Alternatively to @Chopper3 's solution, you can add iptables rules like these
# Create the DHCP_clients chain in the 'raw' table
iptables -t raw -N DHCP_clients
# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients
# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:56 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:57 -j ACCEPT
# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP
Modification : If you need to add additional 'known'/allowed clients, just do the following for each additional client:
# We insert a rule at the head of the chain using the '-I' command
iptables -t raw -I DHCP_clients -m mac --mac-source $CLIENT_MAC -j ACCEPT
(Note: it's using -I (insert) instead of -A (append), so the new rule will be the first rule to be checked. If we don't insert, appended rules will be overridden by the rule with -j DROP)
