MAC related alias
-
what i had noticed recently is that if DHCP was on and all clients get ip from it and then u had alias set for groups of them and had done shaping, filtering based on alias, what if the client PC MAC address was in allowed list for DHCP which means its allowed to communicate with pfsense but then seeing that client traffic is being shaped, he simply would manually add a different IP to his PC in order bypass all filtering and shaping.
what i mean to say is, is it possible to lock client MAC address with IP addresses? currently if set to auto on client side then DHCP gives fixed ip based on static mapping but is it also possible to force client to only get that IP if set to auto and if client tried changing it manually then to stop all communication with pfsense?
or
would it be possible to create alias with client MAC address along with IP?
-
Well you can enable static ARP.
Essentially you have a static ARP-table.
If the client has a different IP than in the table he wont be able to communicate with the pfSense (though with every other client in it's broadcast domain)