MikroTik router has a lot of features by which a network administrator can design his network as he likes. As a network administrator, sometimes you may need to allow internet access some specific devices. If other devices try to access internet, they will be rejected by your router. For example, say, you have configured a simple network like below diagram. In this network, you have configured WAN, LAN, Gateway, DNS and NAT. Also you have created queue rules for limiting bandwidth based on IP address. Now, if you have an expert user who knows networking can change his IP address and can consume unlimited bandwidth because you have created queue rules for specific IP addresses and also you have NATed all the IP blocks. Obviously, it is not a better and secure network design. Then, how can you prevent this unauthorized access in your network? Don’t worry. MikroTik has integrated a lot of features by which you can prevent this type of unauthorized access in your router. In this article, I will show you some strategies by which you can easily block unauthorized access in your network.

Limit Internet Access in MikroTik Router

As a network administrator, you often want to block unauthorized access in your network. Applying some strategies in your MikroTik router, you can easily prevent unauthorized access in your network. These strategies can mainly be divided into below two types.

• Single IP NAT Strategy
• Internet Access Based on MAC Address

Single IP NAT Strategy

Single IP NAT strategy is one of the most efficient ways to block internet access through your router. Normally, you allow internet access to all the IP blocks or a specific IP block by NAT configuration. But using single IP NAT strategy, you can allow internet access to a specific IP address. So, if any user wants to use internet, he/she must inform you to allow him. Otherwise he/she cannot access internet through your router. Single IP NAT strategy was discussed in my previous article. Spend some time to study that article and try to apply single IP NAT strategy in your network. I hope, it will be helpful to block unauthorized internet access in your network.

Internet Access Based on MAC Address

MAC (Media Access Control) is a unique identity to any IP devices. So, using MAC address, you can easily prevent unauthorized access to your router. MikroTik router provides various ways by which you can easily filter MAC address of any IP device and allow internet access to this device. Usually, MAC address can be filtered by below three ways in MikroTik router and can be limit internet access.

• Internet access based on MAC address with PPPoE server
• Internet access based on MAC address with static DHCP server
• MAC address binding on interface

Internet Access Based on MAC Address with PPPoE Server

PPPoE server helps to assign IP address to any user using username and password. PPPoE server is popularly used in local ISP network. MAC address filtering can easily be applied in PPPoE server while creating PPPoE secret that means client’s username name and password. If MAC address filtering is applied in PPPoE server, then username, password and MAC address must be matched to get IP address and other IP information from PPPoE server. How to enable PPPoE server and how to do MAC address filtering in MikroTik router was discussed in another article. Please spend some time to study PPPoE server configuration in MikroTik router if you wish to apply MAC address filtering with PPPoE server.

Internet access based on MAC address with static DHCP server

DHCP server is another easy way to assign user IP address and other IP information. Obviously, normal DHCP server configuration is not secure for your network. So, you should apply static DHCP server strategy where MAC address must provide to get IP address from DHCP server. But only static DHCP is not fully capable to secure your network because if any expert user assigns IP address manually, he/she will be able to access internet through your router. So, you should apply both single IP NAT strategy and static DHCP server strategy at the same time to get more secure network. To get more about static DHCP server, study my article about Static DHCP Server Configuration in MikroTik Router and try to apply in your network. I hope, this strategy will be very helpful for your network.

MAC Address Binding on Interface

MAC address binding on interface is another way to limit internet access based on MAC address. MAC address binding uses ARP (Address Resolution Protocol) property of an interface to respond to any IP device.  ARP is a protocol which is used to map IP network addresses to the hardware addresses or MAC address of any IP device. The term address resolution refers to the process of finding a hardware address or MAC address of a computer in a network. There are four types of ARP modes on an interface in MikroTik router. These are:

• Disabled: If ARP feature is turned off on the interface, i.e., arp=disabled is used, ARP requests from clients are not answered by the router. Therefore, static arp entry that means IP address and MAC address of your router interface should be added to the client’s workstations. For example, if any user uses Windows workstation, he/she must use below arp command otherwise he/she cannot access internet through your router.
  C:\> arp -s 10.5.8.254  00-aa-00-62-c6-09
• Enabled: This mode is enabled by default on all interfaces. ARPs will be discovered automatically and new dynamic entries will be added to ARP table if this mode remains enabled.
• Proxy-arp: This mode is used to responds to an arp request on behalf of another router. This mode is commonly used in VPN connection.
• Reply Only: If arp property is set to reply-only on any interface, then router will only reply to ARP requests. In this case, you have to add MAC address and IP address in ARP table otherwise your user will not get internet access although they assign IP address manually in their workstation.

So, if you set ARP reply only mode on any interface, you can filter user MAC addresses on that interface because until you map MAC address and IP address in ARP table, no user will be able to get internet access through your router although any expert user assign IP address manually in their workstation. Now the question is, how you can apply MAC address binding strategy in your MikroTik router. Don’t worry, in the rest of this article I will show you proper steps to apply MAC address binding strategy in MikroTik router.

Steps to Apply MAC Address Binding Strategy in MikroTik Router

Complete configuration to apply MAC address binding strategy in MikroTik router can be divided into below three steps.

• MikroTik router basic configuration
• Enabling reply only ARP on LAN interface
• Mapping MAC address to IP address in ARP table

Steps 1: MikroTik Router Basic Configuration

Before going to apply MAC binding strategy, you have to do MikroTik router basic configuration. Basic configuration means assigning WAN, LAN and DNS IP addresses and configuring Gateway and NAT. MikroTik router basic configuration using winbox was explained in another article. If you are a new MikroTik user, spend some time to study that article and complete your MikroTik router basic configuration. Then, do the next step.

Step 2: Enable ARP Reply Only Mode on LAN Interface

After completing basic configuration, you need to apply ARP reply only mode on your LAN interfaces. To enable reply only mode, do the below steps carefully.

• Click on Interfaces menu and then double click on your LAN interface. Interface property window will appear now.
• From this window, choose reply-only from ARP dropdown menu and then click Apply and OK button.

Now your router is ready to reply only those devices whose MAC address is mapped in ARP table. So, if you want to allow any devices to get internet access, its MAC address must be entered manually in ARP table. In the next step, I will show you how to put static ARP entry in ARP table.

Step 3: Mapping MAC address to IP address in ARP table

After enabling reply only ARP mode, you must enter MAC addresses of your LAN devices in ARP table otherwise the devices will not be able to get internet access. Follow my below steps carefully to enter MAC address and associated IP address of any device in ARP table.

• Go to IP > ARP ARP list window will appear now.
• Click on add new button (PLUS SIGN) from this window. New ARP window will appear.
• Put desired IP address in IP Address input box and MAC address of any user device in MAC address input box and then chooses your LAN interface from Interface dropdown menu. Click Apply and OK button now.
• Do the above steps for all your LAN devices.

Now your MikroTik router is fully ready for MAC address filtering. So, any user of your network cannot get internet unless you allow them by entering MAC address in ARP table.

Proper steps to bind MAC address on LAN interface has been show above. However, if you face any problem to do the above steps properly, watch my video tutorial about MAC address binding on LAN interface carefully. I hope, it will reduce your any confusion.

Various ways to restrict internet access based on MAC address in MikroTik router has been discussed in this article. I hope, you are now able to prevent any unauthorized access in your network by filtering MAC address with MikroTik router. However, if you face any problem to design a MAC address filtering network with MikroTik router, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.