Centralized MAC filter for wireless lan

Question

I am attempting to install a MAC filter in between a switch that handles my wireless network and the core of the network. The idea is to have a centralized MAC filter bypassing the filters built into the individual access points. My proposal is that wireless devices would still be able to use network resources. How can I effectively do this using Ubuntu 10.04? I have a old dell that I am testing on right now with 2 NICs. I know you can do anything in the world with Linux... soooooo how should I go about this? I would greatly appreciate tutorials.

Answer 1

A good place to start would be as follows.

You could enable ip_forwarding in Ubuntu to make it route traffic:

echo 1 > /proc/sys/net/ipv4/conf/default/forwarding

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

Then use arp to set up static entries (manually filtering):

arp -s address hw_addr

man arp for more details.

Answer 2

Enable Forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Set iptables FILTER/FORWARD chain to drop everything.

iptables -t filter -P FORWARD DROP

Add static entries to the FORWARD chain for MAC addresses you want to route into the network.

iptables -A FORWARD -m mac --mac-source FF:FF:FF:FF:FF:FF -j ACCEPT

Add an entry to the forward table to allow traffic from already established connections. This will make sure that the returned traffic can be routed back to the wireless LAN.

iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

As long as you add each MAC address that you want allow routing for, this should work.

Note that this answer doesn't account for the required routing infrastructure. When forwarding packets across interfaces, it's assumed that you're traversing to a different subnet. If you're bridging the NICs so they're on the same network; this solution will not work since you're no longer routing packets.