I'm dealing with an OPNSense router, at the moment I already configured the DHCP server to provide IPv4 addresses only to a legitimate list of fixed MAC addresses and I want to block every unknown MAC, because right now anyone can connect to the server via the etheret interface and can give himself a static IP and the route in order to enter into the subnet.

I know that the MAC can be spoofed and changed, but i want to mitigate this by denying any connection to unknown MAC addresses. Is this possible? Are other approaches available?

I'm on :

  • OPNsense 20.1.2-amd64
  • FreeBSD 11.2-RELEASE-p17-HBSD
  • OpenSSL 1.1.1d 10 Sep 2019
  • Security by MAC address is a fool's game. It is so very simple to change the MAC address of a device to be an allowed MAC address that you are only fooling yourself if you think it adds any level of security. We have 802.1X for this type of thing, but you will need to build the infrastructure for that. – Ron Maupin Apr 8 '20 at 0:04
  • @RonMaupin ok, then how can I avoid connections that doesn't comes from the DHCP? My concern is that someone connects through ethernet and auto-assign himseld a static rogue IP and then is online in the network. – Fuocoman Apr 8 '20 at 0:12
  • There are vendors that have things like 802.1X, DHCP snooping, IP ARP inspection, IP source guard, etc. Trying to perform security by MAC address will simply get you hacked while you think you are protected. – Ron Maupin Apr 8 '20 at 0:15
  • I think that his question was more related to a general discussion about prevent a rogue access by bypassing the DHCP and not on the data layer itself. – Thecave3 Apr 8 '20 at 0:16
  • 1
    @Thecave3, my point is that security by MAC address is simply non-existent, and you need to use something else for security. Most business-grade switches have something that can be used, rather than relying on something that is too easy to bypass. – Ron Maupin Apr 8 '20 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.