Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if it possible to use iptables to enforce MAC address to IP restrictions to prevent users from stealing IPs. Basically just looking for a way to specify that MAC X can only use IPs Y and Z.

I know you can set static ARP entries on some layer3 routers, however mine isn't capable of doing that so I'm looking at setting up a linux box to do my layer3 routing and have it do the enforcement.

share|improve this question
Generally MAC address limits are not worth the hassle for most installations. MAC addresses can be spoofed with trivial ease. The one exception I would say is at the switchport level, then they can't sniff the wire for valid mac addresses. – Zypher Jan 9 '10 at 6:37
Can one configure 802.1X to enforce MAC to IP address mappings? – pcapademic Jan 9 '10 at 7:41
Will look into 802.1x... seen it for port security, but haven't looked at for IP mappings. – Ken Robertson Jan 10 '10 at 1:31
up vote 4 down vote accepted

Whilst Zypher's comment is correct, and MAC address filtering at anything other than the wallport level is pretty useless, if you're really keen on doing this, iptables can handle it. Look for the mac match extension (which provides the --mac-source option), conveniently documented in iptables(8).

Note that this can only work in a device that passes all traffic through it, otherwise people can still steal IP addresses on your LAN with whatever MAC address they like, it's just that your router won't route the packets. So, in principle, you'd need to put every switch port on its own VLAN, use trunking to get all those packets into your central box, probably do a whole mess of proxy ARP, and then find out precisely how much traffic your little router can actually pass. Or you can just buy a better switch, or just ask people nicely not to go plugging random equipment into the network (on pain of having it driven over with a tank). I can hook you up with a reliable supplier of tanks, if needed.

share|improve this answer
Thanks. Currently, have an HP Procurve 2824. Works nicely, but not finding an easy way to lock clients down. – Ken Robertson Jan 10 '10 at 1:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.