|
I was wondering if it possible to use iptables to enforce MAC address to IP restrictions to prevent users from stealing IPs. Basically just looking for a way to specify that MAC X can only use IPs Y and Z. I know you can set static ARP entries on some layer3 routers, however mine isn't capable of doing that so I'm looking at setting up a linux box to do my layer3 routing and have it do the enforcement. | |||||||||
feedback
|
|
Whilst Zypher's comment is correct, and MAC address filtering at anything other than the wallport level is pretty useless, if you're really keen on doing this, iptables can handle it. Look for the Note that this can only work in a device that passes all traffic through it, otherwise people can still steal IP addresses on your LAN with whatever MAC address they like, it's just that your router won't route the packets. So, in principle, you'd need to put every switch port on its own VLAN, use trunking to get all those packets into your central box, probably do a whole mess of proxy ARP, and then find out precisely how much traffic your little router can actually pass. Or you can just buy a better switch, or just ask people nicely not to go plugging random equipment into the network (on pain of having it driven over with a tank). I can hook you up with a reliable supplier of tanks, if needed. | ||||
feedback
|
