Some Question Tricky

First of all thanks for those kind info . my questions are : * what is the best way to reject all user packets except those who is registered to server . * I need to bind voucher accounts to mac address those are first use the voucher what is the best way to do ? * I have repeated problem that use of MAX-ALL-SESSION for the hotspot usually reject with this message :" Your maximum never usage time has been reached " I try to undestand the problem with no luck . Thanks For generous kind