I have a MikroTik router (that has firewall and scripting capabilities) that is acting as a DHCP server for the subnet. Is there any way I can stop it from passing traffic from a user who has statically assigned himself an address within that range? If so, what is it called so that I can google how to implement it? Do I have to create a script that dynamically modifies firewall rules to match DHCP leases?

My end goal shown as an example in case my question is not clear enough: A user gives themselves the address of My router sees that this is not in his DHCP lease table. He drops all traffic from

  • 5
    He's not spoofing, but statically assigning. You want a MAC-based access control, but it is possible to spoof MAC addresses. You might be able to script a process where the MACs of the DCHP clients are passed to the firewall. – schroeder Aug 21 '12 at 23:28
  • That's right, your network card and router would need to support authentication with encryption to actually handle something like that. Otherwise it's not resilient to anyone because it's easy to spoof MAC. Also, Captive Portal can help by asking username and password no matter ip or mac address. – Andrew Smith Aug 21 '12 at 23:38
  • 2
    Can you explain the reason you think you need to do this? This is a very unusual requirement and most of the time, when people think they have unusual requirements, it's because they've got their requirements wrong. (For example, a much more simple change elsewhere may eliminate this perceived requirement.) – David Schwartz Aug 22 '12 at 0:25
  • Stopping static IPs is certainly a reasonable goal in some non-security contexts. For example to prevent accidental IP collisions at LAN parties. – CodesInChaos Aug 22 '12 at 6:59

No, what you are asking is fundamentally not possible. The primary function of the MAC address sublayer is allow for the communication of numerous devices(OSI Layer 2) via a physical medium (OSI Layer 1). Nothing is preventing an attacker from assigning their NIC an arbitrary MAC address value. One side effect is that your DHCP server will then issue the same IP address to the same MAC for each request, even if the request originates from an attacker's machine. This is not to be confused with ARP spoofing, which is useful for MITM attacks, and can be prevented.

Really what you are looking for is a VPN. This can be used to allow only trusted hosts to communicate.

  • The VPN is secondary. What he's really looking for is IPsec, which a VPN usually provides. – Polynomial Aug 22 '12 at 7:29
  • 1
    @Polynomial You are correct sir. However the OP will probably end up using a VPN. – rook Aug 23 '12 at 3:16
  • Indeed. Though if he can enable IPsec on his network (which most commercial-grade routers will allow) it'd save the VPN. – Polynomial Aug 23 '12 at 5:51

What you are describing is called DHCP Snooping and IP Source Guard and is implemented on most better managed Layer 2 Switches.

It works like this:

  • When the switch sees a MAC address it doesn't know it will only let DHCP Requests from that address pass. All other traffic will be dropped.
  • If the DHCP server responds with an IP address the switch will create a binding entry for the IP+MAC
  • Traffic with that IP+MAC combination will now be allowed

RouterOS does not support that feature but there are two ways to simulate it:

  1. In the interface settings set ARP to "reply-only" - This will prevent the router from learning new IP+MAC combinations. Then in the DHCP server settings enable "Add ARP for Leases". This will add the MAC-IP binding when the DHCP assigns an IP.
  2. Using the Bridge filters you can define valid IP+MAC combinations and drop all other traffic.

If you want to limit a certain MAC to only appear on a certain port take a look at DHCP Option 82 (also part of DHCP snooping) or 802.1x which also can communicate the port a client is connected to (NAS-Port-Id), both are supported by many Layer 2 switches.

However this technique still only can prevent MAC flooding, ARP spoofing, IP spoofing and IP conflicts. It does not guarantee that the person at the end of the MAC address really is who you think it should be.


It sounds as though you want to make sure unauthorized clients are not permitted onto the network. If this is the case, see the Network Security section below. If you are primarily looking to avoid conflicts and force users to use the DHCP server, read the Network Availability section below.

Network Availability

  • As the previous answer by Rook pointed out, what you're specifically asking for can be subverted in many ways. If you are just concerned about users setting their own IP address and creating network conflicts with your DHCP assigned address, the MicroTik DHCP server already checks to see whether or not the address is available before assigning a lease. This may require some additional configuration and your mileage may vary

Network Security

  • A solution controlling network access and allowing network access to only those who are authorized on the network would be Network Access Control. The protocol for this is 802.1x. Cisco has a product called Clean Access Agent that works around a router's ability to perform 802.1x authentication directly.

You could probably do access control at a higher level or implement a NAC like concept of something like 802.1x. If you are on a purely switched network you can disable the port until they authenticate. You could also force all traffic on a VPN as stated above or you can force traffic through a proxy with TLS/SSL/etc with authentication to keep the rogue off the network.

  1. http://en.wikipedia.org/wiki/802.1x
  2. http://en.wikipedia.org/wiki/Network_Access_Control
  3. http://en.wikipedia.org/wiki/Network_Admission_Control

The root question here, is why can someone physically connect to your network if they are not authorized?


Thank you all for the thoughtful responses. I see now that there is no all-purpose solution for what I was seeking (since 802.1X is impractical for my network, since I'm an ISP) and for a more complete answer I would have to provide more details about my network.

Fortunately, I found the answer I was looking for accidentally while browsing the MikroTik DHCP server options. I can stop someone from spoofing their IP address and accessing the gateway by using the "Add-ARP" option as discussed in this forum post. This would guarantee that a user would have to enter into communication with my gateway.

But what about MAC Address spoofing? In my (admittedly, unorthodox) network, we have MAC address authentication for DHCP, but ACLs guarantee that users are isolated and can only speak with the gateway and MAC Addresses of users are associated to a certain port. In other words, if a user is detected on a new port other than the one that they are originally associated with (which is super unlikely to be legitimate), they are not authenticated.

I have not accepted this as my final answer yet, because I want to know if there's something I've missed or if this answer requires clarification.

  • In this scheme, your number of users is limited to number of ports of MikroTik router. Also, you need to protect the broadcast and multicast addresses. – Andrew Smith Aug 23 '12 at 22:44
  • I understand your second point and will keep this in mind, but I'm a little confused about your second. Are you saying that I'm limited to one user per port because the filtering system breaks down? In this case, I have customer end devices that I control that will let me isolate each individual subscriber. – Seanny123 Aug 24 '12 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.