I'm looking for a way to restrict access to the internet from my home network for specific devices without doing any configuration on the device itself. I want to achieve this with a RaspberryPi, which currently acts as a DHCP server in my network (running dnsmasq).
I've already played around with
dhcp-mac, but of course this doesn't work if the client already has an IP address, so I have to remove the lease manually from the dnsmasq.leases file. Reducing the lease time for this specific client (e.g. to 10m) would be an option to solve the issue, but I don't know if this has a negative side effect for the client asking every 10 minutes for a new DHCP lease. And most importantly, the whole thing could be bypassed by configuring a static IP address in the devices network settings.
The only other way I could imagine is to route all network traffic over the RaspberryPi and forward it to the router, allowing me to use
iptables to drop all connections from a specific MAC address. But, I have to say that I don't really know how to configure the RPi like this, and if the RPi is not running, no one could access the internet. So this would be the very last option for me.
Does anyone know a different approach to achieve mac filtering with a RPi?