MAC locking and filtering in FreeBSD

[Brett Glass]

At 12:17 AM 5/14/2009, Ian Smith wrote:
 
>You can use fixed leases with MAC specified in dhcp for that, 

This lets you assign specific addresses to machines with specific MAC addresses. But it doesn't inhibit MAC address "cloning," and the DHCP server cannot force a machine to use a specific IP or stop it from using one that was not assigned to it.

>Re ipfw(8), I'm not clear on what your problem is: the section PACKET 
>FLOW shows clearly how to distinguish layer 2 from layer 3 traffic.

The problem is that you cannot test both the MAC address and the IP address in the same rule -- at least in the current implementation.

>Your 'vice versa' here isn't correct; you can select by layer 3 criteria 
>on packets from ether_demux, 

The docs say that you can't.

--Brett Glass