I want to Only allow certain MAC addresses to get a IP from my DHCP server, currently I use dnsmasq and I rather not change dhcp server but I'm open to other software aswell.
However, I need to be able to set static IP addresses for specific MAC addresses.
currently my dnsmasq conf file has a bunch of entries that specify static IPs for a range of MAC addresses like so:
```
dhcp-host=00:11:22:33:44:55,192.168.1.100
dhcp-host=00:11:22:33:44:56,192.168.1.101
dhcp-host=00:11:22:33:44:57,192.168.1.102
```
Is there a way so that All MAC addresses that are Not specified in the above fashion doensn't get an IP?
Comment MAC filter avec DHCP server
Re: Comment MAC filter avec DHCP server
Alternatively to @Chopper3 's solution, you can add `iptables` rules like these
```
# Create the DHCP_clients chain in the 'raw' table
iptables -t raw -N DHCP_clients
# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients
# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:56 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:57 -j ACCEPT
# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP
```
***Modification :*** If you need to add additional 'known'/allowed clients, just do the following for each additional client:
```
# We insert a rule at the head of the chain using the '-I' command
iptables -t raw -I DHCP_clients -m mac --mac-source $CLIENT_MAC -j ACCEPT
```
(Note: it's using `-I` (insert) instead of `-A` (append), so the new rule will be the first rule to be checked. If we don't insert, appended rules will be overridden by the rule with `-j DROP`)
```
# Create the DHCP_clients chain in the 'raw' table
iptables -t raw -N DHCP_clients
# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients
# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:56 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:57 -j ACCEPT
# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP
```
***Modification :*** If you need to add additional 'known'/allowed clients, just do the following for each additional client:
```
# We insert a rule at the head of the chain using the '-I' command
iptables -t raw -I DHCP_clients -m mac --mac-source $CLIENT_MAC -j ACCEPT
```
(Note: it's using `-I` (insert) instead of `-A` (append), so the new rule will be the first rule to be checked. If we don't insert, appended rules will be overridden by the rule with `-j DROP`)