FAQ: How can I control which network interface is used for network traffic? Like use WiFi in some cases but ethernet in others
The existing firewall on the OS can be used to enable/disable network traffic from specific interfaces
Taking a look at
/etc/config/firewall, you'll notice it has zones that control traffic flow of the network interfaces defined in
By default, the
wanfirewall zone is attached to the
/etc/config/networkyou'll see that the
wwannetwork interface is
apcli0, the Omega's WiFi client interface
We can change the
wanfirewall zone configuration to enable or disable traffic through this interface.
To start, my Omega is connected to WiFi and can ping the internet:
root@Omega-F195:/# ping www.google.com PING www.google.com (188.8.131.52): 56 data bytes 64 bytes from 184.108.40.206: seq=0 ttl=115 time=18.968 ms 64 bytes from 220.127.116.11: seq=1 ttl=115 time=22.639 ms ...
Then, I'll run these commands to REJECT input and output traffic for the
uci set firewall.@zone.output='REJECT' uci set firewall.@zone.input='REJECT' uci commit firewall
Note: these changes can also be made by modifying the
And restart the firewall:
I can no longer access the internet. The WiFi client interface is still associated with the network, but no traffic can go through:
root@Omega-F195:/# ping www.google.com PING www.google.com (18.104.22.168): 56 data bytes ping: sendto: Operation not permitted root@Omega-F195:/# ping www.google.com PING www.google.com (22.214.171.124): 56 data bytes ping: sendto: Operation not permitted
A few notes:
- The default firewall configuration only has zones for the WiFi AP and WiFi Client network interfaces. You'll need to add more zones to the firewall to control the ethernet network interface, or other network interfaces like cellular modems.
- The firewall also supports creating Rules. For a deeper dive into the firewall and rules, take a look at the openwrt firewall documentation: https://openwrt.org/docs/guide-user/firewall/firewall_configuration