# Brume 2 / GL-MT2500 - Network Placement & Network Mode Help

**URL:** <https://forum.gl-inet.com/t/brume-2-gl-mt2500-network-placement-network-mode-help/31848>\
**Category:** Router\
**Created:** [July 28, 2023, 7:58am UTC](https://forum.gl-inet.com/t/brume-2-gl-mt2500-network-placement-network-mode-help/31848 "2023-07-28T07:58:00Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![jhedfors](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/j/ee59a6/32.png) [@jhedfors](https://forum.gl-inet.com/u/jhedfors)\
**Post date:** [July 28, 2023, 11:33pm UTC](https://forum.gl-inet.com/t/brume-2-gl-mt2500-network-placement-network-mode-help/31848/6 "2023-07-28T23:33:09Z")

</div>

Hi. I am a new Brume 2 (and novice networking) user and I am using it as my main router with my Google Nest Wifi set up in bridge mode. I too have two devices (my Android TV’s) set up to use Wireguard VPN full time, with my other devices on regular Internet.

I set the VPN to use the Policy Mode “Based on Client Device” indicated above. You cannot currently set the Global Policy to block non-VPN traffic as normal traffic will not get through (regardless of whether they are excluded/included via policy). Instead, I have a kill-switch for those MAC addresses using custom firewall rules in Luci.

> [@Is it possible to block-non vpn traffic on specific device (MAC address)](https://forum.gl-inet.com/t/is-it-possible-to-block-non-vpn-traffic-on-specific-device-mac-address/31259/11):
>
> Got it working! chatgpt + this thread + your direction to use custom firewall rules. I have a working iptables rule that drops the device when wgclient fails/is offline. iptables -I FORWARD -m mac --mac-source 66:2D:BF:64:EA:62 ! -o wgclient -j DROP It would of been nice to see it in the GUI but hey it works now, I’m not complaining anymore! Thanks for the help!

---

_[View the full topic](https://forum.gl-inet.com/t/brume-2-gl-mt2500-network-placement-network-mode-help/31848)._