Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to install a MAC filter in between a switch that handles my wireless network and the core of the network. The idea is to have a centralized MAC filter bypassing the filters built into the individual access points. My proposal is that wireless devices would still be able to use network resources. How can I effectively do this using Ubuntu 10.04? I have a old dell that I am testing on right now with 2 NICs. I know you can do anything in the world with Linux... soooooo how should I go about this? I would greatly appreciate tutorials.

share|improve this question

A good place to start would be as follows.

You could enable ip_forwarding in Ubuntu to make it route traffic:

echo 1 > /proc/sys/net/ipv4/conf/default/forwarding

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

Then use arp to set up static entries (manually filtering):

arp -s address hw_addr

man arp for more details.

share|improve this answer

Enable Forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Set iptables FILTER/FORWARD chain to drop everything.

iptables -t filter -P FORWARD DROP

Add static entries to the FORWARD chain for MAC addresses you want to route into the network.

iptables -A FORWARD -m mac --mac-source FF:FF:FF:FF:FF:FF -j ACCEPT

Add an entry to the forward table to allow traffic from already established connections. This will make sure that the returned traffic can be routed back to the wireless LAN.

iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

As long as you add each MAC address that you want allow routing for, this should work.

Note that this answer doesn't account for the required routing infrastructure. When forwarding packets across interfaces, it's assumed that you're traversing to a different subnet. If you're bridging the NICs so they're on the same network; this solution will not work since you're no longer routing packets.

share|improve this answer
If I can set up my linux box as a router while still being able to access shared files on the main network, I would be interested in it. Can you walk me through what I would need to set up? Maybe even a link to a tutorial. I'm familiar with Linux but I don't have an intimate knowledge of the networking side. Please help, thank you. – user76318 Mar 29 '11 at 19:08
Setting up a true routed environment would be somewhat tricky unless you already had some routing protocols up and working. The simplest solution would be to setup NAT from wireless to wired. As long as nothing from the wired network plans to go back to the wireless network, you can use NAT. If you want full connectivity in the wired -> wireless direction you need real routing. To setup NAT/PAT iptables -t POSTROUTING -A OUTPUT -o {ethX} -j MASQUERADE. NOTE: {ethX} <- replace with wired facing interface. – Sean C. Mar 29 '11 at 19:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.