By default, RouterOS DHCP assigns an IP address to any client that requests one. To restrict access so that only registered (whitelisted) devices receive IP addresses, RouterOS provides two complementary mechanisms:
Static-only DHCP pool — the DHCP server only serves clients that have a pre-configured static lease entry. Unknown MACs receive no IP.
ARP enforcement — setting add-arp=yes on the DHCP server combined with arp=reply-only on the LAN interface prevents devices that self-assign IPs from communicating, closing the gap left by DHCP-only controls.
Together these controls ensure that only explicitly registered devices can get an address and communicate on the network.
Set the DHCP server’s address pool to static-only. This instructs RouterOS to refuse DHCP offers to any client that does not have a matching static lease.
/ip dhcp-server
set [find name="dhcp1"] address-pool=static-only add-arp=yes
Parameter
Value
Effect
address-pool
static-only
No dynamic pool — only static leases are served
add-arp=yes
enabled
Automatically creates an ARP entry for each active static lease
RouterOS 7 note: The authoritative property existed in RouterOS 6 but is not present in RouterOS 7. With address-pool=static-only, RouterOS 7 silently ignores DHCP requests from unknown MACs — no DHCPNAK is sent. This is the expected behavior and requires no additional configuration.
Step 2 — Create static lease entries for allowed devices
address-pool=static-only prevents unknown clients from obtaining an IP via DHCP, but does not stop a device from self-assigning an IP address. Combining add-arp=yes (Step 1) with arp=reply-only on the LAN interface closes this gap: the router only replies to ARP requests for addresses that are already in its ARP table (populated from active static leases), so self-assigned devices cannot reach the gateway.
For a bridge-based LAN (typical setup):
/interface bridge
set [find name="bridge-lan"] arp=reply-only
For a single LAN interface without a bridge:
/interface ethernet
set [find name="ether2"] arp=reply-only
Warning: After enabling arp=reply-only, any statically configured host (e.g., the router’s own management PC) must have a corresponding ARP entry. Add a static ARP entry if needed:
For environments that require strict Layer 2 access control (e.g., blocking unknown devices from any LAN traffic, not just routed traffic), use bridge filter rules to enforce a MAC allowlist.
Warning: Incorrect bridge filter rules can lock you out of the router. Configure with a fallback plan (console access or a scheduled reset script).
