LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 08-19-2003, 02:27 AM   #1
Ge64
LQ Newbie
 
Registered: Jul 2003
Location: France
Distribution: Red Hat 7.3
Posts: 2

Rep: Reputation: 0
iptables syntax


Hi folks !

My question is rather simple, for anyone who knows the answer, of course

In an iptables script, what separator can I use between two mac-adresses ?

I use iptables as a firewall to filter the requests depending on the source mac address, for example, I have the rules

iptables -A FORWARD -m state -state NEW -m mac -mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
iptables -A FORWARD -m state -state NEW -m mac -mac-source yy:yy:yy:yy:yy:yy -j ACCEPT
iptables -A FORWARD -m state -state NEW -m mac -mac-source zz:zz:zz:zz:zz:zz -j ACCEPT
and so on...

and I would like to use one single rule, to group all the MAC adds in only one line, such as

iptables -A FORWARD -m state -state NEW -m mac -mac-source xx:xx:xx:xx:xx:xx "sep" yy:yy:yy:yy:yy:yy "sep" zz:zz:zz:zz:zz:zz -j ACCEPT

where "sep" is the expected separator.

Thanks in advance !
 
Old 08-19-2003, 01:10 PM   #2
Mathieu
Senior Member
 
Registered: Feb 2001
Location: Montreal, Quebec, Canada
Distribution: RedHat, Fedora, CentOS, SUSE
Posts: 1,403

Rep: Reputation: 46
You can try to use the comma (,)
However, according to the MAN page for iptables, you can only speficy one MAC per rule.

Tell me if I am wrong.

Bonne chance
 
Old 08-20-2003, 02:33 AM   #3
Ge64
LQ Newbie
 
Registered: Jul 2003
Location: France
Distribution: Red Hat 7.3
Posts: 2

Original Poster
Rep: Reputation: 0
Here is a solution :

Quote:
for mac in ${MAC_ADDRESSES}; do
iptables -A FORWARD -m state -state NEW -m mac --mac-source {mac} -j ACCEPT
done
I previously tried the comma, unsuccessfully. A separator may exist, but I still do not know about it.

A la prochaine !
 
Old 08-20-2003, 10:56 PM   #4
Half_Elf
Guru
 
Registered: Sep 2001
Location: Montreal, Canada
Distribution: Slackware; Debian; Gentoo...
Posts: 2,163

Rep: Reputation: 45
wow, nice rules really LOL

what's about just using 3 lines only for the three mac adress?
iptables will "jump" to the next line if the first one isn't matching.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables syntax puzzler tantric Linux - Security 6 03-22-2005 06:46 PM
What's wrong with this iptables syntax?? registering Linux - Security 3 06-16-2004 03:54 PM
iptables syntax question Poetics Linux - Security 4 12-24-2003 03:32 PM
iptables SYNTAX jrgalan Linux - Security 2 07-31-2003 12:54 AM
ipaddress syntax - iptables arobinson74 Linux - Networking 3 03-31-2003 12:34 PM


All times are GMT -5. The time now is 05:42 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration