I have write a simple script:

#!/bin/sh
MAC=/etc/iptables/mac
iptables -N InputRules
iptables -N OutputRules
iptables -A FORWARD -d 123.124.125.0/255.255.255.192 -j InputRules
iptables -A FORWARD -s 123.124.125.0/255.255.255.192 -j OutputRules
seq 66 127 | while read i
do
iptables -N ip$i\In
iptables -N ip$i\Out
#
iptables -A InputRules -d 123.124.125.$i/255.255.255.192 -j ip$i\In
iptables -A OutputRules -s 123.124.125.$i/255.255.255.192 -j ip$i\Out
#
iptables -A ip$i\In -j RETURN
iptables -A ip$i\Out -m mac --mac-source ! $(cat $MAC | grep -m 1 "123.124.125.$i" | cut -d\ -f3) -j DROP
done

What I want:
- I want to get the traffic of those ip's and use it with mrtg.
- And i check the mac to be sure there is no one who change the ip.
In /etc/iptables/mac i keep a file with this format:
IP_ADDRESS at MAC_ADDRESS
ex:
123.124.125.81 at 00:02:44:3F:CD:EA [ether] on eth1
123.124.125.82 at 00:00:00:00:00:00

Where I'm going wrong with the mac thing? If i execute the script, it's blocking every ip.

thank you in advance.

I may be completely wrong about this, but I don't think iptables can do what you are asking with this script. You've got loops and bash commands and I don't think iptables knows how to deal with those. What you could do is have iptables log the traffic it sees and then have a separate script running as a cron job that checks the logs and takes any appropriate action.


Just out of curiosity, if you run this script and then look at the rules iptables has (iptables -L )what do you get back?

yeah that definatly won't work

the rules only gather the data. The reading is done with another script.

if I run 'iptables -L' i get what i want (or i think i want):

______________________________________________

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination
InputRules all -- anywhere 123.124.125.0/24
OutputRules all -- 123.124.125.0/24 anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain InputRules (1 references)
target prot opt source destination
ip66In all -- anywhere 123.124.125.66/26
...........
ip126In all -- anywhere 123.124.125.126/26
ip127In all -- anywhere 123.124.125.127/26

Chain OutputRules (1 references)
target prot opt source destination
ip66Out all -- 123.124.125.66/26 anywhere
..............
ip126Out all -- 123.124.125.126/26 anywhere
ip127Out all -- 123.124.125.127/26 anywhere

Chain ip100In (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain ip100Out (1 references)
target prot opt source destination
DROP all -- anywhere anywhere MAC !00:E0:4C:EA:01:18

Chain ip101In (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain ip101Out (1 references)
target prot opt source destination
DROP all -- anywhere anywhere MAC !00:00:00:00:00:00
..............
..............
Chain ip98In (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain ip98Out (1 references)
target prot opt source destination
DROP all -- anywhere anywhere MAC !00:80:5F:E7:AB:36

Chain ip99In (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain ip99Out (1 references)
target prot opt source destination
DROP all -- anywhere anywhere MAC !00:02:44:43:03:AA
______________________________________________

OK, I'm confused. You say that you run the script and all ip's are blocked, but both your INPUT chain and your OUTPUT chain are wide open. Their default policy is ACCEPT and there are no rules. If nothing else, the computer this runs on should have full access to the network. The rules in the FORWARD chain don't look like proper syntax to me (actually none of the rules look like proper syntax to me) and I suppose that could be part of the problem. However, usually iptables puts up a fuss when you feed it rules it doesn't recognize. Do you get any error messages when you run your script?

I don't get any error messages from iptables.

And all the ip's are comming from another box. In that second box are connected all the computers with those ip's.
The box where i put the rules is the one with the internet cable.
I hope this help's you.

OK, lets see if I have this correct:

Internet <-> Box 1 (with this iptables) <-> Box 2<->All other boxes

In this case, the only LAN traffic Box1 sees is from Box 2. I'm guessing that the tripping point then is your rules syntax. If I were writing your FORWARD rules they would look like:

iptables -A FORWARD -s 194.176.185.0/24 -j InputRules

However, you have both your InputRules and OutputRules bound to the same IP address range. That would restrict all traffict to just that coming and going from that range. If that is what you want, fine, but if you are trying to use the internet, you aren't going to be able to.

Also since you are using this box a bit like a router, you probably need to investigate using NAT and MASQUERADE in iptables. These rules are actually required if you are using iptables to route traffic and may be another aspect of why you can't access the internet. I've never used them so I won't offer advice, but if you search around this board you will find plenty of examples on how to set them up.

we all have real ip's
so we don't use nat.
Just forwarding.

After spending a little time thinking about your rules, I think the problem is in InputRules and OutputRules. In all of the tables below those, you use either DROP or RETURN. Now RETURNED packets will continue to traverse the InputRules or OutputRules tables, but you leave them high and dry there. There is no rule accepting the packets that make it past your filters. You might try adding an ACCEPT line in those two tables or try RETURNing them to the FORWARD table and accepting them there.

For Hangdog42 (3'rd post) : Sorry, I did not change all the ip's. The 194.176.185.* should be 123.124.125.* . My mistake.
I will put this night 2 RETURN rules in the firewall and see what hapens. Thank you.