Blocking machines by both Mac Address and IP address

Blocking machines by both Mac Address and IP address

[Scott Mayo]

I have my DHCP server setup so that it hands out IP adresses according
to a machine's Mac address.  Is there a way to deny traffic to the
internet by both MAC address and IP address?

i.e.  If MAC address 00:11:22:33:44:55 is given IP address 192.168.0.1
by DHCP then that should be the only combo that can get to the outside
world.  If the IP address is changed to something else or if another
machine that has a different MAC address is given the IP address
192.168.0.1 statically, then in neither situation should the machine
be able to get out to the world.

Thanks for any info.
-- 
Scott

Re: Blocking machines by both Mac Address and IP address

[Andrew Beverley]

On Sat, 2010-10-23 at 17:19 -0500, Scott Mayo wrote:
> I have my DHCP server setup so that it hands out IP adresses according
> to a machine's Mac address.  Is there a way to deny traffic to the
> internet by both MAC address and IP address?
> 
> i.e.  If MAC address 00:11:22:33:44:55 is given IP address 192.168.0.1
> by DHCP then that should be the only combo that can get to the outside
> world.  If the IP address is changed to something else or if another
> machine that has a different MAC address is given the IP address
> 192.168.0.1 statically, then in neither situation should the machine
> be able to get out to the world.

Something like this...


Set your default policy to drop:

iptables -t mangle -P FORWARD DROP

Then set up a rule for each client that matches both IP address and MAC:

iptables -t mangle -A FORWARD -s 1.2.3.4 \
	-m mac --mac-source aa:aa:aa:aa:aa:aa -j ACCEPT



Andy

Re: Blocking machines by both Mac Address and IP address

[Scott Mayo]

On Sat, Oct 23, 2010 at 5:33 PM, Andrew Beverley <andy@andybev.com> wrote:
> On Sat, 2010-10-23 at 17:19 -0500, Scott Mayo wrote:
>> I have my DHCP server setup so that it hands out IP adresses according
>> to a machine's Mac address.  Is there a way to deny traffic to the
>> internet by both MAC address and IP address?
>>
>> i.e.  If MAC address 00:11:22:33:44:55 is given IP address 192.168.0.1
>> by DHCP then that should be the only combo that can get to the outside
>> world.  If the IP address is changed to something else or if another
>> machine that has a different MAC address is given the IP address
>> 192.168.0.1 statically, then in neither situation should the machine
>> be able to get out to the world.
>
> Something like this...
>
>
> Set your default policy to drop:
>
> iptables -t mangle -P FORWARD DROP
>
> Then set up a rule for each client that matches both IP address and MAC:
>
> iptables -t mangle -A FORWARD -s 1.2.3.4 \
>        -m mac --mac-source aa:aa:aa:aa:aa:aa -j ACCEPT
>
>
>
> Andy
>
>
>

Thanks for the help everyone.  I will try this out next week.  I
figured there was a way to do it, but I am still not the greatest with
IPTABLES.  Not sure that I have ever done anything with the mangle
table.

Thanks again.

-- 
Scott

Re: Blocking machines by both Mac Address and IP address

[Pascal Hambourg]

Hello,

Andrew Beverley a écrit :
> 
> Set your default policy to drop:
> 
> iptables -t mangle -P FORWARD DROP
> 
> Then set up a rule for each client that matches both IP address and MAC:
> 
> iptables -t mangle -A FORWARD -s 1.2.3.4 \
> 	-m mac --mac-source aa:aa:aa:aa:aa:aa -j ACCEPT

The 'mangle' table is not intended for filtering. The 'filter' table is.

Re: Blocking machines by both Mac Address and IP address

[Andrew Beverley]

> > 
> > Set your default policy to drop:
> > 
> > iptables -t mangle -P FORWARD DROP
> > 
> > Then set up a rule for each client that matches both IP address and MAC:
> > 
> > iptables -t mangle -A FORWARD -s 1.2.3.4 \
> > 	-m mac --mac-source aa:aa:aa:aa:aa:aa -j ACCEPT
> 
> The 'mangle' table is not intended for filtering. The 'filter' table is.

Ooops, I meant filter. Been using the mangle table too much recently :)

Andy

Re: Blocking machines by both Mac Address and IP address

[Jan Engelhardt]

On Sunday 2010-10-24 00:19, Scott Mayo wrote:

>I have my DHCP server setup so that it hands out IP adresses according
>to a machine's Mac address.  Is there a way to deny traffic to the
>internet by both MAC address and IP address?

Combine -s with -m mac.

Re: Blocking machines by both Mac Address and IP address

[Grant Taylor]

On 10/23/10 17:19, Scott Mayo wrote:
> i.e.  If MAC address 00:11:22:33:44:55 is given IP address 
> 192.168.0.1 by DHCP then that should be the only combo that can get 
> to the outside world.  If the IP address is changed to something else 
> or if another machine that has a different MAC address is given the 
> IP address 192.168.0.1 statically, then in neither situation should 
> the machine be able to get out to the world.

I would suggest that you reverse your logic a bit.  Only allow the 
machines to access the internet if the MAC and IP address are correct. 
Any other combination should fail.

This is the old adage of "allow what you want and block the rest" not 
"block what you want and allow the rest".  It is too easy to change an 
IP and / or MAC address to get around the filters that selectively block.



Grant. . . .