Mmmmkaaaay... no.
.............Intarweb
..................|
LAN <=|> Firewall <|=> WLAN Router <=> WLAN Clients
And then some simple filters:
* by MAC
* by fixed IP per MAC (MACs alone are way too simple to forge, takes like 2 seconds)
* Match chain => MAC ! fixed IP per Hostname => REJECT
* If you're hardcore you can also make a finger match for the OS that HAS to run on that machine with that IP and exactly that MAC, or even funnier:
* Have a random high port open on your machines where you have a rsync daemon drop a keyfile every hour that has to be synchronized on the firewall (using rsync with private keys for each machine), and have a match condition on the exact file bytes
* I guess I could come up with about 200 more creative solutions how to fortify a network so literally no one without physical access can fsck with it, not even if they break the WAP/WEP/WPA/[...] encryption.
- Gil
P.S:
Being paranoid and overly securing things does not mean they are not watching me!!