How to block a specific MAC address using pfSense

mauro.tridici

Dear Users,

our pfSense v.2.6 is acting as a DHCP server for a WiFI network (composed by several APs).

Sometime we need to block a particular host connected to the WiFi network, but, since the DHCP assigned IP can change, we would like to block related MAC address.

Is there a way to do it using pfSense?

Thank you in advance,
Mauro

NogBadTheBad

@mauro-tridici If you have smart users they''ll be able to circumnavigate the MAC address block.

As you state IP addresses can change, also nowadays Mac-address can change too, just look at IOS and the use of a private Wi-Fi Address.

Really the only way you could do this is enforce the use of WPA Enterprise, with certs and users added to FreeRADIUS.

You may be able to block them via the access-points, I can do this on my Aruba InstantON device, but that could still be circumnavigated.

mauro.tridici

@nogbadthebad thank you for your reply.
Yes, you are right. I know that the MAC address block can be circumnavigated.

Anyway, since we are still at work to add FreeRADIUS and related stuff, I would like to temporarily use the MAC address block using pfSense.

Do you know how (and if) I can do it via pfSense?

Thanks,
Mauro

NogBadTheBad

@mauro-tridici You could do a DHCP MAC reservaition and put a block rule on the firewall, but that would only stop them connecting past the local LAN, they'd still have access to their local LAN.

dma_pf

@nogbadthebad said in How to block a specific MAC address using pfSense:

You could do a DHCP MAC reservaition and put a block rule on the firewall, but that would only stop them connecting past the local LAN, they'd still have access to their local LAN.

Good idea for a temp fix. The access point may have network isolation that could block cross traffic between other wifi clients on that same network.

johnpoz

@dma_pf if your goal is to try and stop a device from getting on the network completely wirelessly - that should be done on your AP.

But vs giving them a specific IP, you could also just deny their mac from getting an IP from dhcp via mac access control in the dhcp server settings

Keep in mind that many wireless clients these days use private macs.. So your mileage may vary with either option.. But with deny being able to use partial macs, you could block the ranges of mac used for all private macs these devices use..

mauro.tridici

@johnpoz thank you for your reply and suggestions.
thank you to all of you, guys.

I really appreciated your help.

Regards,
Mauro