> the first user will authenticate. the second user (different IP addy than
> the first) will also be forced to authenticate, but the moment his
> authentication passes, he'll be let in and the first user will be locked
> out. as the MAC address (which would be the router's) is now bound to a
> different IP address.
>

Does it have to work this way? Could it be modified to create allow rules
only based on IP? Could be a checkbox (default to off of course for original
behaviour)...

Couldn't there be other cases where you might want to allow this to work in
a captive portal situation?

Where perhaps you have multiple routers on the internal network?

hmmmm

Could role my own for this special purpose, just thought this seemed like
99% of the way there

m/