Automatically quarantine (block) any device caught hotspotting, and how to track those blocks right from a custom dashboard feed.
Here is how to upgrade your detection script to automatically quarantine (block) any device caught hotspotting, and how to track those blocks right from a custom dashboard feed.
Step 1: Upgraded Script (Auto-Block Offenders)
This updated script dynamically injects the offending device’s IP address into a specialized pfSense firewall blocklist (an Alias table named Hotspot_Blocklist) for a set penalty period (e.g., 2 hours).
- Update or replace your /root/hotspot_alert.sh file with the following code:
bash #!/bin/sh # pfSense Hotspot Auto-Block & Alert Script AUTHORIZED_TTL=65 LOG_FILE="/var/log/filter.log" ALERT_LOG="/var/log/hotspot_alerts.log" BLOCK_ALIAS="Hotspot_Blocklist" echo "Monitoring logs for hotspots. Auto-blocking enabled..." clog $LOG_FILE | while read -r line; do if echo "$line" | grep -q "ttl $(($AUTHORIZED_TTL - 1))"; then SRC_IP=$(echo "$line" | awk -F',' '{print $12}') TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S") # Skip blank extraction errors [ -z "$SRC_IP" ] && continue # Check if IP is already blocked to avoid redundant rule reloads if ! pfctl -t $BLOCK_ALIAS -T show | grep -q "$SRC_IP"; then # Dynamically push IP to the firewall block table pfctl -t $BLOCK_ALIAS -T add "$SRC_IP" ALERT_MSG="[BLOCK SYSTEM] $TIMESTAMP - Device $SRC_IP blocked for unauthorized hotspotting." echo "$ALERT_MSG" >> $ALERT_LOG # Send notification to admins /usr/local/bin/php -r "require_once('notices.inc'); file_notice('Hotspot_Block', '$ALERT_MSG', 'Network Security', true);" # Optional: Schedule an auto-unblock command after 7200 seconds (2 Hours) (sleep 7200 && pfctl -t $BLOCK_ALIAS -T delete "$SRC_IP") & fi fi done
Use code with caution.
Step 2: Create the Firewall Quarantine Rule
For the script to successfully drop internet traffic for the offender, pfSense needs an explicit firewall rule linked to that table.
- Navigate to Firewall > Aliases > IP tab.
- Click Add to create a new alias:
- Name: Hotspot_Blocklist (Must match the script spelling exactly)
- Type: Host(s)
- Description: Emptied/populated automatically by background script.
- Click Save and Apply Changes.
- Navigate to Firewall > Rules and select your LAN (or user-facing) tab.
- Click Add (Up Arrow) to position this rule at the very top of the list.
- Configure the rule:
- Action: Block or Reject
- Interface: LAN
- Protocol: Any
- Source: Single host or alias ➔ type Hotspot_Blocklist
- Destination: Any
- Description: Custom Quarantine Rule for Tethered Devices.
- Click Save and Apply Changes.
Step 3: Display Live Logs on Your pfSense Dashboard
You can monitor blocks in real-time by embedding your custom alert log directly onto your home screen using the native Text Widget.
- Go to your main pfSense Dashboard homepage.
- Click the Available Widgets (+) button in the top menu bar.
- Select and add the Text Widget to your dashboard.
- Click the Wrench icon on the newly added Text widget to configure it.
- Paste the following PHP/Shell command into the text box to display the last 5 entries of your block history:text<pre><?php system('tail -n 5 /var/log/hotspot_alerts.log'); ?></pre> Use code with caution.
- Set the Update Interval to 10 seconds (or your preference).
- Click Save.
Now, whenever an employee attempts to host a hidden wireless network, their device will lose network privileges within seconds, and their details will immediately print to your central monitoring screen.
If you want to explore how to white-list specific devices (like executive laptops or dedicated routers) so the script skips over them entirely, or is the infrastructure set up to your liking... Just let us know.