Have you brought a super ultra hi-end access point that only worked ok with all security settings off? You are not the only one. This seems a little bit strange, but the connection is perfect and the signal strenght very good when no security is enabled in the access point. The things start turning very bad when you enable MAC filtering, for example.
At this point, you probably ask me: MAC filtering serves me something? ou better, MAC filtering is known to be ridiculously ease to bypass, what a waste of time?
The point is, even being so simple, a filtering like that will stop the casual user from messing things around. But this discussion is not the focus of this post, the aim here is to create a server side MAC filtering, letting to the AP the task to bridge diferent transmission medias only.
The solution presented here makes use of a FreeBSD box, which should be your current gateway or another machine. We start disabling MAC filtering on the AP to avoid “strange” problems. Then, we must configure our firewall in order to let DHCP packets flow freely, in and out. The extract below shows how the PF firewall should be configured.
pass in quick on $wireless_if inet proto udp from $wireless_net to any port bootpc
block in on $wireless_if
pass in on $wireless_if inet proto tcp from <wireless_dyn_addrs> to any flags S/SA keep state
pass in on $wireless_if inet proto { udp icmp } from <wireless_dyn_addrs> to any keep state
