Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Does anyone know of a inexpensive NAT router that has the ability to limit access to the Internet to a specific MAC address?

I know the Linksys routers have a MAC filtering feature, but it is the opposite of what I need. It allows you to block access to a specific MAC address. I need something that will block all, but allow an exception.

more details............

I'm dealing with some VOIP issues in my company's network, and I think the answer is to have a separate router on the network for my PBX to use. I want to make sure that other nodes are not allowed to access the Internet via this second router.

Problem = Poor call quality at times

Reason for second router = My thought is this...

Connect a second router to my cable modem with a public address. Hopefully, the cable company can configure the modem to give traffic to and from the second router higher priority. (I don't know if this is possible yet, they are bringing me a new cable modem on Monday, as well as upgrading my bandwidth)

Also, I use Untangle (a Linux based router) as my primary router, and it has a lot of protection mechanisms that may introduce latency. I have already configured QoS and other bypass rules to try and take care of the problem.

Using a simple standalone router like a Linksys or something seems like it would be a more streamlined solution, especially if I (or the cable company) am able to give the second router priority.

As far as MAC filtering goes, it would just be a way to prevent internal clients from manually reconfiguring there default gateway and accessing the Internet via the second router. I'm not overly concerned about MAC spoofing in this case. Filtering based on IP address would work also.

It's a small college network with a wireless network that is shared with the student body.

I only have issues with external calls to my VOIP provider, so I don't believe that VLANs would be of any help to me. (They are also not an option, as I don't have smart or managed switches.)

share|improve this question

closed as off-topic by TomTom, cole, squillman, Dave M, mdpc Nov 26 '13 at 18:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – TomTom, cole, squillman, Dave M, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

3  
I'm confused by how a separate router is going to solve your issues with your PBX. Can you elaborate? –  gravyface Apr 16 '10 at 17:22
    
Filtering based on a hardware address is generally a bad idea. Hardware addresses are easily discovered and forged. –  Zoredache Apr 16 '10 at 17:29
    
I too would like to hear more information. What sort of VoIP issues are you running into? What's going on with the network when you're running into these issues? Is VoIP used on the LAN as well as WAN? If used in the LAN is VoIP traffic isolated to it's own network either by dedicated switches or vlans? Ultimately I agree with the answers below. Based on the current question it seems to be a QoS issue and a separate router and internet connection may not be the best or most cost effective solution. –  3dinfluence Apr 16 '10 at 19:29
    
i edited the question... added more details –  Corey Apr 16 '10 at 22:57
    
Overall it sounds to me like you need to get some equipment in place to properly take control of your network. All of your issues can be traced back to that concept. One thing that you said that really jumps out at me is that it appears as though you have wireless traffic from students, perhaps even open access, sharing a network with admin/faculty traffic. If that's the case you need to fix that as soon as possible. You really do need VLANs and quality managed switches in that sort of environment. –  3dinfluence Apr 18 '10 at 18:47

6 Answers 6

up vote 0 down vote accepted

Ok,

I'm sorry, I was being dumb. I figured out a way to do it with the Linksys router (BEFSR41) I already have. It has an IP address filter option, where I can give it ranges of address to not allow access to the Internet. My PBX has .17, so I will give it two ranges to filter.

192.168.76.1 - 192.168.76.16 & 192.168.76.18 - 192.168.76.254

share|improve this answer

To answer your question, buy an ALIX from PCEngines and put pfSense on it: traffic shaping, QoS, VLANs, etc.

However, I'm curious to know what the issues are with your PBX and how you plan on solving the issues with a separate router? You haven't mentioned a separate WAN connection, so I'm assuming you're going to use this new router on the inside; perhaps elaborating on the issue and helping us understand what you're trying to do may be more helpful.

share|improve this answer
    
I like to suggest the netgate ALIX box (link below) which comes with pfSense pre-installed. It's a good low cost solution that can provide both vlan and QoS support to a small/medium sized network. netgate.com/product_info.php?cPath=60_85&products_id=312 –  3dinfluence Apr 16 '10 at 19:21

You can easily achieve what you want using linux and iptables, any old computer with a couple of network interfaces will be enough to use as a linux firewall/router.

share|improve this answer

From the situation you describe, it sounds to me that unfortunately want might want is a more expensive and low latency router that will allow you implement rate-limiting to make sure there is bandwidth for your voip traffic. If these both end up on the same connection, I don't think a different router will help unless the CPU is pegged, which wouldn't be my guess.

You might also look into to getting an internet provider that can provider some QoS for your voip traffic (an MPLS connection between offices would probably be a good fit, but maybe that is too expensive).

share|improve this answer
    
+1 for ISP that can provide some QoS. –  3dinfluence Apr 16 '10 at 19:22

Linksys WRT54G with DD-WRT firmware is always my answer for a cheap powerful router.

share|improve this answer
    
Consider Buffalo over WRT54G. –  Warner Apr 16 '10 at 18:06

Perhaps a VLAN will do what you need?

share|improve this answer
    
Unfortunately not an option in this case –  Corey Apr 16 '10 at 17:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.