Hi all,

There are someone trying to use my network illegally. I discovery this because I'm running the arpwatch software in a FreeBSD machine and this software tell me via email the IP address changes on the network.

I can't block the registration this MAC address because it's behind of the ethernet inteface of my Mikrotik than I did a firewall rule drop the connections of the MAC address:

add chain=forward src-mac-address=00:40:F4:4E:92:4C action=drop

I think that this rule block the traffic from the MAC address but the arpwatch continues to detect the IP address changes...

How can I block all traffic from one MAC address completly?

Thanks in advance

Fabrício F. Kammer
Conchal/SP Brazil

that should work as long as it's one of or is the first rule.

it will only block traffic going -through- the bridge.

however, it is possible that it's a spoofed request

try to set ... and just add ip address and mac address in static ARP .. IP address and MAC address change in this code to your valid IP and MAC address, this works in 2.9.x