I need to block certain hosts (multi-OS) on our LAN from gaining internet access. I decided to try and block certain hosts by mac address via iptables but I can't use the mac address of the workstation as it traverses an L3 switch and the frame gets rebuilt with the switch's interface mac. I've confirmed this using wireshark's tshark
utility.
I know that I can block by IP address but I can't control if a user were to change his/her IP and thus the block would be circumvented. I'm thinking a solution could be achieved with a script that does the following:
- Update the arp table using fping:
fping -c 1 -g 10.10.10.0/24
- Grep the arp table to get IP from a list of mac addresses, say in a file:
arp -n | grep "00:11:22:aa:bb:cc" | awk '{print $1}'
- Build a hash or array and dynamically update iptables with the IP addresses that need to be block. I would probably use a file and do something like
iptables-restore < ips_to_deny
. - Run this script say every 5 mins or so. (Not to sure about timing)
So... the question. Does you see any flaws in this method? Or ways to make it better?
- Mac spoofing comes to mind but host users don't have admin access.
I'd use either perl or ruby for the script if that matters much.