Block internet access by MAC Address

[zaf]

Hi,

is it possible to block internet for a host based on its MAC address? if so can someone please specify steps on how to achieve this?

Thanks

[SeventhSon]

Don't think you can do it that way without hacking a bit:
http://www.openbsd.org/faq/pf/tagging.html

and then filtering those with a rule with advanced option "You can match packet on a mark placed before on another rule. "

There is also the option of static ARP under the DHCP server, but then you need to specify all the MAC addresses that CAN talk with the firewall.