Is a MAC address filter incompatible on an extended network?

Question

Hello all,
I've bought myself an Airport Express and an Airport Extreme.
The Express serves two roles:
1. Play music
2. Extend my network (a real extension, not just a network join)
On my Extreme, I've setup MAC address filtering with a time-based access (to avoid hacking of my network during the night -- don't worry, I have WPA2 security too...). Here's what I've done:
- All devices: no access from 11 PM to 7 AM
- Airport Express: always access
- Macbook Pro: always access
So far, so good.
Now, the problem I see if the following: IF my Express has access anytime, then an unknown device CAN connect to my network at night (midnight for example) simply because it will connect on my Express instead of my Extreme! It's like an unlocked back door!
So, from what I see, when I extend a network, the MAC filtering is not passed along to the "extending" devices. Also, on an extended network, I CAN'T set a MAC filter... So I'm stuck with an unsecure extending device.
So, my question is the following: is this normal behavior or is this an oversight from Apple? In other words, how can I extend my network and "propagate" my security setting on all my devices?
Thanks!
P.-S. On another topic, but related, any idea how to apply a setting without rebooting the router everytime? This is very annoying.

Answer 1

HI Yes this works fine. I have these  wifi base stations these configurations on the same subnet in my place *using MAC filtering (access control)* in two extended networks.. Here's how I do it.
• AEBS 802.11n@5Ghz 9DHCP and WAN.. and MAC ADDRESSES. TimecapsuleTV = SSID="my5Gwifi" , closed network
• 1 x AEBS 802.11g 2.4Ghz snow coloured dome base station (connected through ethernet to the main 802.11n AEBS) + 2 x 802.11g APx's + 802.11N APX; closed network; name | SSID ="my2.4Gnetwork"; all bridge mode. FOr WDS add all MAC addreses of all devices like iphones, ipods, macs, pea-seas, PS2's etc and the other APX base stations too!.
Here's the deal:
for the 802.11N base stations (AEBS . TC or APX gen 2), the extensible wifi stations are through '+extend this network+" in the + Airport Utility+.. There is no provision for the extension stations to addf any ACCESS control if you use BRIDGE MODE> (as I would you to do advise).
• for the *802.11g or WDS* I have found that you must ADD all the MAC addresses in EACH of the base statsion. This is simple to do my exporting all teh mac address config lists and importing them as you need. THis works fine.
My company registers world wide all laptop wireless nics. We have over 300,000 employees (3 x 10**5) all dynamically VPN'ed adn mac address filtered for windows , linux and unix. it works for them worldwide. Walk into any office and you are connected.
As for me and others WEP, WPA2 and all that is a mess around for hours (with that awful redmond based software) with frustrating and a huge waste of time when some one tries to connect to your system with some of those ghastly microsoft opertating systems. They all have their quirks. Vista - well you mostly know.
In any case the simplest and I beleive effective for most is MAC ADDRESS fitering.
FWIW all ways can be infiltrated.. you just need to monitr your network or add a GBE hub and use cables where the cables are in a locked oom.
hth
w