The setup:
[Devices on LAN]—>Mikrotik (RB951-2n)—>Router—>Internet
Devices on the LAN are in the range 192.168.0.20-200 (DHCP allocated), Mikrotik is .203, Router is .14
Now, I don’t control all the devices on the network - OS varies as well. DHCP is set to reject unknown MACs and allocate specific IPs to specific devices so that’s fine. DHCP server runs separate to the Mikrotik.
Lately, someone has cottoned on to the idea of a static IP that bypasses the Mikrotik and connects directly to the router, thus bypassing my restrictions.
I need to nip that in the bud but how?
All traffic is currently passing through the Mikrotik anyway - physically, there’s one ethernet cable going from Mikrotik to the router and nothing else so I feel like there should be a way to either:
a) Make queues and manage traffic based on MAC rather than IP (since IP can be changed)
or
b) Force all devices to use DHCP and reject traffic that doesn’t come from an DHCP enabled host
or
c) something else brilliant that’s obvious to you genius folk 
Any pointers or information would be gratefully received, thanks!