Does anyone know of a inexpensive NAT router that has the ability to limit access to the Internet to a specific MAC address?

I know the Linksys routers have a MAC filtering feature, but it is the opposite of what I need. It allows you to block access to a specific MAC address. I need something that will block all, but allow an exception.

more details............

I'm dealing with some VOIP issues in my company's network, and I think the answer is to have a separate router on the network for my PBX to use. I want to make sure that other nodes are not allowed to access the Internet via this second router.

Problem = Poor call quality at times

Reason for second router = My thought is this...

Connect a second router to my cable modem with a public address. Hopefully, the cable company can configure the modem to give traffic to and from the second router higher priority. (I don't know if this is possible yet, they are bringing me a new cable modem on Monday, as well as upgrading my bandwidth)

Also, I use Untangle (a Linux based router) as my primary router, and it has a lot of protection mechanisms that may introduce latency. I have already configured QoS and other bypass rules to try and take care of the problem.

Using a simple standalone router like a Linksys or something seems like it would be a more streamlined solution, especially if I (or the cable company) am able to give the second router priority.

As far as MAC filtering goes, it would just be a way to prevent internal clients from manually reconfiguring there default gateway and accessing the Internet via the second router. I'm not overly concerned about MAC spoofing in this case. Filtering based on IP address would work also.

It's a small college network with a wireless network that is shared with the student body.

I only have issues with external calls to my VOIP provider, so I don't believe that VLANs would be of any help to me. (They are also not an option, as I don't have smart or managed switches.)

  • 3
    I'm confused by how a separate router is going to solve your issues with your PBX. Can you elaborate? – gravyface Apr 16 '10 at 17:22
  • Filtering based on a hardware address is generally a bad idea. Hardware addresses are easily discovered and forged. – Zoredache Apr 16 '10 at 17:29
  • I too would like to hear more information. What sort of VoIP issues are you running into? What's going on with the network when you're running into these issues? Is VoIP used on the LAN as well as WAN? If used in the LAN is VoIP traffic isolated to it's own network either by dedicated switches or vlans? Ultimately I agree with the answers below. Based on the current question it seems to be a QoS issue and a separate router and internet connection may not be the best or most cost effective solution. – 3dinfluence Apr 16 '10 at 19:29
  • i edited the question... added more details – Corey Apr 16 '10 at 22:57
  • Overall it sounds to me like you need to get some equipment in place to properly take control of your network. All of your issues can be traced back to that concept. One thing that you said that really jumps out at me is that it appears as though you have wireless traffic from students, perhaps even open access, sharing a network with admin/faculty traffic. If that's the case you need to fix that as soon as possible. You really do need VLANs and quality managed switches in that sort of environment. – 3dinfluence Apr 18 '10 at 18:47

Linksys WRT54G with DD-WRT firmware is always my answer for a cheap powerful router.

  • Consider Buffalo over WRT54G. – Warner Apr 16 '10 at 18:06

From the situation you describe, it sounds to me that unfortunately want might want is a more expensive and low latency router that will allow you implement rate-limiting to make sure there is bandwidth for your voip traffic. If these both end up on the same connection, I don't think a different router will help unless the CPU is pegged, which wouldn't be my guess.

You might also look into to getting an internet provider that can provider some QoS for your voip traffic (an MPLS connection between offices would probably be a good fit, but maybe that is too expensive).

  • +1 for ISP that can provide some QoS. – 3dinfluence Apr 16 '10 at 19:22

To answer your question, buy an ALIX from PCEngines and put pfSense on it: traffic shaping, QoS, VLANs, etc.

However, I'm curious to know what the issues are with your PBX and how you plan on solving the issues with a separate router? You haven't mentioned a separate WAN connection, so I'm assuming you're going to use this new router on the inside; perhaps elaborating on the issue and helping us understand what you're trying to do may be more helpful.


Perhaps a VLAN will do what you need?

  • Unfortunately not an option in this case – Corey Apr 16 '10 at 17:34

You can easily achieve what you want using linux and iptables, any old computer with a couple of network interfaces will be enough to use as a linux firewall/router.



I'm sorry, I was being dumb. I figured out a way to do it with the Linksys router (BEFSR41) I already have. It has an IP address filter option, where I can give it ranges of address to not allow access to the Internet. My PBX has .17, so I will give it two ranges to filter. - & -

Not the answer you're looking for? Browse other questions tagged or ask your own question.