I locked down my whole network’s MAC addresses so that only NICs on the whitelist can get an IP from the AirPort Extreme DHCP server and router. Well, guess what. A Mavericks VM with a completely different MAC address from its hosts MAC address can request an IP through its host’s sanctioned MAC address connection, and the AirPort Extreme will hand over a viable and working IP to a VM with MAC address NOT on the white list, and that now connected VM can see the whole LAN and Internet, even though its own MAC address is NOT on the white list! This appears to be a glaring security hole. Is it? For instance...
Now that I have an IP, I can clone myself, and try to run independent of the host which created and holds my VM's data structures. In my case, the host had 10.0.1.16, and the VM got 10.0.1.100 (my forced pool of at least 1 spare IP as dictated by the AirPort Extreme). I’m not sure that once I have an IP, if the MAC address is checked again for communication to the LAN, but why would it? The DHCP has allocated an IP to a device, and that device can now talk as if it is the true host that was given the IP.
We used to use other hosts’ IPs all the time when I worked at Boeing - the ones that we knew were offline; we just borrowed their IPs to eliminate lots of paperwork to test various flight control systems. :-)
But the bottom line is that at a minimum, through a connected host, I am able to get an IP and use a network, even though MAC filtering is turned on, and my own host is not on the whitelist.
In my opinion, this is a problem. I’m not sure where the fault lies at this point. Could it be with the DHCP protocol itself? I don’t know, but as time permits, I will investigate it. I am certain that given enough time, I can exploit this, and take over my own network. How do I stop this from happening? I have other WiFi routers that I could give this a try with, but at this point, can anyone with a better understanding of WiFi, DHCP, routing, etc. please advise me as to whether this is a real problem to concern myself over.