Support for MAC Address Filtering by Masks and Ranges

[Alex Quaken]

Feature Request: Support for MAC Address Filtering by Masks and Ranges

Introduction Currently, my routers allow me to control wireless network access using allowlists (“White List”) and blocklists (“Black List”) based on device MAC addresses. While this works for basic cases, it becomes inconvenient in larger networks or when frequent adjustments to access settings are required.

Proposed Feature I propose adding the ability to filter MAC addresses using masks and/or ranges. This would allow managing access not on a per-device basis but for entire groups of devices with similar MAC addresses.

Why This Matters

1. Ease of Management

   • If the network contains many devices from the same manufacturer (with identical MAC address prefixes), a single rule could replace dozens of individual entries.

2. Scalability

   • For large or dynamic networks, this tool would simplify the management process, as working with ranges or masks is far easier than maintaining a long list of addresses.

3. Improved Security

   • The ability to define precise filters for groups of devices helps ensure better control over who can connect to the network.

4. Suitable for IoT and Office Networks

   • Devices from the same manufacturer often have similar MAC address patterns. Filtering by masks and/or ranges would make managing such devices more efficient.

5. Management of Randomized MAC Addresses

   • This feature would make it possible to allow or block all devices with randomized MAC addresses, or permit connections only for devices using static ones. Currently, this is nearly impossible to achieve without relying on external services. However, implementing this directly in the routers seems feasible and would not require significant technical or human resources.

How It Could Work

• MAC Address Masks: An entry like 00:1A:2B:XX:XX:XX would cover all devices within the specified range.

• MAC Address Ranges: Users could specify a start and end MAC address, such as 00:1A:2B:00:00:00 – 00:1A:2B:FF:FF:FF.

• Interface: Add fields in the access control settings for inputting masks and/or ranges, ensuring the feature remains intuitive.

Conclusion Supporting masks and/or ranges for MAC address filtering would make network management more convenient, flexible, and secure. This is especially important for modern networks where the number of connected devices continues to grow.

[Le ecureuil]

MAC addresses ranges are allocated just per-vendor and rather randomly. To be honest, I don't understand where one can use ranges. Do you want to block all Realtek devices, but to allow all Intel ones? Sounds strange.

[Alex Quaken]

The main goal is to block connections from clients with randomized addresses and, conversely, allow only clients with randomized addresses. Ranges are more of an additional functionality, although blocking devices from a specific vendor based on their IEEE OUI database could also be useful in some cases. Implementing filtering by mask is simpler and more preferable for most cases.

Edited January 6 by Alex Quaken

[Denis P]

On 1/6/2025 at 4:35 PM, Le ecureuil said:

MAC addresses ranges are allocated just per-vendor and rather randomly. To be honest, I don't understand where one can use ranges. Do you want to block all Realtek devices, but to allow all Intel ones? Sounds strange.

since auto registration of devices without random mac is already implemented it would be convenient to have smth like "drop clients with random mac" black list option

[PriSonerS61]

I support this. I also want to prevent devices with random mac address from connecting to my network. Maybe put a checkbox in the segment settings like "prevent devices with random mac address from connecting". It works like Wireless ACL and when enabled, devices with a random mac address cannot connect to that network/segment.

I did some research on the internet and this is how you can tell if the match address is random or not. I don't know how true it is...

"If the 2nd character in a mac address is 2, 6, A or E, that mac address is randomly generated."

 

[MDP]

You can have multiple DHCP servers on the same network segment. Accordingly, it is possible for each vendor to receive different settings.

[Le ecureuil]

So the real feature request sounds as "don't lease the IP address to the host with the installed local-administrated bit in address". Sounds interesting, will reconsider this.

[Alex Quaken]

The main idea is to add the ability to reject connections based on MAC address patterns (masks) in cases where white/blacklists are not flexible enough for configuration.