My ISP provide username-password for authentication and also register the client's MAC address for authentication.
I am concerned about someone misusing my connection while I am not using it. Usernames are easy to guess (clients can't change usernames, only passwords can be changed) and if anyone finds MAC address and password, they can use my connection.
Now, the ISP don't use private VLAN, so MAC addresses are easy to get. A simple ARP broadcast requests from a host within my subnet will reveal my MAC and I am not relying on password because the authentication page doesn't use HTTPS. So, my passwords are sent in plain text.
In this scenario, I want to block/drop/reject ARP request (or any broadcast requests) from any host within my subnet but the gateway.
I have looked this question and this question but the OP tried to block all ARP requests. Of course, this is a bad idea because then I won't get any internet traffic from the gateway. I just want to block ARP request (if possible any broadcast request) from any random host in my subnet, but only allow broadcast/ARP from my gateway.
I am using OpenWrt in my wireless router. So, I think Linux solutions will work and if possible, please also provide Windows solution.