Prevent IP Address Assignment via MAC Addr

Question

Hello, 
 I found this 12 year old thread, 
 Block certain mac address to get ip from dhcp pool 
 and would like to know if it is now possible to prevent the assignment of IP addresses to specific MAC addresses. 
 Thanks

Jay Jay · Accepted Answer

Vivek Jagad said: either y ou can put the computer on a vlan 
 How does one put a computer on a vlan in this context? He would need to be using a a switch that does mac based vlan assignments (a cheap netgear gs308t does this). I'm not sure how this is possible otherwise if the clients in question are on the same lan segment. 
 Simply defining a vlan in UTM is insufficient. Client needs to be placed on that vlan by some means - either mac based vlan switch, or vlan definition in the client nic settings. Unless i'm missing something, just defining a vlan in utm does nothing for the above considerations. 
 Using mac based vlan is quite simple. Assign client to a undefined vlan - that is a vlan which has no services available. Client will never get an ip, nor be able to access any other part of the lan. 
 Blocking by firewall isn't optimal either as that doesn't affect other mechanisms such as web proxy, which will allow access. 
 Toggling Clients with static mappings only in the UTM dhcp server setting achieves what the OP is after, so long as all other connected clients have been defined in UTM. Unknown clients get no dhcp assignment. This is a bit of using a sledge hammer on a picture nail type solution. What happens when a new unknown client is connected.... it won't have any network services. 
 OP's request seems quite simple, yet there doesn't appear to be an elegant simple solution of literally just not assigning an IP to a matched MAC. Depending on the size of your network, it may work best to flip the logic and enable the static mappings toggle in the dhcp server. This will effectively assign IP's to defined clients and block all unknown. 
 Or, perhaps more detail with respect to why you're trying to block these clients?

PhilippRusch · Answer

Not a second one, you need to select your DHCP server there. Because you want to prevent this server from servicing for this MAC. Therefore you define a static mapping and then this server knows, ok, there is already a definition, I don't need to bother with this host.

Vivek Jagad · Answer

hey busthead ,

it can be used to further restrict a rule based on hosts/IP addresses to only match devices which have one of the defined MAC addresses.

So for reference see the screenshot below:
Step1

Step2
Select the Source MAC Address:
And select the action based on your requirement either allow/drop/reject

Prevent IP Address Assignment via MAC Addr

Top Replies