MikroTik kid-control: limit Internet access in RouterOS

[@PosiP]

now my kids know how to change their MAC address.

[@wreckedzilla]

haha D

[@FelixFriebel]

I‘ve configured the router at my parents house to only serve static dhcp-leases. This way the smartphone from my little brother won‘t get an ip address when he tries to use a local administrated mac address. This works for now, because he doesn’t know how to configure a static ip address.

[@ellenorbjornsdottir1166]

was worth it.

[@TheNetworkBerg]

Nothing like running your serious ISP equipment and having heavy duty CCRs in your core network and showing your Cisco and Juniper friends how awesome MikroTik is and they happen to see this Kid Control feature and they ask "Uhhhh what is that?" :C I know this feature is more for home users, and I appreciate MikroTik making all features available on all platforms! Though personally I would love to see you bring more of those amazing Routing & Switching features out instead of Kid Control.

[@Tad3j]

Well, thank you for the video, however! Since everybody knows that the phones use MAC randomization, and is turned on by default, as Windows and IOS too, we would like to know, how can we control kids, with various different MAC addresses? I saw Ubiquiti UDM that does not loose the device and knows anytime which MAC addresses belongs to which device. Will there be any update to the kid-kontrol, regarding this MAC randomisation, if we just leave out disabling random MAC addresses?

[@DumitruBodencov]

I use static DHCP leases and no pool but static-only option and address lists for inet access, so you can change your mac as much as you want but if it is not the one I set - no internet. And I turn off mac randomization for my wifi on my kids' devices.

[@mikrotik]

Not really true. iOS changes it for each AP, but in your MikroTik router it will always be the same. It will change it for the next AP. Anyway, kid control works with latest iPhones, try it

[@Tad3j]

@@mikrotik Thank you! I wil! try! What about Android devices?

[@MartinPuedes]

The main issue I have this control seems to be based on the presumption that the kids will own a device, and that's what you'll be setting. Sometimes kids share devices, and due to this being device based, it's not possible to connect it to the user that's logging into the network, and not as easy to keep the kids control moving about that house, say for when they want to use the TV in the living room or whatever else is more general use.

[@speakstruth7742]

I used Kid Control but it's not denying access when plugged into ethernet. How do I make it apply to wifi and ethernet connections?

[@mikrotik]

You must add each MAC address to the "kid" profile. Each interface needs to be separately added.

[@HSOwUJNwcYJVTpSy]

Much better approach for Kid controll: Separate VLANs for parents & kids and dedicated queues with max up & download

[@cbknaup]

How are you setting this up?

[@HSOwUJNwcYJVTpSy]

@@cbknaup e.g.: 1 SSID for parent with dedicated VLAN + 1 SSID for kids/guest also with dedicated VLAN. For kids/guest VLAN you could set up queues with bandwith limitations.

[@jamess1787]

@@cbknaup different wifi networks that get tagged differently. You can also over complicate it by doing Mac/vlan association (PITA)

[@kalobyte]

from my expirience with parental control - the customers just want to block the internet with one button on smartphone for kid's device and this can do only asus app (and time rules too)

[@JUAN199062]

good principle but most wifi devices these days make use of randomised mac addresses,so how is it going to play off then?

[@mikrotik]

Yes, but they are randomized only once per Wi-Fi AP, so this method works

[@mc4ever]

Thanks for the video, I'm using Mikrotik for a long time, but recently figured out that my kid outsmart the router by using ip6, the kids control cover only the ip4, sadly! How I can add even manually the firewall role based on MAC address on the ip6 or hopefully Mikrotik will have another/better suggestion for my trouble? Thanks!

[@mikrotik]

The quick fix is to disable ipv6

[@djsasha78]

That's good thing. But I've a question: how I can disconnect a user from Internet when he uses a large amount of traffic? Perhaps, is there the script for this situation?

[@jurajvantuch9636]

Hello, this question is not related to this topic, but for me very interesting and quite important. Are you planning some new version of CRS326-24G-2S+RM in near future ? Classic enterprise switch, for example with 2 or 4 SFP+ ports? Thanks a lot for reply.

[@cbknaup]

Can Kid Control also limit the Rate UP too?

[@FelixBank]

This works great. Is there a way to block LAN access at these times you set?

[@RB01-lite]

Not with this method, you would have to use some script for that.

[@mlebd]

All modern devices change MAC dynamically by default (on iOS it cannot be disabled)

[@mikrotik]

Not really true. iOS changes it for each AP, but in your MikroTik router it will always be the same. It will change it for the next AP. Anyway, kid control works with latest iPhones, try it

[@KonstantinovAG]

This tool look devices on ISP interface and it's can't be disabled. And for phones - so, just off wifi?)))

[@nelsonlim5189]

alternative, set different ssid/vlans for kids with dns requests redirected to kids friendly dns server

[@stenbrunnstrom8087]

Nos usable iPhones changes MAC adress all the time, better if it can run a sctipt

[@mikrotik]

That’s not true. For same wireless router, the iPhone doesn’t change MAC. This feature works

[@PetrKrenzelok]

I am sorry, but this is a bit messy and overengineered? Why would anyone distinguish the time unlimited vs limited here? All you want is to allow access, or not. Also - why do you create a firewall rule for each device of particular "kid" group? Address list would just do it and one rule would be enough? Firewall rules allow time limitations too.

[@Gr8thxAlot]

I love this feature. My kids don't. 😀