We use Linux for a router and firewall setup and some of our employee makes hotspot from OS X. Is there a way to block this traffic, or control it?
The problem is, that the IP addresses what this hotspot give to his clients are hidden in the network, so I can not just block this subnets.
I don't think this is trivial to use iptables for this task since the origin mac address and IP for connections behind the hotspot are the hotspot itself. But you could use NAT detection techniques like described for sflow. One way these techniques work is to detect unusual and varying TTL of the packets, i.e. packets originating from devices behind the hotspot have a different TTL then packets originating from the hotspots host itself.
But since this method can have false positives I'd recommend to just watch the traffic and determine potential hotspot users and only if you are sure then you could punish these users since they obviously violate your policy of network use. If users notice that you can detect such policy violation and that violations will be punished they will hopefully stop to even try to setup a hotspot.
I think you're falling into the trap of looking for a technical solution to a managerial problem. This is a case of users circumventing security. Try talking to them; why would they want that hotspot? Does the official Wi-Fi network have shortcomings that they're trying to work around?
As long as this is not addressed they will find ways to work around what you're trying to fix.
Why? Because this is not really something you can fix with a firewall. These only look at the physical and logical addresses, which aren't much use here.
If you don't know who is doing it, you could try foxhunting them with airodump-ng, or see if your Wi-Fi solution supports rogue AP detection.
