This question already has an answer here:
I have a debian server that acts as a router for a network, and I am planning on making it so I am able to block network access for certain computers, what do you think would be the best way to do it? I was thinking mac address filtering, although that could be spoofed. I was also thinking of IP filtering, but that could be avoiding just as easily. A few pages on google suggested doing something with arp tables, but im not sure how to go about doing that. Any help is much appreciated, thanks!