My openwrt router (a loved TP-Link WDR4300) has this WPS button. Let's make this a little more useful than just being there doing nothing.

I have a guest network on my router. It is password protected (WPA2), bandwidth-limited, internal network isolated, all the yada-yadas. When I give my passphrase to the neighbour, I can't trust it to NOT give it to others. Let's make this sharing more difficult.

root@wrt:~# cat /etc/iptables-macs.db
aa:bb:cc:dd:ee:ff this is my own mac address so I still connect on this interface!
de:ad:be:ef:f0:0d this is another one
ca:fe:ca:fe:ca:fe Fri Nov 24 11:37:13 -02 2017 added by wps button
root@wrt:~# cat /etc/iptables-macs.cfg
GUEST_IFACE=wlan0-1
FW_CHAIN=forwarding_rule
MAC_DB=/etc/iptables-macs.db
root@wrt:~# cat /etc/firewall.user
source /etc/iptables-macs.cfg
iptables -F $FW_CHAIN
while read mac etc; do
    iptables -A $FW_CHAIN -i $GUEST_IFACE -m mac --mac-source $mac -j RETURN
done < $MAC_DB
iptables -A $FW_CHAIN -i $GUEST_IFACE -j DROP
root@wrt:~# cat /etc/hotplug.d/button/buttons
#!/bin/sh
source /etc/iptables-macs.cfg
if [ "$BUTTON" = "wps" ]; then
    if [ "$ACTION" = "pressed" ]; then
        macs=$(logread|grep "DHCPACK($GUEST_IFACE)"|grep -o "[a-f0-9:]\{17\}"|sed '1!G;h;$!d')
        if [ -n "$macs" ]; then
            echo "$macs"|while read mac; do
                grep -q "$mac" $MAC_DB && continue
                logger iptables-macs: ADD MAC $mac
                iptables -I $FW_CHAIN -i $GUEST_IFACE -m mac --mac-source $mac -j ACCEPT
                echo "$mac $(date) added by wps button" >> $MAC_DB
            done
        else
            logger iptables-macs: no recent unknown MAC found.
        fi
    fi
else
    logger the button was $BUTTON and the action was $ACTION # this is just so if you have other buttons you can make actions here
fi
root@wrt:~#

Now, if you can read a little of shell script, this is very simple. I add a rule to DROP all forward connections coming from the guest interface and then just allow the MACs that are on my database. This only works here because the DHCP server logs the MAC address after it successfully gives an IP address, so this happens after when they are already connected and the IP address is given to them. Static IPs need to be put manually on the iptables-macs file.

Hope it can save you some time writing your own scripts.