Fw: DROP All MACs

Fw: DROP All MACs

[curlybraces]

----- Original Message ----- 
From: "curlybraces" <curlybraces@dialogsl.net>
To: "Antony Stone" <Antony@Soft-Solutions.co.uk>
Sent: Monday, November 17, 2003 10:18 PM
Subject: Re: DROP All MACs


> Oh , i'm sorry
>
> i will explain , but i need good solution for this matter today itself
> ...............pls
>
> let me to explain ,
>
> in my lan has 5 windpows 2000 pcs. and one Red Hat Linux 8 box .This linux
> box has 2 ethernet - eth0 , eth1 .
> DHCP , Firewall ( iptables ) running in the Linux box .Normally without
> implemention g firewall dhcp server works fine . why i'm try to install a
> firewall for the dhcp server  is i want block some machines which r
strainge
> to the network .
> using MACs we can restric such unknown users .
> so what i'm trying to do is
> as default policies input , forward, output drop .
> as a next step i sugest to do drop all macs which r in the network .
> as a next step i willing to do accept one by one which r known as trusted
> users .
>
> so my . Antony this is the i want to implemet for the LAN . If I
> successfully implemented for the LAN , next step is implement this
firewall
> for the Cable modem for the public users.
>
> so now i think what am i expecting u ....................!!!!!!!
> pls reply me soon...........now can u tell me ur any contact no : ?
>
> thank u
>
>
> ----- Original Message ----- 
> From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
> To: "curlybraces" <curlybraces@dialogsl.net>
> Sent: Monday, November 17, 2003 9:36 PM
> Subject: Re: DROP All MACs
>
>
> > On Monday 17 November 2003 3:29 pm, curlybraces wrote:
> >
> > > Mr. Antony
> > >
> > > can u give me ur any contact no : to contact u wright now ?
> > > then i can tell  u my exact problem ?
> >
> > No, sorry.
> >
> > I am prepared to answer questions on the netfilter mailing list, but if
> > you're not willing to explain your problem there, I'm not willing to
give
> you
> > my private phone number.
> >
> > Maybe somebody else will be kind enough to help you personally.
> >
> > Regards,
> >
> > Antony Stone.
>

Re: Fw: DROP All MACs

[Antony Stone]

On Monday 17 November 2003 5:09 pm, curlybraces wrote:

> i will explain , but i need good solution for this matter today itself
> ...............pls
>
> let me to explain ,
>
> in my lan has 5 windpows 2000 pcs. and one Red Hat Linux 8 box .This
> linux box has 2 ethernet - eth0 , eth1 .
> DHCP , Firewall ( iptables ) running in the Linux box .Normally without
> implemention g firewall dhcp server works fine . why i'm try to install a
> firewall for the dhcp server  is i want block some machines which r
> strainge to the network .

I think the solution you require is probably ebtables, not IPtables, if you 
are trying to stop machines acquiring IP addresses by DHCP in the first place.

See my earlier response to this list in the thread "Re: MAC Block for the 
DHCP via iptables" Mon, 17 Nov 2003 17:02:46

Hope this helps,

Antony.

-- 

The difference between theory and practice is that
in theory there is no difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Fw: DROP All MACs

[Ramin Dousti]

On Mon, Nov 17, 2003 at 11:09:33PM +0600, curlybraces wrote:

> > Oh , i'm sorry
> >
> > i will explain , but i need good solution for this matter today itself
> > ...............pls
> >
> > let me to explain ,
> >
> > in my lan has 5 windpows 2000 pcs. and one Red Hat Linux 8 box .This linux
> > box has 2 ethernet - eth0 , eth1 .
> > DHCP , Firewall ( iptables ) running in the Linux box .Normally without
> > implemention g firewall dhcp server works fine . why i'm try to install a
> > firewall for the dhcp server  is i want block some machines which r
> strainge
> > to the network .
> > using MACs we can restric such unknown users .
> > so what i'm trying to do is
> > as default policies input , forward, output drop .
> > as a next step i sugest to do drop all macs which r in the network .
> > as a next step i willing to do accept one by one which r known as trusted
> > users .
> >
> > so my . Antony this is the i want to implemet for the LAN . If I
> > successfully implemented for the LAN , next step is implement this
> firewall
> > for the Cable modem for the public users.
> >
> > so now i think what am i expecting u ....................!!!!!!!
> > pls reply me soon...........now can u tell me ur any contact no : ?

What you can/should do is to setup your DHCP server to assign IP's to only
those five MS machines (based on their MAC). Although, this does not prevent
any other machine to assign itself a valid IP statically. To solve this
problem is to only allow the traffic of the MAC's you know and drop any other.
An example has been given to you by Antony in a previous email.

This is a frequent problem of the wireless LAN's... The answer is "know your
trusted MAC's". Or let them authenticate before any "session" (with some
well-defined definition of a session).

Ramin