How to control a new device on the ignite wifi apps

[Cindy8]

I recently bought iphone12 for my son , however I wanted to turn off wifi at 10 pm on his device. But it doesn’t work . I have been using the ignite wifi apps to control other devices’ wifi time , set up limit time . It works well . Why can’t I put control on this new device . I have already reset the internet network everything. Still can’t make it work . Pls feel free to leave me some advice .

***Edited Labels***

[Datalink · Accepted solution]

@Cindy8 disable the MAC address randomization on your son's iphone:

https://www.google.com/search?q=disable+iphone12+mac+randomization&oq=disable+iphone12+mac+randomiza...

After the phone has been restarted, you might have to delete the existing profile for your son's iphone and recreate a profile in the modem's profile settings.  I would expect that the current MAC address in use by the phone won't match the profile's MAC address, hence the requirement to delete and recreate the profile if there isn't a method of updating or changing the MAC addresses contained in the profile. 

The one problem here is whether or not your son has access to the iphone's settings.  If so, he could simply turn on MAC randomization.  If so, its time for a one way parent to son conversation.  Turn on MAC address randomization .... good by phone.

[Cindy8]

You are absolutely right ! It works by following your structures

[Cindy8]

However I won’t be able to control his wifi time by using this apps? He can just simply turn it back on for the private address on the setting . Why does it happened only on this device not others ?

[Datalink]

Do you mean, why does this happen on his iphone?  If that's the question, its because Apple has implemented a MAC address randomization scheme to prevent users from being tracked from wifi site to wifi site, and by the same Wifi sites if the phone encounters the same Wifi site again and again.  This is a privacy issue which is legitimate, but, it presents real problems for parents trying to limit their kids Wifi access. 

Does the iphone have an Admin .... User account structure whereby the parents run the admin account, with control over MAC address randomization, while the User account has access to fewer settings?

Here's a couple of interesting quotes from two sites:

https://support.apple.com/en-ca/guide/security/secb9cb3140c/web

...."Because a device’s MAC address changes when disconnected from a Wi-Fi network, it can’t be used to persistently track a device by passive observers of Wi-Fi traffic, even when the device is connected to a cellular network. Apple has informed Wi-Fi manufacturers that iOS and iPadOS Wi-Fi scans use a randomized MAC address and that neither Apple nor manufacturers can predict these randomized MAC addresses....."

https://www.techrepublic.com/article/how-to-manage-or-disable-mac-randomization-in-ios-and-ipados-14...

..." Turn off the private address feature

While there are some potential solutions to mitigate the effects of MAC randomization on your networks, many of these solutions are site-specific, depending almost exclusively on how your particular network is set up.

For a more user-centric solution to resolving this issue locally, users can simply go to Settings, Wi-Fi, then tap on the wireless network they are trying to connect to, and toggle Private Address Off. Do note that the private address feature is one that works per-network, so if there are 20 different saved networks on the device, the user will need to manually toggle off the setting once for each network. The good news is that not every network may require a private address to be turned off, so it only needs to be done on those that are being affected by connectivity issues.

For a holistic solution to resolving this issue remotely, devices that are enrolled in MDM solutions can create a configuration profile using the Wi-Fi payload to specify the name of the wireless network they wish to modify settings on, and toggle on the setting named "Disable association MAC address randomization." This will change the settings of the named SSID and disable private addresses for that network simultaneously. The configuration profile may include additional payloads within it disabling MAC randomization for multiple SSIDs."

So its possible to turn off MAC Address randomization for specific networks, including the home network and leave randomization on for any other Wifi site.  Buried in those sites or others is a tidbit, indicating that IOS will generate a new MAC address every 24 hours.  So, when its enabled, a new MAC address is generated every day, at some point in the day, thereby defeating any parental controls, which are usually based on the device MAC address.  

Fwiw, Android phones apparently do this as well but I think that its probably disabled, selectable to enable if the user prefers to actually use it.  

[CP211]

I have a similar problem to Cindy, where my teens just change the MAC address of their computer (a nice easy setting in Windows 10), and voila they can bypass time restrictions. I have the Technicolor CG4140COM modem, rev 2.2 and Firmware CGM4140COM_4.8p9s1_PROD_sey.  Do any of the Ignite Wifi Router/modems have the ability to allow on SPECIFIC MAC addresses to connect?

Is there a way to disable the WPS button on the modem, and (ideally!) to hide the wifi SSID?

The reason I ask is that my solution is to buy a router which has better parental/network controls, which will let me configure it to only allow certain MAC addresses to connect. However, if the teens then go and press the WPS button, they can connect directly to the modem, and bypass the more secure router. THEN they use VPN to be able to bypass the profile-specific 'sleep' times that are set.

This will also improve control due to the abysmal implementation of the 'PAUSE' feature.

Any help (other than 'control your teens devices') is welcome...

Chris

Chris

[RogersTony]

Hello, @CP211

We appreciate you posting your concern to the community.

I can understand how important it is to manage your kids' screen time and internet usage. The parental controls are based on Mac address so if they are changing the Mac address of their devices or using a Mac randomization feature then the parental controls may not work as intended on those devices. 

You can disable WPS in the gateway modem admin settings. Ensure you are connected to the modem via Wi-Fi or Ethernet. Open a web browser and then navigate to 10.0.0.1. The default username is "Admin" and the default password is "password". On the left-side menu select "Connection" then select "Wi-Fi" from the drop-down options that appear. In the section labelled "Private Wi-Fi Network" click on "Add Wi-Fi protected setup (WPS) client" There should be an option to disable WPS from this menu.

If they are using a VPN connection then the parental control options may not work as intended. Outside of simply taking away their devices when you don't want them to use them, you can easily change the Wi-Fi network name and passphrase of the Gateway modem remotely using the Ignite Wi-Fi Hub. They won't be able to access the modem without the login credentials that you can control via the app.

I hope this helps!

RogersTony

[CP211]

Thank you very much!!!!

By opening the Modem Admin on the web browser, I am able to perform the actions I think that I need to do to secure my network.

I can disable WPS, and I can have the router only allow certain MAC addresses to work. I have more experimenting to do (whether or not I use the modem in Bridge mode, which is a very obvious setting), but things are looking very positive so far.

Thank you for your help!  I do wish that the Ignite App had some of this functionality, though!

Chris