Hey all,

I am trying to secure my home network and I have been wondering something. Say I want to set up something where I only allow the ip addresses I set up to access anything. IE: Gateway/firewall is 192.168.1.2, My PC is 192.168.1.200 and I want to be able to access the network and do everything a normal person would, now some person comes over to my house, plugs his laptop into my network and gives himself an ip address of 192.168.1.240 and I don't want him to be able to access anything at all on the network. How could I go about making this happen?

If there is a way to only allow certain ip addresses or even mac addresses to connect through the gateway, this would be great.

As always, any help would be greatly appreciated and I welcome all comments or suggestions.

Thanks

You can definitely limit the network users by MAC address. Look at your router settings. The default is to allow everyone. Change that to "Limit access to these MAC addresses" or something similar to this.

I don't have a router, I just have a Slackware box with 2 nics attached to a hub on one end and attached to my modem on the other. If I would have known a router could do that I would have gotten one. Well I am trying to learn Slackware better then I already do so this can help me learn something new.

Thanks

You can use iptables to specify that you only want your IP and MAC to get routed. Keep in mind that MACs are easily spoofed, so if you want something truly secure, you need to setup some type of authentication. Either that, or limit access to the ethernet ports which these people that come to your house currently have access to.The above example would make it so any outgoing packets which don't have a source IP of 192.168.1.200 and a source MAC of xx:xx:xx:xx:xx:xx would get filtered. Replace $LAN_IFACE with the actual name of your LAN interface, and xx:xx:xx:xx:xx:xx with the actual MAC of your PC's NIC.

Hey there,

Sorry for such the delay for my reply but I have been busy. Thats the kind of information I was looking for. Allowing only a certain ip with a certain mac address is also a great idea. If I was able to set up some type of authentication to get an ip address, that would be even better.

I have found bits of info and am working on currently implementing it and shall post here how it went.

Thanks

Well I have been looked into this for a day or so now and I am wondering if the same type of filtering is possible with ipchains.

Thanks

Not sure, when I started using GNU/Linux several years ago ipchains was already obsolete, so I've never really used it.