I would like to force all users to connect using DHCP, and to block users who specify their own IP.
I have setup a dhcp based on MAC address so every user get theri own ip but since i have Win98 users can change their IP.

So do I have any way to set this up ??


Regards, PcHammer

iptables -t nat -I PREROUTING -i eth~ -s 192.168.1.x -m mac --mac-source ! 00:66:88:FF:GG:DD -j DROP

(If the mac address for the ip number isn't a match drop it...)

You can also put the rule in the INPUT or FORWARD chains.
Dropping them in the nat PREROUTING chain will only effect NEW connections.
This means they are checked only on their 1st packet, not every packet.

There may be a lot of entries, so I suggest using a separate chain so it can be edited more easily, eg

iptables -t nat -N mac_check
iptables -t nat -I PREROUTING -i eth~ -j mac_check
iptables -t nat -I mac_check -p udp --dport 67 -j RETURN
iptables -t nat -A mac_check -s 192.168.1.x -m mac --mac-source 00:66:88:FF:GG:DD -j RETURN
iptables -t nat -A mac_check ... (ip number & correct macs)
iptables -t nat -A mac_check ... etc
iptables -t nat -A mac_check -j DROP

(If the number/mac is matched, go back to PREROUTING & continue...
otherwise get dropped at the end of the new chain.)

A suggestion, put the busiest machines at the beginning of the list!

Thank you very much it's working great.

But now if i may have one more question, as I have a lot of ips and i would like to use one file where ip and mac address would be stored:
192.168.1.x 00:01:BG:12:45

IPtables rule would be like this than:
iptables -t nat -I PREROUTING -i eth0 -s $IP -m mac --mac-source ! $MAC -j DROP

As i'm not to good in shell programing, i would like to know how can this be done.


regards, PcHammer

Sure, it'll take me a little while too..
it's not my strong point either..

They will need to be in a separate chain so that they don't interfere with existing/future PREROUTING rules...
The info will end up in dhcpd.conf, so maybe a script to build/append to all three files from one master would be good..

How do you start iptables?
From /etc/init.d or from a script?

Great and tnx.
And I start iptables from /etc/rc.d/rc.firewall ( slackware distro )


regards, PcHammer