I haven't decided yet if I *should* do this, but I want to figure out if I *can*. I always tell people to give me the MAC address of anything they want to have a static IP. Printers, NAS, etc. They don't, and just hard-code everything.

Then a year later they get mad when the router or DNS or something changes and their device doesn't work anymore. To prevent this, I'd like to come up with a way to have iptables stop any address that didn't come from my DHCP server. Ideas, anybody?

You can have the DHCP server add the clients to an Address List, then have that address list allowed to access the WAN.

Check this out, it might work for you:
http://wiki.mikrotik.com/wiki/How_to_bl ... e_firewall