The next procedure shows how to restrict an interface to a group of PPPoE clients. Before performing this task, you need to obtain the real Ethernet MAC addresses of the clients you are assigning to the interface.
Some systems allow you to change the MAC address on the Ethernet interface. You should view this ability as a convenience factor, not a security measure.
Using the example that is shown in Example—Configuration for a PPPoE Tunnel, these steps show how to reserve one of dslserve's interfaces, hme1, to clients at MiddleCo.
Configure the access server's interfaces, as shown in How to Configure the Access Server's Interfaces for PPPoE.
Define services, as shown in How to Provide Services to Clients of the Access Server.
Create entries for clients in the server's /etc/ethers database.
Here is a sample entry for clients Red, Blue, and Yellow.
8:0:20:1:40:30 redether 8:0:20:1:40:10 yellowether 8:0:20:1:40:25 blueether
The sample assigns the symbolic names redether, yellowether, and blueether to the Ethernet addresses of clients Red, Yellow, and Blue. The assignment of symbolic names to the MAC addresses is optional.
In this file, device is the name of the device to be defined.
# vi /etc/ppp/pppoe.hme1 service internet pppd "name dslserve-hme1" clients redether,yellowether,blueether
dslserve-hme1 is the access server's name, which is used in matching entries in the pap-secrets file. The clients option restricts the use of interface hme1 to clients with the symbolic Ethernet names redether, yellowether, and blueether.
If you did not define symbolic names for client's MAC addresses in /etc/ethers, you can use the numeric addresses as arguments to the clients option. The advantage here is that you can use wildcards.
For example, you can specify the numeric address clients 8:0:20:*:*:*. This address allows access only to clients that are listed in /etc/ethers with MAC addresses that begin with the number 8:0:20.
# Red dslserve-hme1 redpasswd * Blue dslserve-hme1 bluepasswd * Yellow dslserve-hme1 yellowpassd *
The entries are the PAP names and passwords of clients that are allowed to run PPP over dslserve's hme1 interface.
For more information on PAP authentication, see Configuring PAP Authentication.