Under "Network > Firewall > Settings" the MAC address check can be activated. The MAC addresses of individual clients are entered under "Network > Intranet > Clients". Then every incoming packet is checked to see if it really comes from the MAC belonging to the IP. It also ensures that a MAC uses only the stored IP address.

If a client does not have a MAC, the MAC check ignores the IP address of that client. Also with IP ranges, no MACs can be stored or checked.

If IP and MAC do not match, any access is denied and logged with the identifier "BADMAC" in the messages log file.