Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to Only allow certain MAC addresses to get a IP from my DHCP server, currently I use dnsmasq and I rather not change dhcp server but I'm open to other software aswell. However, I need to be able to set static IP addresses for specific MAC addresses.

currently my dnsmasq conf file has a bunch of entries that specify static IPs for a range of MAC addresses like so:


Is there a way so that All MAC addresses that are Not specified in the above fashion doensn't get an IP?

share|improve this question

5 Answers 5

up vote 5 down vote accepted

You can do this by specifying only a static range


EDIT: Change the address range above to meet your requirements.

With no dynamic ranges specified dnsmask will only provide addresses to hosts that have a corresponding dhcp-host configuration

# Specify a subnet which can't be used for dynamic address allocation,
# is available for hosts with matching --dhcp-host lines. Note that
# dhcp-host declarations will be ignored unless there is a dhcp-range
# of some type for the subnet in question.
# In this case the netmask is implied (it comes from the network
# configuration on the machine running dnsmasq) it is possible to give
# an explicit netmask instead.
share|improve this answer
I had to set dhcp-range to ",static", then it worked like a charm! Thank you! –  Joelbitar Aug 18 '11 at 20:00

Alternatively to @Chopper3 's solution, you can add iptables rules like these

# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients

# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:56 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:57 -j ACCEPT
# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP
share|improve this answer

If you only want specific MACs to get DHCP addresses just create your list of reservations as you have then set the range to cover only those IP addresses. That way it won't have any more addresses to hand out.

share|improve this answer
# Ignore any clients which are not specified in dhcp-host lines
# or /etc/ethers. Equivalent to ISC "deny unknown-clients".
# This relies on the special "known" tag which is set when
# a host is matched.
share|improve this answer

I have to disagree to the previous fixes. except for pepoluan's answer.

Although i don't know if pepoluan's is a true white list technique, it is close to the right answer. To block all data to the wrong mac is your goal. Just disabling dhcp to non registered mac's is not a fix, if they set manual ip's which is usually one of 3 ranges... 10.0.0.x, 192.168.1.x or 192.168.0.x doesnt answer the problem.

If you do use the other proposed answer of not handing out dhcp to unknown mac's, besure to also change your router's address to a unique unguessable option, and to change your ip range to a really strange one. e.g. 192.168.43.x with the router being or something. this would dissalow them to guess your subnet range, and have no link to the network.

It's not flawless, but it is a much better way to protect your network.

share|improve this answer
This isn't going to do any good either; you could break it in seconds. The only way to protect your network from this threat is 802.1x, assuming the goal here is to prevent unauthorized network access. –  Falcon Momot Nov 27 '14 at 6:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.