Home wifi: is it typically possible to prevent WLAN devices from selecting their own IP address?

Question

Motivation: I want to be able to create different outbound traffic rules for different devices on my network e.g. my laptop can create VPN tunnels, whereas my kids' laptops can only connect DNS/HTTP/HTTPS, and they are locked to a specific DNS server. I can create different firewall rules on my router for different IP address blocks, but don't want this to be easily subverted by devices being able to select their own IP address in the "allow" range.

So this question is about whether it is typically possible and practical to prevent a device on a home wifi network from selecting its own IP address (from within the network range), using commonly-installed home wifi/internet routers. In other words, can you prevent devices from assuming any static IP address in the WLAN's normal range.

Assume that I already have and know:

• wifi router configuration for DHCP pool ranges
• wifi router configuration for DHCP static IP addresses
• wifi router MAC-address filtering etc.

I can add a static-lease for the device based on its MAC address, and when the device is configured for DHCP it assumes this address. But assume that I don't have 100% control of the device's networking settings, that some other user can change those - for example they could switch from DHCP to static and configure an IP address of their choosing.

My observation is that whatever static IP address is chosen works and the router will route packets for that client (it has wifi-level access e.g. WPA2 credentials of course), regardless of whether the IP-address chosen is within the router's DHCP range or some reserved range.

My conclusion is that you cannot create firewall rules which prevent outbound traffic for certain clients based on an IP-address range, since clients are free to grab a free static IP address within that range. This seems to happen irrespective of whether a DHCP reservation exists for that client's MAC address, which makes sense because DHCP is inactive for the client at that point.

It seems to me that either multiple routers or multiple VLANs are the only way this can be achieved?

Example: I want to prevent an allowed but only partially-trusted device on my WLAN with MAC 12:34:56:78:9a:bc from routing packets with source in the CIDR range 10.1.1.0/25, which is reserved and outside my DHCP range.

Answer 1

There is no way to force IP addresses on clients in an Ethernet network as such, as they can simply opt not to use DHCP at all. Clients can pick and use any valid IP address. Furthermore, static leases by MAC address will not guarantee an IP assignment even if DHCP is used as MAC address not static and can be chosen arbitrarily (equal to MAC filtering in the first place). More intelligent firewalls will usually force the source address of packets to belong to the interface subnet. You could also really make a firewall rule to at least enforce that only some range of IP addresses are routed.

Embedded router devices are spectacularly non-versatile and preventing some devices form accessing the internet is not a particularly common usage case. Forcing IP addresses to devices is kind of an XY fallacy for the problem. This task is definitely impossible, but your objective is fairly straightforward.

For example, you could use another NAT router for the restricted devices and give it a static LAN IP address on the WAN interface. Then make rules preventing that LAN address on WAN interface from reaching the internet on the main router. This works because the devices behind the internal router have their addresses translated to the single WAN address which they can not change. They would still be able to access the main LAN addresses through the default route of the internal router. To communicate back to them you would need to add port forwards. Another possibility would be to use 1-to-1 NAT with a pool of addresses.

As stated, using a VLAN per SSID capable AP would at least allow a router running a full version of Linux to trivially segregate the traffic between VLAN segments (I recommend Ubuntu w/ Shorewall). Some "open source" firmware images for home routers supposedly can do VLAN/SSID and firewall rules based on VLAN tag, but they tend to be horrible and I strongly do not suggest them.

Perhaps a sincere analysis of the threat model would be helpful as well. Why is it important that these devices can not reach the internet. How strident will attempts to circumvent these controls be? Is a MAC whitelist not good enough? You say the devices are partially trusted... are you sure you trust them to have unprotected access to your trusted machines anyways?