Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block randomized MAC addresses?

    Scheduled Pinned Locked Moved General pfSense Questions
    20 Posts 10 Posters 12.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sdorn77
      last edited by sdorn77

      Thanks. I will eventually have to set up a separate VLAN and maybe use the Captive Portal features as well when my kids get older. Right now we physically restrict their access to internet devices so that hasn't been as much of an issue.

      I run a simple network monitor that tracks who connects to my network, and over the past 10 years or so I've had about 350 unique MAC addresses connect to the network. Recently that number has been going up much faster though, mainly because of these randomized MAC addresses. I go into the device settings and turn it off where I can, but with major updates it gets turned back on and between myself, my wife, my kids and various extended family we have probably 10 - 15 Apple devices that connect to the network from time to time that all generate random MAC addresses.

      It sounds like my best bet is to set up the separate VLAN with a different SSID, limit that to just internet access and stop worrying about what connects to it. However, I am still going to end up with randomized MAC addresses on my main network because of my own personal devices and devices of my wife and kids that I want to be able to access all of the various network resources like cameras, Sonos, etc.

      DerelictD 1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate @sdorn77
        last edited by Derelict

        @sdorn77

        However, I am still going to end up with randomized MAC addresses on my main network because of my own personal devices and devices of my wife and kids that I want to be able to access all of the various network resources like cameras, Sonos, etc.

        So let them access them? The security comes from the wireless network and its security credentials and who has them, not from what MAC address connects.

        If that is the kind of granularity you want in your network, you probably need APs that can announce multiple SSIDs and put the traffic on different VLANs or security zones. Guests can't connect to the VLAN with the stuff you want to protect because they don't have the credentials. They connect to the guest VLAN and can only get to the internet. Doing this at layer 2 (MAC addresses) will require a Layer 2 solution. This might be your wireless gear, switching gear, etc. pfSense is a Layer 3 firewall.

        For instance I'm sure if you deployed WPA2 Enterprise and gave each user specific user credentials, you could find wireless gear that issued DHCP addresses based on that, not the MAC address.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        N 1 Reply Last reply Reply Quote 0
        • N
          NinthWave @Derelict
          last edited by NinthWave

          @derelict said in How to block randomized MAC addresses?:

          For instance I'm sure if you deployed WPA2 Enterprise and gave each user specific user credentials, you could find wireless gear that issued DHCP addresses based on that, not the MAC address.

          😲 That's incredible what sorts of measures parents have to resort to in order to have kids go to bed instead of spending the whole night on the tablets or phones.

          My girlfriend bought an Oculus Quest and since it's standalone, no WiFi is required once the games are installed. The final solution cannot come from pfSence then. The Quest has to come back in our bedroom at night time.

          It reminds me of the McCain Deep'n Delicious cake ad where the husband wakes up in the middle of the night to grab a piece of cake...

          DerelictD 1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @NinthWave
            last edited by

            With real wifi gear you can put two different SSIDs on the same VLAN. Put the kids on one and everyone else on the other. Don't give them the creds for the one that stays up all the time. Tell the WIFI GEAR to shut off that ssid overnight.

            Then they just turn off WiFi and use cellular. :P

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 1
            • J
              jadejaws
              last edited by

              I came across this post when I was trying to do this exact same thing.
              All the other answers work and are likely the better solution.

              To simply answer the question though.....

              Go to Services --> DHCP Server
              Scroll down to MAC Deny.
              Paste this in:
              A2,B2,C2,D2,E2,F2,12,22,32,42,52,62,72,82,92,02,A6,B6,C6,D6,E6,F6,16,26,36,46,56,66,76,86,96,06,AA,BA,CA,DA,EA,FA,1A,2A,3A,4A,5A,6A,7A,8A,9A,0A,AE,BE,CE,DE,EE,FE,1E,2E,3E,4E,5E,6E,7E,8E,9E,0E

              Nothing with one of these privatized MAC addresses will get a DHCP address.

              Yes, it doesnt prevent outright spoofing.
              No, it isnt a perfect solution.

              JKnottJ 1 Reply Last reply Reply Quote 3
              • JKnottJ
                JKnott @jadejaws
                last edited by

                @jadejaws

                Pfsense doesn't filter on MAC addresses.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                J 1 Reply Last reply Reply Quote 0
                • AndyRHA
                  AndyRH
                  last edited by

                  Just be aware that many virtual machines use private MACs too.

                  o||||o
                  7100-1u

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    jadejaws @JKnott
                    last edited by jadejaws

                    @jknott said in How to block randomized MAC addresses?:

                    @jadejaws

                    Pfsense doesn't filter on MAC addresses.

                    Mine does. DHCP Server service does anyway.
                    This works exactly as I have described it.

                    Screenshot_2.png

                    JKnottJ 1 Reply Last reply Reply Quote 1
                    • J
                      jadejaws @AndyRH
                      last edited by

                      @andyrh

                      @andyrh said in How to block randomized MAC addresses?:

                      Just be aware that many virtual machines use private MACs too.

                      All of my VMs use VMware's allocated MACs.
                      00:50:xxxxxxxxx

                      Not sure about VirtualBox or other solutions.

                      1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @jadejaws
                        last edited by

                        @jadejaws said in How to block randomized MAC addresses?:

                        Mine does. DHCP Server service does anyway.

                        That's not filtering. It's assigning an IP address to a MAC address. If it was filtering, you could create a rule to do that. I have worked with other firewalls that can filter on MACs.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.