allowing connection

allowing connection

[Payal Rathod]

Hi,
Right now I am allowing only my client's LAN access one of my 
design's machine from the internet. Their LAN is a simple network,
with a single IP and other machines are masqueraded. Now I want to allow
only one of their machine to access my machine. Can I do it? I mean 
the machine is on 192.168.1.x series of IP, but can I restrict it
on mac address basis? If yes, how do I do it?

With warm regards,
-Payal

RE: allowing connection

[Deepak Seshadri]

Hi Payal,

You can use the MAC match to restrict access.

Something like this:

iptables -t mangle -A PREROUTING -s (Masqueraded_IP) -m mac --mac-source
(MAC_ADDR_MACHINE) -j ACCEPT

Please follow the link below and read 6.4.3.2 for further understanding:

http://iptables-tutorial.frozentux.net/chunkyhtml/matches.html#GENERICMATCHE
S

Hope this helps!

Regards,

Deepak Seshadri


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Payal Rathod
Sent: Friday, September 10, 2004 2:18 PM
To: Netfilter ML
Subject: allowing connection

Hi,
Right now I am allowing only my client's LAN access one of my 
design's machine from the internet. Their LAN is a simple network,
with a single IP and other machines are masqueraded. Now I want to allow
only one of their machine to access my machine. Can I do it? I mean 
the machine is on 192.168.1.x series of IP, but can I restrict it
on mac address basis? If yes, how do I do it?

With warm regards,
-Payal

Re: allowing connection

[Jason Opperisano]

On Fri, 2004-09-10 at 14:18, Payal Rathod wrote:
> Hi,
> Right now I am allowing only my client's LAN access one of my 
> design's machine from the internet. Their LAN is a simple network,
> with a single IP and other machines are masqueraded. Now I want to allow
> only one of their machine to access my machine. Can I do it? I mean 
> the machine is on 192.168.1.x series of IP, but can I restrict it
> on mac address basis? If yes, how do I do it?
> 
> With warm regards,
> -Payal

so essentially:

+------------+  +----------------+
| CLIENT LAN |--| CLIENT MACHINE |
+------------+  +----------------+
      |
+-----------+
| CLIENT FW |
+-----------+
      |
      |
+----------+
| INTERNET |
+----------+
      |
      |
+---------+
| YOUR FW |
+---------+
      |
+---------+  +----------------+
|YOUR LAN |--| DESIGN MACHINE |
+---------+  +----------------+

Right you allow whatever IP all of "Client LAN" is MASQ'ed behind to 
access "Design Machine."

To answer the question, can you filter by MAC address--the answer is 
a resounding, "no!"  The MAC address of "Client Machine" is stripped 
off by "Client FW" never to be seen again by any network device.

The only MAC address that you'll see on the external interface of
"Your FW" is that of your Internet router.

My suggestion:  protect the resource in question with a
username/password or certificate or whatever authentication suits you.
Only give the one person who needs access credentials to get in.
Keep the filtering policy as-is.

-j

-- 
Jason Opperisano <opie@817west.com>

Re: allowing connection

[Joel n.solanki]

If you have 2 lan cards.
eth0 --connected to internet
eth1 --connected to lan

then ..
Make the default policy of FORWARD to DROP
Just FORWARD the client's ip so that it can get internet access.
All other machines will communicated with each other but not with the
internet.

Without mac binding.
iptables -A FORWARD -i eth1 -s 192.168.1.x -j ACCEPT
iptables -A FORWARD -i eth0 -d 192.168.1.x -j ACCEPT

With mac binding.
iptables -A FORWARD -i eth1 -s 192.168.1.x -m mac --mac-source
00:00:00:00:00:00 -j ACCEPT
iptables -A FORWARD -i eth0 -d 192.168.1.x -m mac --mac-source
00:00:00:00:00:00 -j ACCEPT


Regards,
On Fri, 2004-09-10 at 23:48, Payal Rathod wrote:
> Hi,
> Right now I am allowing only my client's LAN access one of my 
> design's machine from the internet. Their LAN is a simple network,
> with a single IP and other machines are masqueraded. Now I want to allow
> only one of their machine to access my machine. Can I do it? I mean 
> the machine is on 192.168.1.x series of IP, but can I restrict it
> on mac address basis? If yes, how do I do it?
> 
> With warm regards,
> -Payal
-- 
Joel N.Solanki
Network Administrator
Phone No: 0265-550001/2/3/4/5 Ext: 211/212
Digtial 2 Virtual Internet Service Provider.
http://www.packetraptor.com/
http://www.d2visp.com/
Gujarat (India)