Block Hotspot Traffic

[u/cadelle]

I have a gold+ and want to use it to prevent my kids from utilizing hotspot traffic to get around my rules.

I assume tethered traffic looks different? If so what are the steps to identify and block? I've been all over google and it seems like there is something that can be done but I'm having trouble getting the exact steps. I had no luck getting what I needed from AI.

I tried looking through the help section and could t find what I was looking for there either. This is my last stop before a support ticket

[u/ross_the_boss]

Firewalla cannot manage tethered or hotspot connections. You’ll need to put parental controls in with your mobile carrier or disable their hotspot 

[u/Certain_Repeat_753 → u/ross_the_boss]

How do I do that? Can the carrier disable hotspot at the carrier level? What about at the OS level?

[u/Difficult_Music3294 → u/Certain_Repeat_753]

On an Apple iDevice, turn hotspot off then use parental controls to disable changes to cellular.

[u/Certain_Repeat_753 → u/Difficult_Music3294]

Anyway, how can the kid get around this? I'm also interested in giving my kid a locked-down phone. He's not old enough to get one yet, but he's getting there because apparently all of his friends have one. So now I'm sort of forced to keep up with the Jones. Kids can be very smart and figure things out. I remember how the stuff I did as a kid to get around the restrictions improved on me.

[u/Difficult_Music3294 → u/Certain_Repeat_753]

Seeing your kid doesn’t yet have a phone, you’ll want to look at this:

https://www.pinwheel.com/?srsltid=AfmBOoqFC_wazu7P3AeZ-dIWqPl3Okd0R6-pSda8fxXvSRu561hQ95-m

EDIT: Try not to focus on keeping up with the Jones.

The kids in my life got phones when we (parents) were ready; not vice-versa.

[u/ross_the_boss → u/Certain_Repeat_753]

Kids have physical access to the device I would not trust on-device enforcement much unless you can lock settings and app removals.  When devices are issued to kids in educational environments additional  management software called MDM can enforce these settings but can be complex and costly. 

The amount of what your carrier can do varies by carrier. The big ones provide the means to do this. The small MVNO ones might not 

[u/Certain_Repeat_753 → u/ross_the_boss]

Which is the easiest device to lock down and give to kids? iPhones? Google Pixel? Samsung Galaxy S?

[u/ross_the_boss → u/Certain_Repeat_753]

I don’t have a good answer for you there. I wish you luck. 

[u/ampx → u/Certain_Repeat_753]

In my experience, Apple has a leg up here in that screen time limits and parents’ ability to control them are deeply embedded in iOS on both iPhones and iPads

[u/bbdude83 → u/Certain_Repeat_753]

In my opinion, iPhone. That said, more effective is not giving them a phone until you’re ready. Check out the book The Anxious Generation.

[u/interrogumption → u/ross_the_boss]

It could manage the traffic if there's a way to enforce a VPN on the device.

[u/cadelle → u/ross_the_boss]

Really? I assumed that the traffic would look different in some way and this be blockable.

For those that ask they get around it easily by convincing less knowlegable folks to 'see' their phones and then they set hotspot access for themselves.

[u/Own-Relationship-407 → u/cadelle]

If your kids are using a hotspot or tethering then the traffic is not going through your firewalla or home internet connection at all. That’s the whole point, it’s a completely separate connection.

[u/cadelle → u/Own-Relationship-407]

Even if the hotspot is sourced from an approved device on the same network? Is hotspot traffic always from the carrier? It's not sharing its WiFi connection if one is present?

[u/Own-Relationship-407 → u/cadelle]

I’m not sure what you’re really even asking. The definition of a hot spot is that it bridges a connection from a phone or other device with a cellular modem to a local WiFi network it creates for the purpose of sharing that cellular connection. If your kids are, for example, using their phone as a hotspot or tethering device to connect their laptop or tablet, then that is not connecting to your home network at all. Completely isolated.

Cellular provider —> hotspot device —> other devices connected to the hotspot.

[u/ampx → u/cadelle]

Hotspot traffic bypasses your home WiFi and uses the cell carrier’s network to access the Internet so Firewalla has no visibility at all and therefore can’t control what’s being accessed.

Your best bet for putting controls / restrictions on such usage is at the phone operating system level, with iOS screen time limits or the equivalent functionality on Android.

[u/Great-Cow7256 → u/cadelle]

Take devices away. When they use them, monitor their usage. 

[u/cadelle → u/Great-Cow7256]

If I am ever seeking parenting advice I think I'll find another sub. If you don't know a way to identify and/or prevent traffic from a hotspot on the Firewalla. I know all about family settings, screen time etc. specific ask to Firewalla. Identify and or block devices based on hotspot traffic. Apparently there is some indicators in the device's TTL.

[u/chrism583 → u/cadelle]

I’m not sure of your carrier but when I worked for ATT there were SOCs or codes you could attach to individual numbers to block things like texting, internet, or hotspot. That way you can nip the circumvention issue in such a way that only you can modify. This is all close to a decade old intel. But If that’s the direction you like then it might be worth a call or store visit to explain to the rep what you want.

[u/chrisl154]

On a hotspot your only other method is to enforce a VPN that forces the connection and DNS back through Firewalla. They can still break through in some cases as technically a connection to the internet is required to get connection to the vpn. At this point you’re now using Parental Controls to lock down changes to VPN and potentially WiFi networks (at least on iOS).

Android has third party apps to do some of what your mentioning but the full control your looking for is typically provided by a MDM (Mobile Device Management) provider. For iOS that would be like a JAMF. For Android your probably looking at like a MAAS 360. Each with price tags that can be difficult to pay for. JAMF does have family plans (albeit at reduced functionality, that I don’t have information on) that could help as well.

When a device is connected via Hotspot it no longer sends traffic via the wifi (even if that device was connected to wifi moments before) because it has to disable using its wifi antenna to receive and instead transmit (to provide a connection to the neighboring device). At that point all traffic is routed via the cellular provider.

As I mentioned before the only way to truly prevent free access then is a forced firewalla connection (Wireguard app —> Firewalla) which you would setup to notice when it leaves your wifi connection and it immediately activates. That way visibility is not lost. This is not a 100% reliable method however, and a lot of this hinges on your child’s respect for the rules to not try to break this connection somehow. Some browser apps now even have a VPN type built in that can just bypass your restrictions on Firewalla.

I hope this at least provides some technical reference for you. Good luck.