LinuxQuestions.org - How to open port on iptables locked on a specific internal MAC address?

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - How to open port on iptables locked on a specific internal MAC address? (https://www.linuxquestions.org/questions/linux-security-4/how-to-open-port-on-iptables-locked-on-a-specific-internal-mac-address-589446/)

How to open port on iptables locked on a specific internal MAC address?

Hello there.

I am currently having a slight problem with our firewall. Basically "transmissions" are locked and all ports locked except for HTTP and HTTPS.

However one developers computer has to have access through the firewall on a specific port (the FTP port, 21).

However I need it so that only this specific computer to be able to get through the Firewall. Therefore I thought of opening a port open only for that computers specific MAC address.

However after some googling I haven't found the right command/rule for this. Can anyone tell me the rule/show me where I can find something like this?.

Thanks in advance. :)

Sincerely:
Jonatan Nilsson
Iceland

P.S.
Just to clarify: Everything is locked so I thing I may also have to specifie OUT and IN.

i'm very new to iptables but from the manual:

Quote:

mac
--mac-source [!] address
Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. Note that this only makes sense for
packets coming from an Ethernet device and entering the PREROUTING, FORWARD or INPUT chains.

i believe this will work for you:

Code:

iptables -A INPUT -p tcp --dport ftp --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT

The syntax on that is missing the module. It's like:

Code:

-m mac --mac-source xx:xx:xx:xx:xx:xx

Also, if this is a gateway/firewall setup, in the sense that you want to give someone on the LAN access to an FTP server on the WAN, then you need to use the FORWARD chain.

Code:

iptables -A FORWARD -p TCP -i $LAN_IFACE -o $WAN_IFACE --dport 21 \

-m state --state NEW -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT

The returning packets will get picked-up by your RELATED,ESTABLISHED rule.