ::= A.B.C.D[-A.B.C.D |/00..32 |/A.B.C.D ] (IP address range)

E.g. ‘/ ip hotspot ip-binding add address=192.168.100.1-192.168.100.10’.

But there is another one trouble: this way allows block (or accept) all logins to hotspot-server from same IP/MAC. But I need to disable only ‘shared’ hotspot account from this IP.

E.g.:

  • from ip-list1 (192.168.1.10-192.168.1.20) ‘shared’ hotspot login is allowed, all another hotspot logins are allowed too.
  • from ip-list2 (192.168.1.21-192.168.1.100) ‘shared’ hotspot login are disabled, all another hotspot logins are allowed.

Basically, how to set up IP-filter for each hotspot account and then (after checking some parameters while login requesting) allow or disable login?

I think you can specify ‘IP address’ or ‘MAC-address’ for the specific ‘ip hotspot user’, that only specific IP/MAC-address will be used for the specific HotSpot user.

Some of hotspot accounts are ‘shared’ therefore I can’t bind it to single IP/MAC. Hotspot user address can be ‘single IP’ only, not IP-list.