Whilst Zypher's comment is correct, and MAC address filtering at anything other than the wallport level is pretty useless, if you're really keen on doing this, iptables can handle it. Look for the
mac match extension (which provides the
--mac-source option), conveniently documented in
Note that this can only work in a device that passes all traffic through it, otherwise people can still steal IP addresses on your LAN with whatever MAC address they like, it's just that your router won't route the packets. So, in principle, you'd need to put every switch port on its own VLAN, use trunking to get all those packets into your central box, probably do a whole mess of proxy ARP, and then find out precisely how much traffic your little router can actually pass. Or you can just buy a better switch, or just ask people nicely not to go plugging random equipment into the network (on pain of having it driven over with a tank). I can hook you up with a reliable supplier of tanks, if needed.