Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block a specific MAC address using pfSense

    General pfSense Questions
    4
    7
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mauro.tridici
      last edited by

      Dear Users,

      our pfSense v.2.6 is acting as a DHCP server for a WiFI network (composed by several APs).

      Sometime we need to block a particular host connected to the WiFi network, but, since the DHCP assigned IP can change, we would like to block related MAC address.

      Is there a way to do it using pfSense?

      Thank you in advance,
      Mauro

      NogBadTheBadN 1 Reply Last reply Reply Quote 0
      • NogBadTheBadN
        NogBadTheBad @mauro.tridici
        last edited by NogBadTheBad

        @mauro-tridici If you have smart users they''ll be able to circumnavigate the MAC address block.

        As you state IP addresses can change, also nowadays Mac-address can change too, just look at IOS and the use of a private Wi-Fi Address.

        Really the only way you could do this is enforce the use of WPA Enterprise, with certs and users added to FreeRADIUS.

        You may be able to block them via the access-points, I can do this on my Aruba InstantON device, but that could still be circumnavigated.

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        M 1 Reply Last reply Reply Quote 1
        • M
          mauro.tridici @NogBadTheBad
          last edited by

          @nogbadthebad thank you for your reply.
          Yes, you are right. I know that the MAC address block can be circumnavigated.

          Anyway, since we are still at work to add FreeRADIUS and related stuff, I would like to temporarily use the MAC address block using pfSense.

          Do you know how (and if) I can do it via pfSense?

          Thanks,
          Mauro

          NogBadTheBadN 1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad @mauro.tridici
            last edited by

            @mauro-tridici You could do a DHCP MAC reservaition and put a block rule on the firewall, but that would only stop them connecting past the local LAN, they'd still have access to their local LAN.

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            D 1 Reply Last reply Reply Quote 1
            • D
              dma_pf @NogBadTheBad
              last edited by

              @nogbadthebad said in How to block a specific MAC address using pfSense:

              You could do a DHCP MAC reservaition and put a block rule on the firewall, but that would only stop them connecting past the local LAN, they'd still have access to their local LAN.

              Good idea for a temp fix. The access point may have network isolation that could block cross traffic between other wifi clients on that same network.

              johnpozJ 1 Reply Last reply Reply Quote 2
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @dma_pf
                last edited by

                @dma_pf if your goal is to try and stop a device from getting on the network completely wirelessly - that should be done on your AP.

                But vs giving them a specific IP, you could also just deny their mac from getting an IP from dhcp via mac access control in the dhcp server settings

                dhcp.jpg

                Keep in mind that many wireless clients these days use private macs.. So your mileage may vary with either option.. But with deny being able to use partial macs, you could block the ranges of mac used for all private macs these devices use..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                M 1 Reply Last reply Reply Quote 1
                • M
                  mauro.tridici @johnpoz
                  last edited by

                  @johnpoz thank you for your reply and suggestions.
                  thank you to all of you, guys.

                  I really appreciated your help.

                  Regards,
                  Mauro

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.