[juneau-lug] Re: access control for wired devices
- From: Jamie <jamie@xxxxxxxxxxxxxxxxx>
- To: juneau-lug@xxxxxxxxxxxxx
- Date: Thu, 5 May 2016 22:46:38 -1000
Thanks for the response James
On 05/04/2016 01:57 PM, James Zuelow wrote:
If I set up DHCP on my server, instead of on the modem/router, could I
prevent unwanted MAC's from connecting?
You can prevent a particular MAC from getting an address or you could ensure
that those particular MAC addresses get particular IP addresses and then
treat that specially.
Any other ideas come to mind?
Does your guest know how to spoof MAC addresses?
Not likely.
You may want to set up known MAC addresses with "good" addresses, and any
unknown MAC addresses go to a local-only subnet, etc.
So form a pool of unknown MACs and assign them to a local only net.
Hmm. Would that work.
And, if your guest assigns himself a static IP and gateway that works with
your modem the DHCP server won't help.
Again not likely. He does know how to move cable around.
So, there are some options:
Perhaps you want to set up a firewall that filters by MAC address. PF (the
BSD firewall) can do this, so if you want a mostly premade firewall a pfSense
VM might be a good download for you. And regular plain jane iptables can do
this on Linux too.
Yup, I've already got the wireless devices filtered out by MAC by the
modem/router. It just won't filter wired connections. This
modem/router would be the best place to filter - as one unit, you can't
jack in in front of the router.
I could set up a machine to do firewalling but he could unplug the
ethernet coming in and just use that. Maybe I need a locking cabinet.
Or, you could set up Squid as a transparent proxy and filter MAC addresses
that way but Squid might be more work than you're after.
Thanks for your thoughts. I'm thinking now a hardware solution is
required - a locking cage around the gear would prevent pluging in an
ethernet cable.
James Zuelow
Systems Operations Manager
City and Borough of Juneau – MIS
(907) 586-0236
------------------------------------
The Juneau Linux Users Group -- http://www.juneau-lug.org
This is the Juneau-LUG mailing list.
To unsubscribe, send an e-mail to juneau-lug-request@xxxxxxxxxxxxx with the
word unsubscribe in the subject header.
------------------------------------
The Juneau Linux Users Group --
http://www.juneau-lug.org
This is the Juneau-LUG mailing list.
To unsubscribe, send an e-mail to juneau-lug-request@xxxxxxxxxxxxx with the
word unsubscribe in the subject header.
Other related posts: