# MAC-based port security with OpenWrt on BotBlox routers **URL:** \ **Category:** BotBlox Software\ **Created:** [November 2, 2026, 6:42pm UTC](https://forum.botblox.org/t/mac-based-port-security-with-openwrt-on-botblox-routers/669 "2026-11-02T18:42:11Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![botblox\_admin](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.botblox.org/botblox_admin/32/1_2.png) [@botblox\_admin](https://forum.botblox.org/u/botblox_admin)\ **Post date:** [November 2, 2026, 6:42pm UTC](https://forum.botblox.org/t/mac-based-port-security-with-openwrt-on-botblox-routers/669/1 "2026-11-02T18:42:12Z")
Can I restrict each Ethernet port to specific MAC addresses, either entered manually or learned during setup? I also need unauthorized traffic blocked, the option to disable a port after a violation, settings retained after reboot, and logs showing the offending port and MAC address. How would I configure this, and where is the documentation? ---
**Author:** ![botblox\_admin](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.botblox.org/botblox_admin/32/1_2.png) [@botblox\_admin](https://forum.botblox.org/u/botblox_admin)\ **Post date:** [November 2, 2026, 6:43pm UTC](https://forum.botblox.org/t/mac-based-port-security-with-openwrt-on-botblox-routers/669/2 "2026-11-02T18:43:18Z")
Standard Puck Edge and Puck Maxi firmware does not currently provide this feature set. An OpenWrt-based router provides standard Linux networking tools for implementing these policies. Our OpenWrt platforms include: - [SwitchBlox Rugged](https://shop.botblox.com/products/rugged-ethernet-switch) with [Rugged SOM](https://shop.botblox.com/rugged-som): 5 × 10/100BASE-T. - [RouterCore Module](https://shop.botblox.com/routercore-module/): 16 × 1GBASE-T and 3 × 10G SerDes. - [RouterCore Nano](https://shop.botblox.com/routercore-nano/): 8 × 1GBASE-T and 2 × 10G SerDes, currently in development. We lean on upstream OpenWrt, Linux and nftables documentation for configuration guidance. These are standard networking components, rather than a proprietary BotBlox port-security interface. Hardware enforcement and event support depend on the platform and firmware. **1. Configure authorized MAC addresses** Connect using the [OpenWrt SSH guide](https://openwrt.org/docs/guide-quick-start/sshadministration). For RouterCore Module, Linux bridge locked ports and approved forwarding-database entries provide the hardware-enforced approach. In the [bridge command reference](https://man7.org/linux/man-pages/man8/bridge.8.html), see “bridge link” → “locked”, and “bridge fdb” → “add”, “replace” and “static”. The [Linux bridge guide](https://www.kernel.org/doc/html/latest/networking/bridge.html#bridge-port-netlink-attributes), under IFLA\_BRPORT\_LOCKED, explains the behaviour. **2. Learn and retain permitted addresses** Learning should be a deliberate setup step: connect the intended devices, record their MAC addresses against their ports, save those mappings, then stop accepting new addresses. See IFLA\_BRPORT\_MAB in the Linux bridge guide and “mab” in the bridge command reference. MAB reports newly seen addresses for an authorization policy to approve. It does not automatically make every new device trusted. Use [UCI](https://openwrt.org/docs/guide-user/base-system/uci) for persistent configuration and [procd](https://openwrt.org/docs/guide-developer/procd-init-scripts), under “Defining service instances”, for the enrollment/event handler. This policy is a script or service using standard tools, rather than a single ready-made setting. **3. Block traffic or disable the port** Locked ports reject unauthorized sources. If the required violation event is exposed by the driver, a handler can also take the whole port down until an administrator resets it. See “ip link set” → “up/down” in the [interface command reference](https://man7.org/linux/man-pages/man8/ip-link.8.html). **4. Restore settings and log violations** Restore saved MAC mappings and policies before enabling protected ports after a restart. For software filtering and logging, see [nftables bridge filtering](https://wiki.nftables.org/wiki-nftables/index.php/Bridge_filtering) and [Logging traffic](https://wiki.nftables.org/wiki-nftables/index.php/Logging_traffic), particularly “Log flags” → “ether” and “Queueing logging to userspace”. Software logging only sees traffic reaching that filtering path. Persistent nftables rules are covered in [OpenWrt Firewall configuration](https://openwrt.org/docs/guide-user/firewall/firewall_configuration#includes_2203_and_later_with_fw4), under “Includes (22.03 and later with fw4)”. We can assist with setup, while the upstream documentation and [OpenWrt community forum](https://forum.openwrt.org/) provide resources for general configuration questions. The open ecosystem lets you develop and maintain your configuration without depending on a proprietary BotBlox interface.