IP+MAC based firewall rule

IP+MAC based firewall rule

[Osama Hashmi]

Hi Everyone,

Can anyone tell me that how can i place firewall rule based on both IP
Address and the Network Card's MAC Address. I want to do so because i
want to limit my clients that if any of my clients changes his
ipaddress his packets start dropping and he is unable to connect the
server.
-- 
Oliging
Superior
Ambitious
Marvellous
Attrahent

Re: IP+MAC based firewall rule

[Jason Opperisano]

On Mon, 2005-02-28 at 05:14, Osama Hashmi wrote:
> Hi Everyone,
> 
> Can anyone tell me that how can i place firewall rule based on both IP
> Address and the Network Card's MAC Address. I want to do so because i
> want to limit my clients that if any of my clients changes his
> ipaddress his packets start dropping and he is unable to connect the
> server.

first--answering your question:

  iptables -N verifyMac

  iptables -A verifyMac -m mac --mac-source $HOST1_MAC \
    -s $HOST1_IP -j RETURN
  iptables -A verifyMac -m mac --mac-source $HOST2_MAC \
    -s $HOST2_IP -j RETURN
  iptables -A verifyMac -m mac --mac-source $HOST3_MAC \
    -s $HOST3_IP -j RETURN
  [ ... ]
  iptables -A verifyMac -j LOG --log-prefix "INVALID MAC/IP COMBO: "
  iptables -A verifyMac -j DROP

and then somewhere early in FORWARD:

  iptables -A FORWARD -j verifyMac

  [ rest of FORWARD rules ]

you could also do verify the mac/ip pair directly in FORWARD and jump to
a custom chain for your allowed FORWARD packets--something like:

  iptables -N allowFwd

  iptables -A FORWARD m mac --mac-source $HOST1_MAC \
    -s $HOST1_IP -j allowFwd
  iptables -A FORWARD m mac --mac-source $HOST2_MAC \
    -s $HOST2_IP -j allowFwd

and then put the allowed protocols/ports in the "allowFwd" chain.

two ways to accomplish the same thing.  the first one happens to match
the way my brain works.

keep in mind that neither is particularly scalable...that is--if there
are 500 machines behind this firewall, poor MAC/IP pair number 500 has
to traverse 499 rules every time he starts a connection...  :-(

second--an alternative to the iptables -m mac method:  put static arp
entries on your firewall.  the end effect is that an invalid MAC/IP
combo won't ever get any reply packets from the firewall, but it doesn't
have the audit trail capabilities (read: logging) that the iptables
method has--but it's better from a performance perspective.

you could also look into arpwatch to detect changes in mac/ip
pairings--which could be combined with the static arp entry method for
the audit trail.

just some thoughts--hope it helps.

oh yeah--and anyone with access to the local network can sniff out valid
mac/ip pairs and modify their NIC to bypass this type of filtering, but
i assume you are aware of this glaring limitation.

-j

--
"Dear Baby, Welcome to Dumpsville. Population: You"
	--The Simpsons