IP and MAC Address check

IP and MAC Address check

[Winanjaya - PBXSoftwares]

Hi All,

I have list of Mac addresses and also have range of IP addresses.. how to set iptables with conditions below:

Range of IP addresses: 172.16.2.241 to 172.16.2.250

List of MAC Addresses: (stored in a file named maclist)
01:02:03:04:05:0a
01:02:03:04:05:0b
01:02:03:04:05:0c
01:02:03:04:05:0d
01:02:03:04:05:0e
01:02:03:04:05:0f
01:02:03:04:05:1a
01:02:03:04:05:2a
01:02:03:04:05:3a
01:02:03:04:05:4a

When Incoming package from the ranged IP address (172.16.2.241 to 172.16.2.250)  then the mac address must be checked from the list of MAC Address, if the MAC Address matched then it allowed otherwise it will be rejected or dropped..


please advise

thanks a lot in advance

Regards
Winanjaya

Re: IP and MAC Address check

[Marcos S. Trazzini]

On Wed, Oct 05, 2005 at 11:24:46AM +0700, Winanjaya - PBXSoftwares wrote:
> Hi All,
> 
> I have list of Mac addresses and also have range of IP addresses.. how to set iptables with conditions below:
> 
> Range of IP addresses: 172.16.2.241 to 172.16.2.250
> 
> List of MAC Addresses: (stored in a file named maclist)
> 01:02:03:04:05:0a
> 01:02:03:04:05:0b
> 01:02:03:04:05:0c
> 01:02:03:04:05:0d
> 01:02:03:04:05:0e
> 01:02:03:04:05:0f
> 01:02:03:04:05:1a
> 01:02:03:04:05:2a
> 01:02:03:04:05:3a
> 01:02:03:04:05:4a
> 
> When Incoming package from the ranged IP address (172.16.2.241 to 172.16.2.250)  then the mac address must be checked from the list of MAC Address, if the MAC Address matched then it allowed otherwise it will be rejected or dropped..
 
Hi All,

This's my first reply to the list (And I wan't to send a lot more...), and
expect to help. Sorry for the the bad english (Need's a litle practice).

Can't you associate each IP with a MAC address from the list? It's the best thing
to do (as it is the most secure...).

Or.... maybe this is that you want:

---CUT HERE---
while read mac; do
  iptables -A INPUT -m mac --mac-source $mac -m iprange --src-range \
   172.16.2.241-172.16.2.250 -j ACCEPT
done < /path/to/maclist
iptables -AINPUT -m iprange --src-range 172.16.2.241-172.16.2.250 -j DROP
---CUT HERE---

This will create a lot of rules (One per MAC address from the list) instead of only one "wonderful rule". Of course the rules must be "best worked", but maybe this can solve the problem.

See also:
# iptables -m mac --help
# iptables -m iprange --help

--
Marcos S. Trazzini

Re: IP and MAC Address check

[Winanjaya - PBXSoftwares]

Hi . . I already had the list of MAC Address .. and they stored in the file
named maclist (ie. /etc/sysconfig/maclist) ..
what I need is to configure iptables to read maclist file when there is
incoming trafic from the IP address 172.16.2.241 to 172.16.2.250 ..if the
MAC Address listed then the traffic will allowed otherwise the traffic will
be dropped or rejected..

any idea ? .. please advise

Regards
Winanjaya

----- Original Message -----
From: "Marcos S. Trazzini" <mstrazzini@gmail.com>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, October 05, 2005 11:58 AM
Subject: Re: IP and MAC Address check


> On Wed, Oct 05, 2005 at 11:24:46AM +0700, Winanjaya - PBXSoftwares wrote:
> > Hi All,
> >
> > I have list of Mac addresses and also have range of IP addresses.. how
to set iptables with conditions below:
> >
> > Range of IP addresses: 172.16.2.241 to 172.16.2.250
> >
> > List of MAC Addresses: (stored in a file named maclist)
> > 01:02:03:04:05:0a
> > 01:02:03:04:05:0b
> > 01:02:03:04:05:0c
> > 01:02:03:04:05:0d
> > 01:02:03:04:05:0e
> > 01:02:03:04:05:0f
> > 01:02:03:04:05:1a
> > 01:02:03:04:05:2a
> > 01:02:03:04:05:3a
> > 01:02:03:04:05:4a
> >
> > When Incoming package from the ranged IP address (172.16.2.241 to
172.16.2.250)  then the mac address must be checked from the list of MAC
Address, if the MAC Address matched then it allowed otherwise it will be
rejected or dropped..
>
> Hi All,
>
> This's my first reply to the list (And I wan't to send a lot more...), and
> expect to help. Sorry for the the bad english (Need's a litle practice).
>
> Can't you associate each IP with a MAC address from the list? It's the
best thing
> to do (as it is the most secure...).
>
> Or.... maybe this is that you want:
>
> ---CUT HERE---
> while read mac; do
>   iptables -A INPUT -m mac --mac-source $mac -m iprange --src-range \
>    172.16.2.241-172.16.2.250 -j ACCEPT
> done < /path/to/maclist
> iptables -AINPUT -m iprange --src-range 172.16.2.241-172.16.2.250 -j DROP
> ---CUT HERE---
>
> This will create a lot of rules (One per MAC address from the list)
instead of only one "wonderful rule". Of course the rules must be "best
worked", but maybe this can solve the problem.
>
> See also:
> # iptables -m mac --help
> # iptables -m iprange --help
>
> --
> Marcos S. Trazzini
>
>

RE: IP and MAC Address check

[Ruben Cardenal]

Hi,

> what I need is to configure iptables to read maclist file when there is
> incoming trafic from the IP address 172.16.2.241 to 172.16.2.250 ..if the
> MAC Address listed then the traffic will allowed otherwise the traffic
> will
> be dropped or rejected..

  That's were you were showed to implement.

> > while read mac; do
> >   iptables -A INPUT -m mac --mac-source $mac -m iprange --src-range \
> >    172.16.2.241-172.16.2.250 -j ACCEPT
> > done < /path/to/maclist
> > iptables -A INPUT -m iprange --src-range 172.16.2.241-172.16.2.250 -j
> DROP

  You can't create "condicional" rules with iptables, you only create the
rules you need, and if such condition ever exists, the rule will be applied.
If it never does, the rule will never be applied.

-Ruben

Re: IP and MAC Address check

[hareram]

Hi

better way to do is
store IP and MAC
and try to compare with them

hare
----- Original Message ----- 
From: "Winanjaya - PBXSoftwares" <winanjaya@pbxsoftwares.com>
To: <netfilter@lists.netfilter.org>; "Marcos S. Trazzini" 
<mstrazzini@gmail.com>
Sent: Wednesday, October 05, 2005 10:49 AM
Subject: Re: IP and MAC Address check


> Hi . . I already had the list of MAC Address .. and they stored in the 
> file
> named maclist (ie. /etc/sysconfig/maclist) ..
> what I need is to configure iptables to read maclist file when there is
> incoming trafic from the IP address 172.16.2.241 to 172.16.2.250 ..if the
> MAC Address listed then the traffic will allowed otherwise the traffic 
> will
> be dropped or rejected..
>
> any idea ? .. please advise
>
> Regards
> Winanjaya
>
> ----- Original Message -----
> From: "Marcos S. Trazzini" <mstrazzini@gmail.com>
> To: <netfilter@lists.netfilter.org>
> Sent: Wednesday, October 05, 2005 11:58 AM
> Subject: Re: IP and MAC Address check
>
>
>> On Wed, Oct 05, 2005 at 11:24:46AM +0700, Winanjaya - PBXSoftwares wrote:
>> > Hi All,
>> >
>> > I have list of Mac addresses and also have range of IP addresses.. how
> to set iptables with conditions below:
>> >
>> > Range of IP addresses: 172.16.2.241 to 172.16.2.250
>> >
>> > List of MAC Addresses: (stored in a file named maclist)
>> > 01:02:03:04:05:0a
>> > 01:02:03:04:05:0b
>> > 01:02:03:04:05:0c
>> > 01:02:03:04:05:0d
>> > 01:02:03:04:05:0e
>> > 01:02:03:04:05:0f
>> > 01:02:03:04:05:1a
>> > 01:02:03:04:05:2a
>> > 01:02:03:04:05:3a
>> > 01:02:03:04:05:4a
>> >
>> > When Incoming package from the ranged IP address (172.16.2.241 to
> 172.16.2.250)  then the mac address must be checked from the list of MAC
> Address, if the MAC Address matched then it allowed otherwise it will be
> rejected or dropped..
>>
>> Hi All,
>>
>> This's my first reply to the list (And I wan't to send a lot more...), 
>> and
>> expect to help. Sorry for the the bad english (Need's a litle practice).
>>
>> Can't you associate each IP with a MAC address from the list? It's the
> best thing
>> to do (as it is the most secure...).
>>
>> Or.... maybe this is that you want:
>>
>> ---CUT HERE---
>> while read mac; do
>>   iptables -A INPUT -m mac --mac-source $mac -m iprange --src-range \
>>    172.16.2.241-172.16.2.250 -j ACCEPT
>> done < /path/to/maclist
>> iptables -AINPUT -m iprange --src-range 172.16.2.241-172.16.2.250 -j DROP
>> ---CUT HERE---
>>
>> This will create a lot of rules (One per MAC address from the list)
> instead of only one "wonderful rule". Of course the rules must be "best
> worked", but maybe this can solve the problem.
>>
>> See also:
>> # iptables -m mac --help
>> # iptables -m iprange --help
>>
>> --
>> Marcos S. Trazzini
>>
>>
>
>
>
> 

Re: IP and MAC Address check

[/dev/rob0]

Please don't top-post. Thank you.

On Wednesday 2005-October-05 00:19, Winanjaya - PBXSoftwares wrote:
> Hi . . I already had the list of MAC Address .. and they stored in
> the file named maclist (ie. /etc/sysconfig/maclist) ..

Yes.

> what I need is to configure iptables to read maclist file when there

iptables cannot read from a file. Use a shell script to do that.

> is incoming trafic from the IP address 172.16.2.241 to 172.16.2.250
> ..if the MAC Address listed then the traffic will allowed otherwise
> the traffic will be dropped or rejected..
>
> any idea ? .. please advise

You were given good advice:

> ----- Original Message -----
> From: "Marcos S. Trazzini" <mstrazzini@gmail.com>
> To: <netfilter@lists.netfilter.org>
> Sent: Wednesday, October 05, 2005 11:58 AM
> Subject: Re: IP and MAC Address check
>
snip
> > ---CUT HERE---
> > while read mac; do
> >   iptables -A INPUT -m mac --mac-source $mac -m iprange \
> >   --src-range 172.16.2.241-172.16.2.250 -j ACCEPT
> > done < /path/to/maclist
> > iptables -AINPUT -m iprange --src-range \
> > 172.16.2.241-172.16.2.250 -j DROP
> > ---CUT HERE--- 

My only comment is that some older systems might not have -m iprange. 
But no worries, it's not far outside 2 CIDR ranges: 172.16.2.240/29 and 
172.16.2.248/30.

Ah, one other comment: this might be better structured using a 
user-defined chain.

> > See also:
> > # iptables -m mac --help
> > # iptables -m iprange --help

And of course "man iptables".
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: IP and MAC Address check

[Winanjaya - PBXSoftwares]

Ok .. thanks, is it also impossible to read a textfile thru iptables?
..please confirm

TIA
Winanjaya




----- Original Message -----
From: "Ruben Cardenal" <ruben@ruben.cn>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, October 05, 2005 12:23 PM
Subject: RE: IP and MAC Address check


> Hi,
>
> > what I need is to configure iptables to read maclist file when there is
> > incoming trafic from the IP address 172.16.2.241 to 172.16.2.250 ..if
the
> > MAC Address listed then the traffic will allowed otherwise the traffic
> > will
> > be dropped or rejected..
>
>   That's were you were showed to implement.
>
> > > while read mac; do
> > >   iptables -A INPUT -m mac --mac-source $mac -m iprange --src-range \
> > >    172.16.2.241-172.16.2.250 -j ACCEPT
> > > done < /path/to/maclist
> > > iptables -A INPUT -m iprange --src-range 172.16.2.241-172.16.2.250 -j
> > DROP
>
>   You can't create "condicional" rules with iptables, you only create the
> rules you need, and if such condition ever exists, the rule will be
applied.
> If it never does, the rule will never be applied.
>
> -Ruben
>
>
>
>

Re: IP and MAC Address check

[Winanjaya - PBXSoftwares]

----- Original Message -----
From: "/dev/rob0" <rob0@gmx.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, October 05, 2005 12:29 PM
Subject: Re: IP and MAC Address check


> Please don't top-post. Thank you.
>
> On Wednesday 2005-October-05 00:19, Winanjaya - PBXSoftwares wrote:
> > Hi . . I already had the list of MAC Address .. and they stored in
> > the file named maclist (ie. /etc/sysconfig/maclist) ..
>
> Yes.
>
> > what I need is to configure iptables to read maclist file when there
>
> iptables cannot read from a file. Use a shell script to do that.
>
> > is incoming trafic from the IP address 172.16.2.241 to 172.16.2.250
> > ..if the MAC Address listed then the traffic will allowed otherwise
> > the traffic will be dropped or rejected..
> >
> > any idea ? .. please advise
>
> You were given good advice:
>
> > ----- Original Message -----
> > From: "Marcos S. Trazzini" <mstrazzini@gmail.com>
> > To: <netfilter@lists.netfilter.org>
> > Sent: Wednesday, October 05, 2005 11:58 AM
> > Subject: Re: IP and MAC Address check
> >
> snip
> > > ---CUT HERE---
> > > while read mac; do
> > >   iptables -A INPUT -m mac --mac-source $mac -m iprange \
> > >   --src-range 172.16.2.241-172.16.2.250 -j ACCEPT
> > > done < /path/to/maclist
> > > iptables -AINPUT -m iprange --src-range \
> > > 172.16.2.241-172.16.2.250 -j DROP
> > > ---CUT HERE---
>
> My only comment is that some older systems might not have -m iprange.
> But no worries, it's not far outside 2 CIDR ranges: 172.16.2.240/29 and
> 172.16.2.248/30.
>
> Ah, one other comment: this might be better structured using a
> user-defined chain.
>
> > > See also:
> > > # iptables -m mac --help
> > > # iptables -m iprange --help
>
> And of course "man iptables".
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>

so you meant I can use  below:

# Range 241 to 246
 -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
00:12:95:6d:0a:3e -j DROP
-A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
00:12:95:15:61:14 -j DROP
-A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
00:12:95:15:62:29 -j DROP
-A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
00:12:95:15:63:ba -j DROP


please advise ..

Regards
Winanjaya

Re: IP and MAC Address check

[/dev/rob0]

On Wednesday 2005-October-05 00:50, Winanjaya - PBXSoftwares wrote:
> > My only comment is that some older systems might not have -m
> > iprange. But no worries, it's not far outside 2 CIDR ranges:
> > 172.16.2.240/29 and 172.16.2.248/30.
> >
> > Ah, one other comment: this might be better structured using a
> > user-defined chain.

(Hold that thought ...)

> so you meant I can use  below:
>
> # Range 241 to 246

172.16.2.240/29 is actually 240 through 247.

>  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> 00:12:95:6d:0a:3e -j DROP
> -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> 00:12:95:15:61:14 -j DROP
> -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> 00:12:95:15:62:29 -j DROP
> -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> 00:12:95:15:63:ba -j DROP

RH-Lokkit-0-50? Yuck!!

Okay, trying to regain composure ... :)

Think about this. Look at the first rule:
>  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> 00:12:95:6d:0a:3e -j DROP

If the source IP is in 172.16.2.240/29 and the MAC address is *not* 
00:12:95:6d:0a:3e, drop the packet. Your second and subsequent MAC 
rules will never be used, because those packets are already dropped.

That's why I'd use another chain for this. Put an ACCEPT rule in the 
calling chain after the jump to your new chain. Use -j RETURN rules for 
your permitted MAC addresses, and a -j DROP rule at the end of your new 
chain.

I hope you do understand about MAC filtering: it only works when your 
packets originated on the same physical segment. Anything from outside 
your physical segment will come to you with the MAC address of your 
upstream router.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: IP and MAC Address check

[Winanjaya - PBXSoftwares]

----- Original Message -----
From: "/dev/rob0" <rob0@gmx.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, October 05, 2005 1:23 PM
Subject: Re: IP and MAC Address check


> On Wednesday 2005-October-05 00:50, Winanjaya - PBXSoftwares wrote:
> > > My only comment is that some older systems might not have -m
> > > iprange. But no worries, it's not far outside 2 CIDR ranges:
> > > 172.16.2.240/29 and 172.16.2.248/30.
> > >
> > > Ah, one other comment: this might be better structured using a
> > > user-defined chain.
>
> (Hold that thought ...)
>
> > so you meant I can use  below:
> >
> > # Range 241 to 246
>
> 172.16.2.240/29 is actually 240 through 247.
>
> >  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> > 00:12:95:6d:0a:3e -j DROP
> > -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> > 00:12:95:15:61:14 -j DROP
> > -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> > 00:12:95:15:62:29 -j DROP
> > -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> > 00:12:95:15:63:ba -j DROP
>
> RH-Lokkit-0-50? Yuck!!
>
> Okay, trying to regain composure ... :)
>
> Think about this. Look at the first rule:
> >  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> > 00:12:95:6d:0a:3e -j DROP
>
> If the source IP is in 172.16.2.240/29 and the MAC address is *not*
> 00:12:95:6d:0a:3e, drop the packet. Your second and subsequent MAC
> rules will never be used, because those packets are already dropped.
>
> That's why I'd use another chain for this. Put an ACCEPT rule in the
> calling chain after the jump to your new chain. Use -j RETURN rules for
> your permitted MAC addresses, and a -j DROP rule at the end of your new
> chain.
>
> I hope you do understand about MAC filtering: it only works when your
> packets originated on the same physical segment. Anything from outside
> your physical segment will come to you with the MAC address of your
> upstream router.
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>
>
I am really sorry that I am not sure that I already understood what you mean
exactly.. could you please give me a simple example for this? .. thanks a
lot in advance

Regards
Winanjaya

Re: IP and MAC Address check

[Rob Sterenborg]

On Wed, October 5, 2005 08:44, Winanjaya - PBXSoftwares wrote:
...
>> > > Ah, one other comment: this might be better structured using a
>> > > user-defined chain.
>>
>> (Hold that thought ...)
...
>> Think about this. Look at the first rule:
>> >  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
>> > 00:12:95:6d:0a:3e -j DROP
>>
>> If the source IP is in 172.16.2.240/29 and the MAC address is *not*
>> 00:12:95:6d:0a:3e, drop the packet. Your second and subsequent MAC
>> rules will never be used, because those packets are already dropped.
>>
>> That's why I'd use another chain for this. Put an ACCEPT rule in the
>> calling chain after the jump to your new chain. Use -j RETURN rules
>> for your permitted MAC addresses, and a -j DROP rule at the end of
>> your new chain.
>>
>> I hope you do understand about MAC filtering: it only works when
>> your packets originated on the same physical segment. Anything from
>> outside your physical segment will come to you with the MAC address
>> of your upstream router.

> I am really sorry that I am not sure that I already understood what
> you mean exactly.. could you please give me a simple example for
> this? ..
> thanks a lot in advance

...[rules]...
# If the source IP is in 172.16.2.240/29, jump to a user defined chain.
$ipt -A INPUT -s 172.16.2.240/29 -j MAC-CHECK
...[other rules]...

# User defined chain.
# RETURN to built-in chain INPUT if the MAC address matches
# Otherwise, DROP the packet

$ipt -N MAC-CHECK
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:6d:0a:3e -j RETURN
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:61:14 -j RETURN
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:62:29 -j RETURN
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:63:ba -j RETURN
$ipt -A MAC-CHECK -j DROP


Gr,
Rob

Re: IP and MAC Address check

[Winanjaya - PBXSoftwares]

----- Original Message -----
From: "Rob Sterenborg" <rob@sterenborg.info>
To: "Winanjaya - PBXSoftwares" <winanjaya@pbxsoftwares.com>
Cc: "/dev/rob0" <rob0@gmx.co.uk>; <netfilter@lists.netfilter.org>
Sent: Wednesday, October 05, 2005 2:13 PM
Subject: Re: IP and MAC Address check


> On Wed, October 5, 2005 08:44, Winanjaya - PBXSoftwares wrote:
> ...
> >> > > Ah, one other comment: this might be better structured using a
> >> > > user-defined chain.
> >>
> >> (Hold that thought ...)
> ...
> >> Think about this. Look at the first rule:
> >> >  -A RH-Lokkit-0-50-INPUT -m mac -s 172.16.2.240/29 ! --mac-source
> >> > 00:12:95:6d:0a:3e -j DROP
> >>
> >> If the source IP is in 172.16.2.240/29 and the MAC address is *not*
> >> 00:12:95:6d:0a:3e, drop the packet. Your second and subsequent MAC
> >> rules will never be used, because those packets are already dropped.
> >>
> >> That's why I'd use another chain for this. Put an ACCEPT rule in the
> >> calling chain after the jump to your new chain. Use -j RETURN rules
> >> for your permitted MAC addresses, and a -j DROP rule at the end of
> >> your new chain.
> >>
> >> I hope you do understand about MAC filtering: it only works when
> >> your packets originated on the same physical segment. Anything from
> >> outside your physical segment will come to you with the MAC address
> >> of your upstream router.
>
> > I am really sorry that I am not sure that I already understood what
> > you mean exactly.. could you please give me a simple example for
> > this? ..
> > thanks a lot in advance
>
> ...[rules]...
> # If the source IP is in 172.16.2.240/29, jump to a user defined chain.
> $ipt -A INPUT -s 172.16.2.240/29 -j MAC-CHECK
> ...[other rules]...
>
> # User defined chain.
> # RETURN to built-in chain INPUT if the MAC address matches
> # Otherwise, DROP the packet
>
> $ipt -N MAC-CHECK
> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:6d:0a:3e -j RETURN
> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:61:14 -j RETURN
> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:62:29 -j RETURN
> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:63:ba -j RETURN
> $ipt -A MAC-CHECK -j DROP
>

I tried it .. but all traffic 172.16.2.240/29 will be dropped although it
has valid Mac Address.. could you please advise ..what should I check?

Regards
Winanjaya

Re: IP and MAC Address check

[Rob Sterenborg]

On Wed, October 5, 2005 09:52, Winanjaya - PBXSoftwares wrote:

>> ...[rules]...
>> # If the source IP is in 172.16.2.240/29, jump to a user defined
>> chain.
>> $ipt -A INPUT -s 172.16.2.240/29 -j MAC-CHECK
>> ...[other rules]...
>>
>> # User defined chain.
>> # RETURN to built-in chain INPUT if the MAC address matches
>> # Otherwise, DROP the packet
>>
>> $ipt -N MAC-CHECK
>> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:6d:0a:3e -j RETURN
>> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:61:14 -j RETURN
>> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:62:29 -j RETURN
>> $ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:63:ba -j RETURN
>> $ipt -A MAC-CHECK -j DROP
>
> I tried it .. but all traffic 172.16.2.240/29 will be dropped
> although it has valid Mac Address.. could you please advise ..what
> should I check?

As /dev/rob0 mentioned : are you sure that the PC's that you want to
check the MAC address from are on the same physical ethernet segment ?
If not then you won't be able to match the MAC address.

You may want to check with this :

$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:6d:0a:3e -j LOG \
  --log-prefix "MAC1: "
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:6d:0a:3e -j RETURN

$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:61:14 -j  LOG \
  --log-prefix "MAC2: "
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:61:14 -j RETURN

$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:62:29 -j LOG \
  --log-prefix "MAC3: "
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:62:29 -j RETURN

$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:63:ba -j  LOG \
  --log-prefix "MAC4: "
$ipt -A MAC-CHECK -m mac --mac-source 00:12:95:15:63:ba -j RETURN

See if you get any logging. If not, the MAC addresses do not match.


Gr,
Rob