wifi

I don't know what's happening to your DHCP, but I know a few things about wireless security.

If someone is trying to get into your network via wireless, and that person knows what he/she is doing, it's too late for ACL's!
This person already know all MAC's connected to your AP.
The short technical explanation for this is that an attacker, would send something called "deauthentication requests" to your AP, and listen for the clients trying to connect again, and get your MAC addresses.

Like someone said earlier in this thread "changing MAC is trivial".

Here is what I suggest:

1. Change your wifi-password (only use WPA2-personal, and only AES). And make it a long one!
2. Consider setting up a Radius server for wifi-client authentication on your network :-) (Please don't ask me how, yet.)

Good luck...

edit
Like I just said, I don't have a Radius server, yet, but I'm planning on it.
Someone wise on this forum once said; "take small steps".
This is _very_ true if you are a first time pfSense user, like me.

As of now, before pfSense, my personal wifi safety routine is as follows:

I only use WPA2 with AES. If someone comes to me with an old Mackbook or Windows XP machine that only supports TKIP, I tell them to piss off and buy a new machine ;-).
I use a 55 character randomly generated password, that I change _once_ a month!
I email my friends/clients the new password a day before I change it.
I also make a QR Code that's easy to scan using this service: http://blog.qr4.nl/QR-Code-WiFi.aspx
When I have guests, I power up a cheap Wifi-router (WR841N) with an open network. This is configured as a "isolated AP". When they leave I unplug it.

PS. I will argue that the words wireless and security should never be mentioned in the same sentence or document.
/edit