Block MAC after access point

Internet ( 192.168.1.1 )
|
SPBM

TP-Link AP rule .....Both 100 KB/s TCP/UDB AP W&WL MAC Any:any Lan

Block all rule .........Both Blocked TCP/UDB 192.168.0.0-192.168.255.255:any Any:any Lan
|
TP-Link AP
|
WIFI ( 192.168.0.1 )
|
User ( 192.168.0.x )


After the access point many users can access the Internet with the 100 KB/s speed I set. How can I block MACs after AP?

What are you trying to achieve?

Your first rule allows all communications with the AP, which may also include all clients behind it. It depends on whether the AP substitutes their MAC address with its own. If that's the case, the second rule does nothing.

Ok...
All wire clients have ip range 192.168.1.X work fine and the block rule prevent any new MAC from access to the Internet.
All wireless clients after AP can access the Internet and the block rule only affect on the AP mean that I can control the whole AP bandwidth.

The question here how the block rule will work with clients ip range 192.168.0.X that AP DHCP give to them?

I remove all rules and I let only block rule.
Block all rule .........Both Blocked TCP/UDB 192.168.0.0-192.168.255.255:any Any:any Lan

I need to connect AP to the SPBM Lan Nic and block any wireless clients expect other that I add there MAC to with ip range 192.168.0.X

Thanks

The question is whether the AP conceals client MAC addresses or not.

In order to find out, create a rule with tracking turned on. With tracking enabled you can see what IP addresses and MAC addresses reach BM:

I try to make this rule, but I don't know which (Protocol, Source, Destination, Tracking mode) I should chose.
So please can you explain more?

OK...
I created a rule:
Monitor Both Unlimited IPv4 based 192.168.1.2 - 192.168.1.254 Any Lan Tracking mode IP address for each source

I search the network with SPNS and found that every pc behind the AP have the AP MAC. Now we know that the AP changed the clients MAC to the AP MAC. So what is the next step?

Well if the AP conceals all client MAC addresses under its own, you have to either configure it not to do so, or allow/block clients based on their IP address (that's provided the AP doesn't substitute their IP addresses also).

It's all about AP configuration...
In my case I have Nanostation M2 configure as AP after BM and TP-Link AP configure as Repeater. Now BM see all clients MAC after TP-Link AP. The problem was in TP-Link AP configuration, after change it to repeater every thing is going ok.

Thanks