Switch configuration

[user234a]

Hi all, I am trying to learn network security to stop a user on my wifi who is not obeying the rules (streaming only no other users) I implemented open dns and have used my routers limited mac functionality to prevent others from gaining access and have set up static ips with only a certain number of ips needed to allow all devices to connect, the open dns certainly has stopped them accessing sites like a charm however it was this that tipped me off to the fact somebody else is using the network and and the only way possible to my limited knowledge would be for this person to pass his mac address on for someone to clone. I have done some research 802.1x certifcates radius server etc and decided I can get a managed switch with port security. but here is where I am a little confused, the switch will be configured to run one port to a access point how do I configure the switch to only allow one mac or multiple without clones from the AP and not shutdown the port if a cloning attempt occurs? probaly a very noob question this, any help or a pointer in th right irection would be appreciated .
ps. I fear the will soon start using a vpn to bypass dns blocking, can a protect li firewall/router and pfsense prevent this?

[veeg]

Hello

I will tag one of our members that can help..

@Malnutrition

[Malnutrition]

What you are asking goes above what I know, if it were a particular machine I could help lock it down.

As far as Mac address filtering that would be the best way to go, and a cloned Mac address could work but in my experience when there is a cloned device on at the same time it really slows things down for the cloned device, almost to the point of unusable.

There are programs that can block via hosts file, and I’m not certain that a VPN would circumvent that or not. That would not help with a phone tho… Also, you would need to install this on the persons machine and disable them being able to uninstall it.

https://www.sordum.org/8266/bluelifehosts-editor-v1-3/

https://www.sordum.org/7941/askadmin-v1-9/

Pretty much I do not think this is what you want, but just shooting in the dark here and maybe this will help you.

[user234a]

Thanks for trying to help Mal, I have since done some more study and answered my own questions. thread may be closed.

[PeterOz]

what answer did you come up with
so others may learn

[Bruce]

I would have suggested a Cisco Meraki or a Sophos XG firewall, coupled with a good managed switch, say by Ubiquiti and using their Controller software to lock down each port on the network.
but for home use, they are usually out of peoples price range.

[Bruce]

no responses, closing.