I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use
iptables to restrict access to all devices unless they were previously added to the table via MAC address. A website is hosted on the same machine, which uses a Node JS process to add the device MAC address to the tables once the user accepts terms and conditions.
I know for people with adequate knowledge it's not hard to grab someone's MAC address that's already authenticated and spoof it to access the network. What are some security measures to prevent this from happening and is there anything else I should consider.
Ps.: this is not in production at this stage and since it's designed to cover free wireless AP's.