Hello! I am wondering if anybody can help me in finding ways to block connection to the server using MAC address. The scenerio is

I have a DHCP server which also acts as a network gateway for my entire LAN. I used to use IP for blocking certain computers to browse the Internet (I have squid running in the same box), but then they would change their IP and get into the Net. I am using RH8.

Now, can anybody please tell me if I can block these connections using MAC address through IPTables, and if yes, how?

If no, what can be an alternative means?

The fact that these connections are using other IP is both annoying and occassionally problematic for me since they are colliding with the eligible IPs as well.

Thanks for your response

Look at the various modules that can be used for iptables. Look in the kernel configuration screen under networking options->ip netfilter configuration->MAC match address support. THat should do the trick.

Actually setting it up is a bit beyond my experience but the documentation should help you.

Alex

You could aslo setup dchp to assign specific IP addresses to specific mac addresses. You could then use regular IP tables to filter out the internet connection

Hi

I think I know what you are trying to do. I would like to so something similar. I would like to force all users to connect using DHCP, and to block users who specify their own IP.

However, if you just want to block certain computers completely, its easy using iptables

iptables -I INPUT -p all -m mac --mac-source aa:bb:cc:dd:ee:ff -j DROP

will prevent connection from the mac address aa:bb:cc:dd:ee:ff

if you want to allow access again just do service firewall restart

To make the changes more permanent (to survive restarting the firewall) you will need to edit rc.firewall

Hope this helps

Let us know if you manage to sort out IP assignments.

yes, it worked :-) I love it ;-)

but as people suspected, I changed -p all to -p tcp, so they can ping, but no internet :-)

thanks thanks and thanks.

all the best

but they can play games cs quake ia

well, in my network, they cannot. Any and ALL request to the interface is rejected immediately. Can they play games in yours?

well i have a little home network