I have a camera that I can access from the manufacturer's cloud platform through a phone app. At the same time, I possess a router running Linux which I want to program to block the camera's access to the internet. This should happen at my request and not as a permanent rule. I am using the firewall's
iptables command to accomplish this but the frustrating situation is when this is not working. I insert two rules in the firewall's forward chain like this:
iptables -I FORWARD -s camera_local_ip_addr -j DROP
iptables -I FORWARD -d camera_local_ip_addr -j DROP
Occasionally this works, especially if I reboot the camera having the rules already inserted or when the connection was recently established. But most of the times it's not working for some unknown reason to me. For example, I insert the rules, the connection drops and after 5 hours, let's say, when I remove the rules, the connection is re-established as expected but from that moment I cannot block it anymore using the same procedure. Sometimes it's not working at all by inserting these rules. I tried to monitor the firewall traffic by using:
watch -n 1 iptables -L FORWARD -nvx
which shows an increasing number of packets for the first rule; this should mean that the packets are being dropped but in fact, I can still access the camera from the mobile app out of the network (with the wifi turned off). At some point, I thought this might be because of the DHCP lease and inserted a rule to allow the UDP traffic on ports 67 and 68 but it didn't work. However, I think the DHCP requests are not passing through the FORWARD filter anyway.
So my questions are: why is that this procedure works sometimes but not most of the times? And, is there any other method to block programmatically the internet access from/to my camera?
Thanks in advance!