Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 08-19-2003, 02:27 AM   #1
LQ Newbie
Registered: Jul 2003
Location: France
Distribution: Red Hat 7.3
Posts: 2

Rep: Reputation: 0
iptables syntax

Hi folks !

My question is rather simple, for anyone who knows the answer, of course

In an iptables script, what separator can I use between two mac-adresses ?

I use iptables as a firewall to filter the requests depending on the source mac address, for example, I have the rules

iptables -A FORWARD -m state -state NEW -m mac -mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
iptables -A FORWARD -m state -state NEW -m mac -mac-source yy:yy:yy:yy:yy:yy -j ACCEPT
iptables -A FORWARD -m state -state NEW -m mac -mac-source zz:zz:zz:zz:zz:zz -j ACCEPT
and so on...

and I would like to use one single rule, to group all the MAC adds in only one line, such as

iptables -A FORWARD -m state -state NEW -m mac -mac-source xx:xx:xx:xx:xx:xx "sep" yy:yy:yy:yy:yy:yy "sep" zz:zz:zz:zz:zz:zz -j ACCEPT

where "sep" is the expected separator.

Thanks in advance !
Old 08-19-2003, 01:10 PM   #2
Senior Member
Registered: Feb 2001
Location: Montreal, Quebec, Canada
Distribution: RedHat, Fedora, CentOS, SUSE
Posts: 1,403

Rep: Reputation: 46
You can try to use the comma (,)
However, according to the MAN page for iptables, you can only speficy one MAC per rule.

Tell me if I am wrong.

Bonne chance
Old 08-20-2003, 02:33 AM   #3
LQ Newbie
Registered: Jul 2003
Location: France
Distribution: Red Hat 7.3
Posts: 2

Original Poster
Rep: Reputation: 0
Here is a solution :

for mac in ${MAC_ADDRESSES}; do
iptables -A FORWARD -m state -state NEW -m mac --mac-source {mac} -j ACCEPT
I previously tried the comma, unsuccessfully. A separator may exist, but I still do not know about it.

A la prochaine !
Old 08-20-2003, 10:56 PM   #4
LQ Guru
Registered: Sep 2001
Location: Montreal, Canada
Distribution: Slackware; Debian; Gentoo...
Posts: 2,163

Rep: Reputation: 45
wow, nice rules really LOL

what's about just using 3 lines only for the three mac adress?
iptables will "jump" to the next line if the first one isn't matching.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables syntax puzzler tantric Linux - Security 6 03-22-2005 06:46 PM
What's wrong with this iptables syntax?? registering Linux - Security 3 06-16-2004 03:54 PM
iptables syntax question Poetics Linux - Security 4 12-24-2003 03:32 PM
iptables SYNTAX jrgalan Linux - Security 2 07-31-2003 12:54 AM
ipaddress syntax - iptables arobinson74 Linux - Networking 3 03-31-2003 12:34 PM

All times are GMT -5. The time now is 07:49 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration