[SOLVED] Network Switch Direct to Internet??

[DonnieSuits]

Hello,

I have the following setup in my house but need to change it to solve a problem with internet access and not sure if what I want to do will work. Any help would be greatly appreciated.

FIOS Internet - with the following connections:

Verizon ONT box (Basement) connects direct to FIOS wireless G1100 router WAN port (1st floor)
G1100 Router Lan port connects to an unmanaged 8 port switch (located basement next to ONT box)
1 of the Lan ports from the switch is connected to a Linksys MR9000 router setup as an access point (3rd floor) to get WIFI to the 3rd floor rooms

All works OK

Here is the issue - My sons is gaming all day and night and not going to school or doing homework. I setup parental controls on the G1100 router but my son erases them by pressing the factory reset button on the G1100. The internet based parental controls FIOS has also sucks and he gets around them. I have taken the power cord from the router at night when I go to sleep and plug it back in the next morning but my son figured out that if you take the RJ45 cat6 plug out of the ONT box that runs to the G1100 router and then take the RJ45 cat6 Lan wire that runs to his bedroom out of the switch and connect directly into the ONT box you have unfiltered internet direct to his bedroom and bypass the disconnected G1100 router altogether.

I don't want to hear about take the computer away because A - he needs it everyday for Remote school and B - he is 15 and it becomes a physical battle that I no longer want to have every night. I can not lock up the G1100 routerbecause that would kill the wifi signal to part of the house 1st and 2nd floor and I no longer want to unplug the router every night which does not matter because he is bypassing it.

So here is my idea but do not know if it will work:

I read that a managed switch can block access to the internet and also individual websites based on IP and time. This would help with the game play at night (turn off the internet completely by MAC address / IP) as well as during the day by blocking the gaming and chat room sites during school hours. I wanted to know if the following configuration would work to do this on a managed switch.

I will put a 4 inch wide steal bar with square drive screws across the ONT box so it can no longer be opened without a special screw driver. And if need be put a steal cover over the managed switch so it can not be factory reset.

ONT box (basement) connected to the uplink on the managed switch (basement)
Managed switch to both wireless routers 1st and 3rd floor (G1100 and Linksys MR9000) and turn them both into access points only.
Setup the manage switch to control internet access by MAC or IP address

Will this work, going direct from the ONT to the Switch?? Also any suggestions on what brand and model switch I should buy to do this?? I need an 8 port switch.

I know this is ridiculous but avoiding several hours of arguing and physical confrontation is in all of our best interest and my son who was an A student and is now failing high school will hopefully get back on track and get those F's back to A's. REMOTE LEARNING SUCKS!!

Also I can't believe that you can plug directly into the ONT box and get unlimited internet access over lan. If I lived in a multifamily house or apartment building where the ONT box is in the basement or outside I would install a switch and run a Lan to everybody's apartment and split the bill with them to get internet dirt cheap or even free.

 

[USAFRet]

1. Parental controls on the G1100. Does he have the router password? Change that, removing his access.
2. Ethernet capability from the ONT can be totally disabled. Is there a possibility for coax from the ONT to the G1100?
3. Social solution vs tech solution - Stop doing his laundry and cooking for him.
4. Managed switch to restrict by MAC or IP is easily circumvented by an inventive 15 year old.
5. Cut the physical cable to his room. Put his system on WiFi, and the Guest network in the G1100.

 

[Math Geek]

if the switch can be secured and has the right abilities it would work. but ip's and mac's can be changed and if he is determined, he'd get it working. you've already lost the battle and other than shutting it off from outside the house, i'm not sure you can win this no matter what you do. i have fios but never looked into what you can set from the website. that may be the only way if you can set it at verison's level and keep him from getting into the verizon account itself.


he already knows he has won and unless you take back the house, you may as well accept, he'll do what he wants.

 

[DonnieSuits]

Thanks USAFRet, The admin ID and pass code for the router is pointless. Verizon has it printed on the router and when you do a factory reset not only does it wipe the parental controls that have been set it resets the admin ID and password of the router to the default printed on the router. Verizon = Genius I guess.

I wanted to use the Ethernet because I pay for 1GB service and COAX is limited to 700 MBs but Ethernet is 1 GB so I am just hurting myself especially when My wife and I are working from home and I have 2 other kids doing zoom calls to attend classes along with apps open to access docs and presentations from school. With 5 of us online splitting the 1GB connection during the day I would hate to cut my speeds down to 700MBs especially when 2 of us are remoting into the office PC's.

I did read that I could do a complete block of outside domains via a managed switch regardless of IP or Mac. That would be fine I don't play Graal or chat on Discord which is where the issue resides. Just wondering if I could hook the switch directly to the ONT before the wireless router and still get it to work and make the routers access points only. I just did not want to spend $150 to $300 to find out it does not work. I also did not know what switch to buy.

 

[USAFRet]

Yeah, physical access to the G1100 reset button trumps all/most security.
(I have that same device)

I am unsure about the managed switch between the ONT and the G1100.
In this instance, a managed switch is mostly like a router, but with more options.

Possibly someone else will be along with more specific info on this.

 

[Math Geek]

it would have to be a router or at least a layer 3 switch since it is first in line after the ont.

otherwise it won't know how to sort the traffic to the various other routers and such. you pretty much have to cut off access to his pc. blocking an ip or address will easily be defeated with a vpn or proxi. every school kid knows that move already. instead of blocking, you'll want to instead only allow access to his school site during the day. much easier to deny all except a couple addresses than to try and think up every option to block as there are just too many.

not sure about time frames though. never seen that on a switch myself but then i have not seen 20 years worth of options either. mainly i am familiar with cisco stuff which is what i have trained on.

 

[bill001g]

If you are willing to play the nightly game of unplug the cables you could put the ONT in a box and just unplug the ethernet going to the router. It all depends on how determined the kid is. If you just place some cover over it he could just take the screws out. Depends on they have the ont box mounted. Verizon has a plastic box they put the units in to protect them from weather. You should be able to get something similar. It all depends if you could carefully unmount the whole ONT from the wall put in a box and then place the ONT in it leave the cables out the bottom. All you would do is lock it and you could just unplug the ethernet cable and leave it in the locked box.

Even with a fancy firewall you have to protect the internet jack coming into the house.

I will defer to USAF-Ret since he has fios. I think if you ask verizon to use coax rather than ethernet it would force the traffic to have to use the G1100. What I don't know is if you can bypass this with other hardware. If it was a cable modem you could not swap it. Verizon though uses some form of MoCA between the ONT and the router. I am not sure if you can use a standard moca adapter.

You could then mount the g1100 in a box preventing access to the reset button. SInce a nice secure metal box would block the wifi you would then need to plug a AP into the router outside the box to replace the wifi.

Now this assume the G1100 patental controls are strong enough. Most things other than a electronic form of turn the power off at certain times can be bypassed by someone who is determined enough to spoof mac addresses. You can't actually filter content anymore because everything is encrypted. You would have to somehow whitelist only the IP addresses going to say the school to prevent VPN.

Now it is possible to prevent access but you have to use a enterprise solution. It is not that is really expensive it is just complex to do when you are using free software.

You still must solve the issue of how to connect some device to the ont and not allow it to be bypassed.

You would use a small pc to replace the g1100 as the router. You still need the device to provide wifi since using a pc wifi doesn't perform well.

So the 2 solutions that are hard to beat.

1. Use a captive portal like a hotel uses. It blocks all traffic from a mac address until you use a web browser to authenticate. When it does not see traffic for a period of time it forces a reauenticate. This to a point prevents mac spoofing. If you were to actually duplicate the mac of another active machine both machines would work extremely poorly if at all.

2. The next level up from this is to use 802.1x. This is already part of the wifi standard but you can implement it on ethernet ports also. So on wifi instead of a SSID and shared password you must provide a userid and password. This requires setting the wifi to run in radius mode. Ethernet work very similar but you need a managed switch that has the feature. This is how we used to keep lan jacks in common areas secure. This solution is as close to impossible to hack as you can get. There of course is no stopping the hacking of the person, if you made a mistake and he got your userid and password the system is compromised.

The big issue you have with a home user is if you have any of those smart lights etc etc. Those devices will be blocked by these solutions and there really is not way to make them work.

 

[USAFRet]

I am not sure if you can use a standard moca adapter.

Yes you can.
My 100/100 FiOS is coax from the ONT to the G1100. The ethernet plug on the ONT is not enabled at all.

The internet signal is injected into the coax already by the G1100.
A single standard MOCA device will extract that out to a PC on any connected coax cable.

I have a typical Actiontec MOCA to deliver the connection upstairs.
A single one of these:
https://www.amazon.com/Actiontec-Ethernet-Adapter-Service-ECB2500C/dp/B008C1JC4O

 

[bill001g]

More I was concerned if a sneaky kid could use it to somehow bypass the router

 

[USAFRet]

More I was concerned if a sneaky kid could use it to somehow bypass the router

The router is the other half of the MOCA pair, so it has to be in there.

 

[Ralston18]

@DonnieSuits

I am going to go in a different direction: The situation is not a technical problem although there may be some technical solutions.

Overall, my concern is that the problem may actually be beyond technical.

You can only do so much to physically restrict his access to things without, as mentioned, making your own work much more difficult.

The problem is behavioral in many ways and manners.

Especially with grades dropping from A's to F's. And his actions to do (or threaten) anything to get his gaming fix is not a good sign. I am not (full disclosure) a professional with such things but I would label the problem/behavior as "addiction".

Although you probably have more than enough stress to deal with (home schooling, WFH, socially distancing, etc..) you need to face the situation head on and get some help.

Likely tough with Covid in general and hundreds of people (of all ages) getting addicted to games and other online behavior. Or finding other escapes...

Start with the school: teachers, counselors, staff. I would be very surprised if you discover that you are the only parents/family with a similar problem.

Hopefully, someone at the school can provide support or practical guidance on ways to deal with the problem be it full addiction or not.

Or you may know and have other channels of support. Use them all.

Very good chance that once Covid is under control along with some other things life will return to some form of normal. How long that may take is uncertain.

I would not wait.....

 

[gggplaya]

Take away his console and computer. Buy him a low powered 15w TDP processor laptop to do schoolwork, but have very little graphical performance.

No school, no play.
Attend school, then he gets to play.