Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I grant access to a server based on mac address? (This is a VPS)

According to google searches, this is the syntax to allow a certain mac address...

iptables -A INPUT -m mac --mac-source c4:2c:03:30:14:1f -j ACCEPT

I get useless error messages along the lines of "iptables: Unknown error 18446744073709551615". (Tried it on ubuntu and centos) Is my syntax wrong? Or is the concept fundamentally flawed. Like, is it impossible to filter mac addresses on a VPS. What am I missing here?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The concept is probably flawed, depending on how you're trying to use it.

The MAC address is what's used for communication on the same broadcast domain - so, in cases when one node is talking to another on the same subnet, the source MAC of the packet will actually be the MAC of the source node. However, when traffic is routed, the source MAC changes as it passes through each network segment.

In practical terms: If you're trying to allow all traffic from another VPS on the same broadcast domain, then this should work (it seems like your iptables is having issues with the MAC module). Otherwise, if the source system is outside the subnet (say, a device you're using to manage the VPS), then this is not a workable approach; the source MAC on all traffic routed from the internet is going to be the VPS's first-hop router.

share|improve this answer
    
Thank you for the explanation. While I still don't know why I get an error, at least now I know not to waste time with it anymore. I was trying to match a remote mac address, so it wouldn't have done what I wanted anyway. Thanks. –  Charlie Frank Feb 18 '12 at 22:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.