Can I restrict each Ethernet port to specific MAC addresses, either entered manually or learned during setup? I also need unauthorized traffic blocked, the option to disable a port after a violation, settings retained after reboot, and logs showing the offending port and MAC address.
How would I configure this, and where is the documentation?
Standard Puck Edge and Puck Maxi firmware does not currently provide this feature set. An OpenWrt-based router provides standard Linux networking tools for implementing these policies.
Our OpenWrt platforms include:
We lean on upstream OpenWrt, Linux and nftables documentation for configuration guidance. These are standard networking components, rather than a proprietary BotBlox port-security interface. Hardware enforcement and event support depend on the platform and firmware.
1. Configure authorized MAC addresses
Connect using the OpenWrt SSH guide.
For RouterCore Module, Linux bridge locked ports and approved forwarding-database entries provide the hardware-enforced approach. In the bridge command reference, see “bridge link” → “locked”, and “bridge fdb” → “add”, “replace” and “static”.
The Linux bridge guide, under IFLA_BRPORT_LOCKED, explains the behaviour.
2. Learn and retain permitted addresses
Learning should be a deliberate setup step: connect the intended devices, record their MAC addresses against their ports, save those mappings, then stop accepting new addresses.
See IFLA_BRPORT_MAB in the Linux bridge guide and “mab” in the bridge command reference. MAB reports newly seen addresses for an authorization policy to approve. It does not automatically make every new device trusted.
Use UCI for persistent configuration and procd, under “Defining service instances”, for the enrollment/event handler. This policy is a script or service using standard tools, rather than a single ready-made setting.
3. Block traffic or disable the port
Locked ports reject unauthorized sources. If the required violation event is exposed by the driver, a handler can also take the whole port down until an administrator resets it. See “ip link set” → “up/down” in the interface command reference.
4. Restore settings and log violations
Restore saved MAC mappings and policies before enabling protected ports after a restart.
For software filtering and logging, see nftables bridge filtering and Logging traffic, particularly “Log flags” → “ether” and “Queueing logging to userspace”. Software logging only sees traffic reaching that filtering path.
Persistent nftables rules are covered in OpenWrt Firewall configuration, under “Includes (22.03 and later with fw4)”.
We can assist with setup, while the upstream documentation and OpenWrt community forum provide resources for general configuration questions. The open ecosystem lets you develop and maintain your configuration without depending on a proprietary BotBlox interface.