Re: MAC address and iptables

[Sasa Stupar <sasa@stupar.homelinux.net>]

The thing is that it worked but it was not I have expected. Her is my 
ruleset:
-----------------
# Generated by webmin
*filter
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:INPUT DROP [0:0]
# Loopback
-A OUTPUT -o lo -j ACCEPT
# Allow self access by loopback interface
-A INPUT -i lo -j ACCEPT
# Master
-A INPUT -m mac -s a.b.c.d --mac aa:bb:cc:dd:ee:ff -j ACCEPT
# Accept established connections
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset
# FTP
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
# Telnet
-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT
# SMTP
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
# NTP
-A INPUT -p tcp -m tcp --dport 37 -j ACCEPT
# DNS
-A INPUT -p udp -m udp -s a.b.c.d -d 0/0 --sport 53 -j ACCEPT
# HTTP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT  --syn
# POP3
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
# Samba
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
# Samba
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
# Samba
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT  --syn
# HTTPS
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
# SMTP-SSL
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
# POP3-SSL
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
# Squid Proxy
-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
# UPS
-A INPUT -p tcp -m tcp --dport 3493 -j ACCEPT
# Xmail CtrlClnt
-A INPUT -p tcp -m tcp --dport 6017 -j ACCEPT
# XQM agent
-A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
# Webmin
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Drop all other connection attempts
-A INPUT -j DROP
COMMIT
# Generated by webmin
*mangle
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
COMMIT
# Completed
----------------------

Regards,
Sasa