Re: Blocking access to network via IP/MAC/dhcpd?

Amadeus wrote:
> Hello,
>
> I'm using netbsd 3.0 to provide NAT via dhcpd, and often need to block
> a machine for a certain time period for bandwidth excess that altq
> doesn't seem able to handle well (small uplink quickly saturates).
>
> Up til now a line in ipf.conf has been blocking the offending IP, but
> people are twigging to the fact they can manually specify their IP (as
> long as it doesn't cause collisions with another machine with that
> IP), getting around this "ban".
>
> I could force a MAC address to use a specific IP in dhcpd, but again,
> they could just configure their IP manually.
>
> Do you have any suggestions for this problem?

Not really.

The one that seems most obvious, filtering on MAC address, will only
work as long as they realise they cannot change their MAC address.


> For each machine wanting to connect, I could:
>
> -specify an IP address for their MAC in dhcpd.conf
> -allow that IP address to connect via ipf.conf (default block all)
>
> But again, someone could find a valid IP and manually use that when
> the original user isn't.

Have you thought about demploying/implement 802.1x ?

Darren