How to set up "No access to USB storage for unregistered devices"?

[Dmitry Andrievsky]

I wanted to allow usage of local network and USB drives in particular only to devices I know, to registered ones.

So that guests can go to the internet through my WiFi, but not to USB drives.

Could you please advise how and what should I configure? 

 

Изменено 8 июля, 2021 пользователем Dmitry Andrievsky

[Werld]

14 минуты назад, Dmitry Andrievsky сказал:

I wanted to allow usage of local network and USB drives in particular only to devices I know, to registered ones.

So that guests can go to the internet through my WiFi, but not to USB drives.

Could you please advise how and what should I configure? 

 

https://help.keenetic.com/hc/en-us/articles/360000490820-Guest-network-

[Dmitry Andrievsky]

4 hours ago, werldmgn said:

https://help.keenetic.com/hc/en-us/articles/360000490820-Guest-network-

Thanks, guest network is great solution for, well, guests, but sometimes (at least once for me in one month) there are guys who bruteforce wifi key. 

While I received the notification for that one and banned the guy from the internet, it would be beneficial if I was sure that the guy would not use LAN resources (even if used internet), so I am a bit more relaxed about such bruteforce guys.

[Werld]

19 минут назад, Dmitry Andrievsky сказал:

Thanks, guest network is great solution for, well, guests, but sometimes (at least once for me in one month) there are guys who bruteforce wifi key. 

While I received the notification for that one and banned the guy from the internet, it would be beneficial if I was sure that the guy would not use LAN resources (even if used internet), so I am a bit more relaxed about such bruteforce guys.

You can use Wireless Access Lists. By creating a whitelist of your devices, you block access for all clients that are not in the list.

[Le ecureuil]

Используйте wpa-eap, тогда не подберут. Или на основном выключайте wifi.

Если серьезно, то защиты после того как злоумышленник прошел аутентификацию по wifi внутри одного сегмента сделать невозможно. Он всегда сможет сменить мак, заспуфить arp и вообще сделать кучу всего. Потому нужна физическая изоляция в таком случае: отдельный сегмент.