Block MAC address from internet access - settings not working

Hi David,

Do you have Web Protection enabled?

Thanks,
Karlos

Yes, web filtering is on.

Hi DavidHudson 

Proxy functions including Web Proxy will precede configured Firewall Rules and MAC filtering can not be applied to Web Proxy.

Your only options for Web Filtering is by IP address or User Authentication. 

If you're able to assign a static IP to that device that you would like to block. Then you can use that to create a Web Filter profile that will block access to all. 

Another option is to add that device (again only by IP or hostname) to the Transparent Mode Skiplist and it will bypass the proxy and the Firewall rules will apply.

Cheers,
Karlos

Karlos gave you the two possible solutions, David.  To understand a bit better, see #2 in Rulz and Doug Foster's take on some of that: READ ME FIRST: UTM Architecture.

Cheers - Bob

Hi Karlos,

Thank you explaining how I can achieve the MAC filtering.  It is clear now that I did not understand the rulz and precedence with regards to UTM proxies.

I will acknowledge, I am still on the learning curve with the UTM.

Thanks again,

David

Hi Bob,

I did read the rulz before hand to see if I was going about the MAC filtering properly but clearly I did not understand.  The UTM architecture article gave me a better understanding on how the rulz are applied and proxies are separate.  It re-enforces I have a lot to learn about the UTM.

Thanks for the info,

David

It's easy enough for the host IP address to be changed on the device itself.  MAC spoofing is also possible but usually more difficult to achieve.  Blocking by mac address is available even in the cheapest consumer grade products. It's odd to see this oversight in such a feature full firewall.  One should simply be able to define a mac address and assign a rule to block all internet access.  No user lists, or other work arounds.

Jay, it is possible to block by MAC in the firewall, just not directly in Web Filtering.  If you want to block by MAC in Web Protection, you have to associate an IP to the MAC.  Blocking by MAC is less necessary in a corporate environment where LDAP and AD servers can be used to regulate users' behavior, so I don't think adding a MAC address check to the Proxy would make sense outside of home users.

Cheers - Bob