OPNSense noob here. Just installed it. I'm somewhat passable with routers and whatnot, but this is all very new to me.
On my ISP provided router there was an option to deny network access to unknown devices/MACs - I would like to replicate this behavior on OPNSense if possible.
Can someone help me, or point me in the right direction? I know that denying a DHCP address is pretty useless if someone manually assigns themselves an IP, but what about putting all unknown MACs into an isolated subnet? or similar?
Is there any way to achieve this?
Thank you! :)
You can set a static arp flag onto an interface, afterwards you can manually add the mac address(es) allowed to communicate.
But just as well as users can spoof an IP they can spoof a MAC address if they can scan the network.
So you also need a switch/AP that isolates clients on L2 from each other anyway (L2 client isolation).
It's probably not worth it (for a home network)
If its a guest network, the captive portal can help if each user gets their own password:
https://docs.opnsense.org/manual/captiveportal.html
How would I go about setting a static arp flag on an interface?
I have everything going through one interface I called "lan0"
Just saw its not possible currently without using the ISC plugin, and I wouldnt recommend starting to use it since its EOL.
So you have to wait until its implemented as a normal interface setting again:
https://github.com/opnsense/core/issues/9659
Ahh, hmm, ok.
Then I will try to lock it down from my wifi mesh, and wait for later. Ostensibly no one is breaking into my house to plug into my network lol.
Thank you for your assistance. I will keep learning and wait till that's available in Kea.
Thank you!
Wait, would this work? And if so, how best to implement it? Also, might it work for different subnets?
https://docs.opnsense.org/manual/neighbors.html
No, as I said the interface needs the static arp flag, otherwise static assignments are just additional entries in the arp table (they dont enforce "only these are allowed" without that flag)
Its essentially this (search for "staticarp"):
https://man.freebsd.org/cgi/man.cgi?query=ifconfig
The GUI currently lacks a way to set it, as referenced in the github issue.
Ahhhhh okay. Thank you again for your help!
The clarity is much appreciated, so I don't keep banging my head against this needlessly.
You could look into the zenarmor plugin I think it can whitelist new devices. But not an expert with it.
Good luck :)
You can still - and possibly your ISP router did not do more than that - disable DHCP for unknown MAC addresses and add all clients explicitly and statically. While not a strong security measure against an experienced attacker it will still puzzle the occasional wardriver who somehow got hold of your WiFi secret. It will also keep out phones that change MAC addresses as a privacy measure etc. until you configure them to not do that.
People with the correct secret can still authenticate to your WiFi, try to catch some broadcast traffic, and give themselves a static IP address. But it's better than nothing.
Best if combined with client isolation on your access point.