From: Grant Taylor <gtaylor@riverviewtech.net>
To: Mail List - Netfilter <netfilter@vger.kernel.org>
Subject: Re: Blocking machines by both Mac Address and IP address
Date: Mon, 25 Oct 2010 11:02:59 -0500 [thread overview]
Message-ID: <4CC5AA33.7010400@riverviewtech.net> (raw)
In-Reply-To: <AANLkTimE3DpKibaqKH53D9PEtt_AxSAimdaTiyTy1VZK@mail.gmail.com>
On 10/23/10 17:19, Scott Mayo wrote:
> i.e. If MAC address 00:11:22:33:44:55 is given IP address
> 192.168.0.1 by DHCP then that should be the only combo that can get
> to the outside world. If the IP address is changed to something else
> or if another machine that has a different MAC address is given the
> IP address 192.168.0.1 statically, then in neither situation should
> the machine be able to get out to the world.
I would suggest that you reverse your logic a bit. Only allow the
machines to access the internet if the MAC and IP address are correct.
Any other combination should fail.
This is the old adage of "allow what you want and block the rest" not
"block what you want and allow the rest". It is too easy to change an
IP and / or MAC address to get around the filters that selectively block.
Grant. . . .
prev parent reply other threads:[~2010-10-25 16:02 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-23 22:19 Blocking machines by both Mac Address and IP address Scott Mayo
2010-10-23 22:33 ` Andrew Beverley
2010-10-24 13:14 ` Scott Mayo
2010-10-24 14:22 ` Pascal Hambourg
2010-10-24 14:46 ` Andrew Beverley
2010-10-23 22:51 ` Jan Engelhardt
2010-10-25 16:02 ` Grant Taylor [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CC5AA33.7010400@riverviewtech.net \
--to=gtaylor@riverviewtech.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).