iprange and mac-source

iprange and mac-source

[Kenneth Kalmer]

Guys

I'm having some difficulty getting the following rules to work:

These chains are used in both the INPUT and FORWARD chains of the filter table:

# Log/Drop chain for ip/mac address mismatches
$IPTABLES -N ADDRESSMISMATCH 2> /dev/null
$IPTABLES -F ADDRESSMISMATCH
$IPTABLES -A ADDRESSMISMATCH -j LOG --log-level $LOG_LEVEL -m limit
--limit $LTIME --log-prefix "Firewall (IP/MAC mismatch) "
$IPTABLES -A ADDRESSMISMATCH -p tcp -j $TCP_RESPOND
$IPTABLES -A ADDRESSMISMATCH -p udp -j $UDP_RESPOND
$IPTABLES -A ADDRESSMISMATCH -j DROP

# Now verify all MAC/IP combos
$IPTABLES -N VERIFYMAC 2> /dev/null
$IPTABLES -F VERIFYMAC
$IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
192.168.10.1-192.168.10.10 -m mac --mac-source 00:0b:6a:a0:0a:7f -j
RETURN
$IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
192.168.10.31-192.168.10.40 -m mac --mac-source 00:02:e3:55:85:f5 -j
RETURN
$IPTABLES -A VERIFYMAC -j ADDRESSMISMATCH

Every single packet traverses the chain all the way down to
ADDRESSMISMATCH, no packets match...

The scenario is that each user can have multiple MAC addresses
(laptops, pda's & pc's). The DHCP will always issue the same range to
the same MAC addresses, each user get's their own pool own 10 IP's.

I'm trying to avoid matching 10 ip's to each MAC address. I'm under
the impression that this will adversely affect performance. We already
have 80 users on the network, 800 possible ip's and already 110 mac
addresses. The VERIFYMAC chain above will get too big or is this not a
problem.

Is the one-to-one match the only solution, or am I missing the plot here?

Thanks in advance!

-- 

Kenneth Kalmer
kenneth.kalmer@gmail.com
http://opensourcery.blogspot.com

Re: iprange and mac-source

[Mohamed Eldesoky]

You wrote:
$IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
192.168.10.31-192.168.10.40 -m mac --mac-source 00:02:e3:55:85:f5 -j
RETURN

This doesn't seem like every user can have multiple MACs !!!



On Mon, 7 Mar 2005 01:38:46 +0200, Kenneth Kalmer
<kenneth.kalmer@gmail.com> wrote:
> Guys
> 
> I'm having some difficulty getting the following rules to work:
> 
> These chains are used in both the INPUT and FORWARD chains of the filter table:
> 
> # Log/Drop chain for ip/mac address mismatches
> $IPTABLES -N ADDRESSMISMATCH 2> /dev/null
> $IPTABLES -F ADDRESSMISMATCH
> $IPTABLES -A ADDRESSMISMATCH -j LOG --log-level $LOG_LEVEL -m limit
> --limit $LTIME --log-prefix "Firewall (IP/MAC mismatch) "
> $IPTABLES -A ADDRESSMISMATCH -p tcp -j $TCP_RESPOND
> $IPTABLES -A ADDRESSMISMATCH -p udp -j $UDP_RESPOND
> $IPTABLES -A ADDRESSMISMATCH -j DROP
> 
> # Now verify all MAC/IP combos
> $IPTABLES -N VERIFYMAC 2> /dev/null
> $IPTABLES -F VERIFYMAC
> $IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
> 192.168.10.1-192.168.10.10 -m mac --mac-source 00:0b:6a:a0:0a:7f -j
> RETURN
> $IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
> 192.168.10.31-192.168.10.40 -m mac --mac-source 00:02:e3:55:85:f5 -j
> RETURN
> $IPTABLES -A VERIFYMAC -j ADDRESSMISMATCH
> 
> Every single packet traverses the chain all the way down to
> ADDRESSMISMATCH, no packets match...
> 
> The scenario is that each user can have multiple MAC addresses
> (laptops, pda's & pc's). The DHCP will always issue the same range to
> the same MAC addresses, each user get's their own pool own 10 IP's.
> 
> I'm trying to avoid matching 10 ip's to each MAC address. I'm under
> the impression that this will adversely affect performance. We already
> have 80 users on the network, 800 possible ip's and already 110 mac
> addresses. The VERIFYMAC chain above will get too big or is this not a
> problem.
> 
> Is the one-to-one match the only solution, or am I missing the plot here?
> 
> Thanks in advance!
> 
> --
> 
> Kenneth Kalmer
> kenneth.kalmer@gmail.com
> http://opensourcery.blogspot.com
> 
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: iprange and mac-source

[Mohamed Eldesoky]

I am refering that you actually matching a range of IPs against a single MAC !!



On Mon, 7 Mar 2005 17:05:21 +0200, Kenneth Kalmer
<kenneth.kalmer@gmail.com> wrote:
> On Mon, 7 Mar 2005 11:56:59 +0200, Mohamed Eldesoky
> <eldesoky.lists@gmail.com> wrote:
> > You wrote:
> > $IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
> > 192.168.10.31-192.168.10.40 -m mac --mac-source 00:02:e3:55:85:f5 -j
> > RETURN
> >
> > This doesn't seem like every user can have multiple MACs !!!
> 
> I can't exaclty paste 110 lines from the output here can I?
> 
> >
> >
> > On Mon, 7 Mar 2005 01:38:46 +0200, Kenneth Kalmer
> > <kenneth.kalmer@gmail.com> wrote:
> > > Guys
> > >
> > > I'm having some difficulty getting the following rules to work:
> > >
> > > These chains are used in both the INPUT and FORWARD chains of the filter table:
> > >
> > > # Log/Drop chain for ip/mac address mismatches
> > > $IPTABLES -N ADDRESSMISMATCH 2> /dev/null
> > > $IPTABLES -F ADDRESSMISMATCH
> > > $IPTABLES -A ADDRESSMISMATCH -j LOG --log-level $LOG_LEVEL -m limit
> > > --limit $LTIME --log-prefix "Firewall (IP/MAC mismatch) "
> > > $IPTABLES -A ADDRESSMISMATCH -p tcp -j $TCP_RESPOND
> > > $IPTABLES -A ADDRESSMISMATCH -p udp -j $UDP_RESPOND
> > > $IPTABLES -A ADDRESSMISMATCH -j DROP
> > >
> > > # Now verify all MAC/IP combos
> > > $IPTABLES -N VERIFYMAC 2> /dev/null
> > > $IPTABLES -F VERIFYMAC
> > > $IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
> > > 192.168.10.1-192.168.10.10 -m mac --mac-source 00:0b:6a:a0:0a:7f -j
> > > RETURN
> > > $IPTABLES -A VERIFYMAC -i $LANPORT -m iprange --src-range
> > > 192.168.10.31-192.168.10.40 -m mac --mac-source 00:02:e3:55:85:f5 -j
> > > RETURN
> > > $IPTABLES -A VERIFYMAC -j ADDRESSMISMATCH
> > >
> > > Every single packet traverses the chain all the way down to
> > > ADDRESSMISMATCH, no packets match...
> > >
> > > The scenario is that each user can have multiple MAC addresses
> > > (laptops, pda's & pc's). The DHCP will always issue the same range to
> > > the same MAC addresses, each user get's their own pool own 10 IP's.
> > >
> > > I'm trying to avoid matching 10 ip's to each MAC address. I'm under
> > > the impression that this will adversely affect performance. We already
> > > have 80 users on the network, 800 possible ip's and already 110 mac
> > > addresses. The VERIFYMAC chain above will get too big or is this not a
> > > problem.
> > >
> > > Is the one-to-one match the only solution, or am I missing the plot here?
> > >
> > > Thanks in advance!
> > >
> > > --
> > >
> > > Kenneth Kalmer
> > > kenneth.kalmer@gmail.com
> > > http://opensourcery.blogspot.com
> > >
> > >
> >
> > --
> > Mohamed Eldesoky
> > www.eldesoky.net
> > RHCE
> >
> 
> --
> 
> Kenneth Kalmer
> kenneth.kalmer@gmail.com
> http://opensourcery.blogspot.com
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE