Restrict Internet Access Based on MAC Address in MikroTik

MikroTik router has a lot of features by which a network administrator can design his network as he likes. As a network administrator, sometimes you may need to allow internet access some specific devices. If other devices try to access internet, they will be rejected by your router. For example, say, you have configured a simple network like below diagram. In this network, you have configured WAN, LAN, Gateway, DNS and NAT. Also you have created queue rules for limiting bandwidth based on IP address. Now, if you have an expert user who knows networking can change his IP address and can consume unlimited bandwidth because you have created queue rules for specific IP addresses and also you have NATed all the IP blocks. Obviously, it is not a better and secure network design. Then, how can you prevent this unauthorized access in your network? Don’t worry. MikroTik has integrated a lot of features by which you can prevent this type of unauthorized access in your router. In this article, I will show you some strategies by which you can easily block unauthorized access in your network.

Limit Internet Access in MikroTik Router

As a network administrator, you often want to block unauthorized access in your network. Applying some strategies in your MikroTik router, you can easily prevent unauthorized access in your network. These strategies can mainly be divided into below two types.

  • Single IP NAT Strategy
  • Internet Access Based on MAC Address

Single IP NAT Strategy

Single IP NAT strategy is one of the most efficient ways to block internet access through your router. Normally, you allow internet access to all the IP blocks or a specific IP block by NAT configuration. But using single IP NAT strategy, you can allow internet access to a specific IP address. So, if any user wants to use internet, he/she must inform you to allow him. Otherwise he/she cannot access internet through your router. Single IP NAT strategy was discussed in my previous article. Spend some time to study that article and try to apply single IP NAT strategy in your network. I hope, it will be helpful to block unauthorized internet access in your network.

Internet Access Based on MAC Address

MAC (Media Access Control) is a unique identity to any IP devices. So, using MAC address, you can easily prevent unauthorized access to your router. MikroTik router provides various ways by which you can easily filter MAC address of any IP device and allow internet access to this device. Usually, MAC address can be filtered by below three ways in MikroTik router and can be limit internet access.

  • Internet access based on MAC address with PPPoE server
  • Internet access based on MAC address with static DHCP server
  • MAC address binding on interface

Internet Access Based on MAC Address with PPPoE Server

PPPoE server helps to assign IP address to any user using username and password. PPPoE server is popularly used in local ISP network. MAC address filtering can easily be applied in PPPoE server while creating PPPoE secret that means client’s username name and password. If MAC address filtering is applied in PPPoE server, then username, password and MAC address must be matched to get IP address and other IP information from PPPoE server. How to enable PPPoE server and how to do MAC address filtering in MikroTik router was discussed in another article. Please spend some time to study PPPoE server configuration in MikroTik router if you wish to apply MAC address filtering with PPPoE server.

Internet access based on MAC address with static DHCP server

DHCP server is another easy way to assign user IP address and other IP information. Obviously, normal DHCP server configuration is not secure for your network. So, you should apply static DHCP server strategy where MAC address must provide to get IP address from DHCP server. But only static DHCP is not fully capable to secure your network because if any expert user assigns IP address manually, he/she will be able to access internet through your router. So, you should apply both single IP NAT strategy and static DHCP server strategy at the same time to get more secure network. To get more about static DHCP server, study my article about Static DHCP Server Configuration in MikroTik Router and try to apply in your network. I hope, this strategy will be very helpful for your network.

MAC Address Binding on Interface

MAC address binding on interface is another way to limit internet access based on MAC address. MAC address binding uses ARP (Address Resolution Protocol) property of an interface to respond to any IP device.  ARP is a protocol which is used to map IP network addresses to the hardware addresses or MAC address of any IP device. The term address resolution refers to the process of finding a hardware address or MAC address of a computer in a network. There are four types of ARP modes on an interface in MikroTik router. These are:

  • Disabled: If ARP feature is turned off on the interface, i.e., arp=disabled is used, ARP requests from clients are not answered by the router. Therefore, static arp entry that means IP address and MAC address of your router interface should be added to the client’s workstations. For example, if any user uses Windows workstation, he/she must use below arp command otherwise he/she cannot access internet through your router.
    C:\> arp -s 10.5.8.254  00-aa-00-62-c6-09
  • Enabled: This mode is enabled by default on all interfaces. ARPs will be discovered automatically and new dynamic entries will be added to ARP table if this mode remains enabled.
  • Proxy-arp: This mode is used to responds to an arp request on behalf of another router. This mode is commonly used in VPN connection.
  • Reply Only: If arp property is set to reply-only on any interface, then router will only reply to ARP requests. In this case, you have to add MAC address and IP address in ARP table otherwise your user will not get internet access although they assign IP address manually in their workstation.

So, if you set ARP reply only mode on any interface, you can filter user MAC addresses on that interface because until you map MAC address and IP address in ARP table, no user will be able to get internet access through your router although any expert user assign IP address manually in their workstation. Now the question is, how you can apply MAC address binding strategy in your MikroTik router. Don’t worry, in the rest of this article I will show you proper steps to apply MAC address binding strategy in MikroTik router.

Steps to Apply MAC Address Binding Strategy in MikroTik Router

Complete configuration to apply MAC address binding strategy in MikroTik router can be divided into below three steps.

  • MikroTik router basic configuration
  • Enabling reply only ARP on LAN interface
  • Mapping MAC address to IP address in ARP table

Steps 1: MikroTik Router Basic Configuration

Before going to apply MAC binding strategy, you have to do MikroTik router basic configuration. Basic configuration means assigning WAN, LAN and DNS IP addresses and configuring Gateway and NAT. MikroTik router basic configuration using winbox was explained in another article. If you are a new MikroTik user, spend some time to study that article and complete your MikroTik router basic configuration. Then, do the next step.

Step 2: Enable ARP Reply Only Mode on LAN Interface

After completing basic configuration, you need to apply ARP reply only mode on your LAN interfaces. To enable reply only mode, do the below steps carefully.

  • Click on Interfaces menu and then double click on your LAN interface. Interface property window will appear now.
  • From this window, choose reply-only from ARP dropdown menu and then click Apply and OK button.

Now your router is ready to reply only those devices whose MAC address is mapped in ARP table. So, if you want to allow any devices to get internet access, its MAC address must be entered manually in ARP table. In the next step, I will show you how to put static ARP entry in ARP table.

Step 3: Mapping MAC address to IP address in ARP table

After enabling reply only ARP mode, you must enter MAC addresses of your LAN devices in ARP table otherwise the devices will not be able to get internet access. Follow my below steps carefully to enter MAC address and associated IP address of any device in ARP table.

  • Go to IP > ARP ARP list window will appear now.
  • Click on add new button (PLUS SIGN) from this window. New ARP window will appear.
  • Put desired IP address in IP Address input box and MAC address of any user device in MAC address input box and then chooses your LAN interface from Interface dropdown menu. Click Apply and OK button now.
  • Do the above steps for all your LAN devices.

Now your MikroTik router is fully ready for MAC address filtering. So, any user of your network cannot get internet unless you allow them by entering MAC address in ARP table.

Proper steps to bind MAC address on LAN interface has been show above. However, if you face any problem to do the above steps properly, watch my video tutorial about MAC address binding on LAN interface carefully. I hope, it will reduce your any confusion.

Various ways to restrict internet access based on MAC address in MikroTik router has been discussed in this article. I hope, you are now able to prevent any unauthorized access in your network by filtering MAC address with MikroTik router. However, if you face any problem to design a MAC address filtering network with MikroTik router, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.

Why not a Cup of COFFEE if the solution?

restrict-internet-access-based-on-mac-address-in-mikrotik

ABU SAYEED

I am a system administrator and like to share knowledge that I am learning from my daily experience. I usually work on MikroTik, Redhat/CentOS Linux, Windows Server, physical server and storage, virtual technology and other system related topics. Follow Me: Facebook, Twitter and Linkedin.

Your name can also be listed here. Have an IT topic? Submit it here to become a System Zone author.

29 comments

  • Dear,
    very helpful and easy to understand,
    one more thing, if we create queue for whole network with “/”, like 192.168.0.0/24….and give limited bandwidth like upload 64k and download 64k then if someone gain unauthorized access to network then he/she will fall in that 64k category,,,,

    Thanks

    • Hi ihsan,
      Thanks for your tricks. But why will you take extra burden for unauthorized user? isn’t it better to reject them by MAC filtering?

      • Hi Sayeed,
        Is there any way to restrict only mikrotik local(LAN) IP address, means someone assigning mikrotik lan interface ip to own PC lan card,
        Thanks

      • Avatar for LIU XIAO MING LIU XIAO MING

        hello,I am LIU XIAO MING from CHINA.i am a administrator in a automobile 4S-shop.i have a MikroTik RouterBoard 1100Ahx4 main router and a MikroTik CRS326-24G-2S+RM 24-port main switch and a number of MikroTik CRS326-24G-2S+RM 24-port switchs.i have some questions for using net device.

        i want to ask:how do i submit my question for your answer on “systemzone.net” site.

        2019-10-30

  • Avatar for NORTHON KASONGA NORTHON KASONGA

    Hello,
    Great thanks for your tip. It helped me a lot.

  • Avatar for phos phos

    Thanks for your sharing. I got it and love this website.

  • Avatar for عصام العماري عصام العماري

    al slam alikom I am Essam, I have a network that distributes my device. My problem is when I come, I find the customers and take a Mac for one of the users. Dohul Net is authorized. Can users connect to the device?

    • If anyone collect known MAC, he or she cannot connect if your known user is already connected but otherwise he/she will be connected because windows provide a way to change mac address of any LAN card. But in this case, your known user will be disconnected. You need to have advance troubleshooting knowledge to solve this situation but can be solved this type of issue.

  • How to securing client witk mikrotik router from ip and mac address scanner ?Because other users can change mac address and ip from other clients. Cause, other client get warning ip conflict.

  • Avatar for Kadiravan Kadiravan

    Hi i have an mikrotik router i had blocked few sites in the firewall . When the user are send some mails its getting blocked int he outbox when i disable the webproxy the mails are going from outbox.

    could you suggest me how to by pass this user to full access.

    Thanks
    Kadiravan

  • Avatar for Xavier Xavier

    thanks, brother. Helped a whole lot.
    how do you block users trying to access restricted sites using Tor?
    many thanks for your wise counsel.

  • Avatar for SamSam SamSam

    Bonjour,
    J’ai un routeur D Link afin d’augmenter la porté de mon signal; mais j’aimerai que les personnes qui se connectent dessus puissent etre authentifiés par mon routeur Mikrotik. En se moment, ils se connectent sans aucune authentification MAC
    Merci pour vos conseils

  • Avatar for dipak dipak

    hi
    With this user can access internet if he manually sets IP. But i don’t want allow internet access until i allow IP in queue or in ARP.

    • Single IP NAT strategy does not allow any IP until you provide permission. MAC Address Binding on Interface does not allow any IP until its know MAC address. On the hand, in Static DHCP server, you have to use Single IP NAT strategy. Otherwise, if any user assign IP manually he/she will get internet.

  • Avatar for adil adil

    dear simple question

    what can i do with betternet vpn of Chrome plz tell me how to stop its using

  • Avatar for Tuuguu Tuuguu

    Hello there.
    How many IP&MAC binding devices possible in Mikrotik router or firewall? I need at least 200. Is it possible?

    • Its actually depend on your RB resources. You should have enough CPU and RAM to process your traffic. Also you should calculate your bandwidth to choose your RB specs.

  • Avatar for LIU XIAO MING LIU XIAO MING

    hello,I am LIU XIAO MING from CHINA.i am a network administrator in a automobile 4S-shop.i have a MikroTik RouterBoard 1100Ahx4 main router and a MikroTik CRS326-24G-2S+RM 24-port main switch and a number of MikroTik CRS326-24G-2S+RM 24-port switchs.i have some questions for using net device.

    i want to ask:how do i submit my question for your answer on “systemzone.net” site.

    2019-10-30

  • Avatar for tom tom

    Hi – could you show us how to do this is that interface is in a bridge?

  • Avatar for @jens_streubel @jens_streubel

    Hello,
    Great thanks for your tip. It helped me a lot.

Leave a Reply to phos Cancel reply

Your email address will not be published. Required fields are marked *

*