Motivation: I want to be able to create different outbound traffic rules for different devices on my network e.g. my laptop can create VPN tunnels, whereas my kids' laptops can only connect DNS/HTTP/HTTPS, and they are locked to a specific DNS server. I can create different firewall rules on my router for different IP address blocks, but don't want this to be easily subverted by devices being able to select their own IP address in the "allow" range.
So this question is about whether it is typically possible and practical to prevent a device on a home wifi network from selecting its own IP address (from within the network range), using commonly-installed home wifi/internet routers. In other words, can you prevent devices from assuming any static IP address in the WLAN's normal range.
Assume that I already have and know:
- wifi router configuration for DHCP pool ranges
- wifi router configuration for DHCP static IP addresses
- wifi router MAC-address filtering etc.
I can add a static-lease for the device based on its MAC address, and when the device is configured for DHCP it assumes this address. But assume that I don't have 100% control of the device's networking settings, that some other user can change those - for example they could switch from DHCP to static and configure an IP address of their choosing.
My observation is that whatever static IP address is chosen works and the router will route packets for that client (it has wifi-level access e.g. WPA2 credentials of course), regardless of whether the IP-address chosen is within the router's DHCP range or some reserved range.
My conclusion is that you cannot create firewall rules which prevent outbound traffic for certain clients based on an IP-address range, since clients are free to grab a free static IP address within that range. This seems to happen irrespective of whether a DHCP reservation exists for that client's MAC address, which makes sense because DHCP is inactive for the client at that point.
It seems to me that either multiple routers or multiple VLANs are the only way this can be achieved?
Example: I want to prevent an allowed but only partially-trusted device on my WLAN with MAC
12:34:56:78:9a:bc from routing packets with source in the CIDR range
10.1.1.0/25, which is reserved and outside my DHCP range.