Re: Blocking machines by both Mac Address and IP address

[Andrew Beverley <andy@andybev.com>]

On Sat, 2010-10-23 at 17:19 -0500, Scott Mayo wrote:
> I have my DHCP server setup so that it hands out IP adresses according
> to a machine's Mac address.  Is there a way to deny traffic to the
> internet by both MAC address and IP address?
> 
> i.e.  If MAC address 00:11:22:33:44:55 is given IP address 192.168.0.1
> by DHCP then that should be the only combo that can get to the outside
> world.  If the IP address is changed to something else or if another
> machine that has a different MAC address is given the IP address
> 192.168.0.1 statically, then in neither situation should the machine
> be able to get out to the world.

Something like this...


Set your default policy to drop:

iptables -t mangle -P FORWARD DROP

Then set up a rule for each client that matches both IP address and MAC:

iptables -t mangle -A FORWARD -s 1.2.3.4 \
	-m mac --mac-source aa:aa:aa:aa:aa:aa -j ACCEPT



Andy