filtering based on MAC address prefix

filtering based on MAC address prefix

[Daniel Drake]

Hi,

I'm interested in setting up iptables filtering rules based on the OUI
(i.e. first 3 bytes) of the source MAC address. Is this possible?

I see that there is a "mac" match extension but it only seems to
operate with full 6-byte addresses. I also looked at the u32 extension
but that only seems to operate on the TCP header, not on the ethernet
header.

Any ideas/suggestions?

Thanks,
Daniel

Re: filtering based on MAC address prefix

[Eray Aslan]

On 15.01.2010 21:44, Daniel Drake wrote:
> I'm interested in setting up iptables filtering rules based on the OUI
> (i.e. first 3 bytes) of the source MAC address. Is this possible?
> 
> I see that there is a "mac" match extension but it only seems to
> operate with full 6-byte addresses. I also looked at the u32 extension
> but that only seems to operate on the TCP header, not on the ethernet
> header.
> 
> Any ideas/suggestions?

ebtables(8) is usually the better tool to use for dealing with ethernet
frames.  Check if its --source and among matches fits.

-- 
Eray

Re: filtering based on MAC address prefix

[Pascal Hambourg]

Hello,

Eray Aslan a écrit :
> 
> ebtables(8) is usually the better tool to use for dealing with ethernet
> frames.  Check if its --source and among matches fits.

But ebtables works only on frames seen by a bridge. So using it requires
to create a dummy bridge with one member.

Re: filtering based on MAC address prefix

[Daniel Drake]

2010/1/16 Eray Aslan <eray.aslan@caf.com.tr>:
> ebtables(8) is usually the better tool to use for dealing with ethernet
> frames.  Check if its --source and among matches fits.

Thanks! I wasn't aware of that.

At first glance it looks ideal, but after trying to get it working, it
seems inappropriate.
Setting all ebtables policies to DROP (and adding log rules) does
nothing. As far as I can tell, ebtables only operates on bridge
devices, of which there are none in this setup. Am I missing anything?

Daniel

Re: filtering based on MAC address prefix

[Eray Aslan]

On 16.01.2010 18:37, Daniel Drake wrote:
> At first glance it looks ideal, but after trying to get it working, it
> seems inappropriate.
> Setting all ebtables policies to DROP (and adding log rules) does
> nothing. As far as I can tell, ebtables only operates on bridge
> devices, of which there are none in this setup. Am I missing anything?

Create a bridge with only one enslaved device and ebtables should see
the traffic:
http://ebtables.sourceforge.net/examples/basic.html#ex_nobridge

-- 
Eray

Re: filtering based on MAC address prefix

[Maximilian Wilhelm]

Anno domini 2010 Eray Aslan scripsit:

Hi!

> On 16.01.2010 18:37, Daniel Drake wrote:
> > At first glance it looks ideal, but after trying to get it working, it
> > seems inappropriate.
> > Setting all ebtables policies to DROP (and adding log rules) does
> > nothing. As far as I can tell, ebtables only operates on bridge
> > devices, of which there are none in this setup. Am I missing anything?

> Create a bridge with only one enslaved device and ebtables should see
> the traffic:
> http://ebtables.sourceforge.net/examples/basic.html#ex_nobridge

Is this wise on machines with high network load?
I would guess that it will slow down things a little. Am I wrong here?

Ciao
Max
-- 
If it doesn't work, force it.
If it breaks, it needed replacing anyway.