Regarding iptables mac matching

Regarding iptables mac matching

[Abhishek Singh]

Dear All,
     I'm using iptables on Fedora 9. I need to block network access to a 
specific mac address. My LAN uses a gateway. On the gateway I'm using 
iptables for firewalling. I monitor the network traffic from hosts on my 
LAN, and need to block the hosts which are consuming too much of network 
traffic. To block a host with MAC address 00:E0:4D:02:1F:B8, I added 
these rules in iptables:

iptables -A INPUT -m mac --mac-source 00:E0:4D:02:1F:B8 -j DROP
iptables -A FORWARD -m mac --mac-source 00:E0:4D:02:1F:B8 -j DROP

I tested the network connection on the host with the mac address 
matching 00:E0:4D:02:1F:B8 and I got the following results:

   * The gateway blocked ssh and ping requests from the host.
   * But I was still able to access other servers on real ip (say
     pinging google.com, worked fine)

I like to block the access of that host to other hosts, the gateway and 
the internet as well. But I'm unable to do that using the above 
mentioned rules. I'm quite optimistic that someone help me with this 
problem.
Thanks in advance.

Regards,
Abhishek Singh

Re: Regarding iptables mac matching

[Grant Taylor]

On 08/21/08 09:33, Abhishek Singh wrote:
> I like to block the access of that host to other hosts, the gateway 
> and the internet as well. But I'm unable to do that using the above 
> mentioned rules. I'm quite optimistic that someone help me with this 
> problem.

In short I am fairly certain that you will not (reliably) be able to 
block host to host communications on your LAN.  Here's a quick synopsis 
of a very similar discussion on the EBTables mailing list.

Consider your LAN a small room with multiple people in it, all of which 
are in ear shot of each other.  So when one person tries to talk to 
another person they can do it with out a problem because it is directly 
between each other.  Your firewall only enters the picture when someone 
tries to leave the room to go out to the world.  With out shouting at 
everyone, there is very little that you can do to prevent each other 
from talking between them selves.

> Thanks in advance.

*nod*



Grant. . . .


P.S.  This assumes that all the systems are on the same subnet.  If they 
are on different subnets and have to pass through the router to get 
between subnets you can do something if you want to.