Ways to restrict internet access via MAC address with a RPi

Question

I'm looking for a way to restrict access to the internet from my home network for specific devices without doing any configuration on the device itself. I want to achieve this with a RaspberryPi, which currently acts as a DHCP server in my network (running dnsmasq).

I've already played around with dhcp-ignore and dhcp-mac, but of course this doesn't work if the client already has an IP address, so I have to remove the lease manually from the dnsmasq.leases file. Reducing the lease time for this specific client (e.g. to 10m) would be an option to solve the issue, but I don't know if this has a negative side effect for the client asking every 10 minutes for a new DHCP lease. And most importantly, the whole thing could be bypassed by configuring a static IP address in the devices network settings.

The only other way I could imagine is to route all network traffic over the RaspberryPi and forward it to the router, allowing me to use iptables to drop all connections from a specific MAC address. But, I have to say that I don't really know how to configure the RPi like this, and if the RPi is not running, no one could access the internet. So this would be the very last option for me.

Does anyone know a different approach to achieve mac filtering with a RPi?

Answer 1

One possibility would be to use a more complete DHCP server on the RP. For example, the isc-dhcp-server allows you to assign specific IP addresses on a per-MAC basis (in file /etc/dhcp/dhcpd.conf - there is an example within the comments in this file).

You could then assign an address within the valid IP segment to certain MACs, but assign addresses from an incorrect IP address range. For instance, if you are using 192.168.1.0/24 on your network, you could give addresses in 192.168.2.1 to 192.168.2.10 to hosts that do not have the correct MAC.

Alternatively, you could also play with the gateway address, assigning certain MAC addresses the RP gateway, but no gateway to others (they will connect to the local network, but not be able to access Internet).