IPTables How To "Deny all MAC" on router

neopandid · 07-19-2013, 12:13 AM

Hi,
I have a several debian squid routers and on one of these routers, I want to allow only certain MAC addresses in IPTABLES.

I searched but I couldn't find any documents about this.

My system administrators told me that we can't do that.
But we have ZyXEL routers and these machines can create "Black Lists" or more importantly "White Lists" for MAC Filtering, I'm pretty sure these routers use linux and iptables.

Thanks in advance

unSpawn · 07-19-2013, 01:26 AM

Quote:

Originally Posted by neopandid

I want to allow only certain MAC addresses in IPTABLES. I searched but I couldn't find any documents about this.

'man iptables' says to use "-m mac --mac-source XX:XX:XX:XX:XX:XX".

Quote:

Originally Posted by neopandid

My system administrators told me that we can't do that. But we have ZyXEL routers and (..) I'm pretty sure these routers use linux and iptables.

Either check the vendors documentation or (have someone) log in and find out.

neopandid · 07-19-2013, 02:13 AM

Thank you but I have already checked manual pages, but I couldn't find how to create a "White MAC List" and deny every other MAC address in IPTables.

Celyr · 07-19-2013, 02:38 AM

you can do it in several way, the easiest is maybe to do a list of accept in that chain and then a drop for example:

Code:

iptables -A INPUT -m mac --mac-source 01:02:03:04:05:06 -j ACCEPT
iptables -A INPUT -m mac --mac-source 01:02:03:04:05:07 -j ACCEPT
iptables -A INPUT -m mac --mac-source 01:02:03:04:05:08 -j ACCEPT
iptables -A INPUT -m mac --mac-source 01:02:03:04:05:09 -j ACCEPT
iptables -A INPUT -m mac --mac-source 01:02:03:04:05:10 -j ACCEPT

iptables -A INPUT -j DROP

Since the kernel executes the firewall in order from the first to the last rule and the ACCEPT target stops the execution of next rules packets from desidered macs will be accepted and the others dropped.
hth.

Noway2 · 07-19-2013, 07:42 AM

Two other things to bear in mind are one, that MAC addresses do not pass through routers and filtering by MAC will be inherently limited as a result. Two, devices tend to easily give out MAC information because MAC was never meant to be a secure ID and hence it is easy to bypass a filter by simply identifying MAC numbers associated with the access point.