Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've a script to automatically block internet access after 11pm (23:00) and restore it at 6am (06:00). The script adds and remove some drop rules in iptables.

Unfortunately the filtering rule refers to the IP address. Since the user may easily change its ip address by hand he may thus bypass the filter.

The question is if its possible to define an IP table DROP rule that filters on ethernet address ?

PS: I expect an example as answer, not a simple yes or no ! ;)

share|improve this question
up vote 4 down vote accepted

In short:

iptables -A INPUT -m mac --mac-source 00:0C:F1:6C:CC:7D -j DENY
iptables -A INPUT -m mac --mac-source 00:E0:29:17:7E:78 -j DENY
iptables -A INPUT -m mac --mac-source 00:A0:CC:D4:FE:A7 -j DENY

Perhaps PREROUTING or FORWARD as appropriate for the chain, and ACCEPT not deny if you want a whitelist.

The man page fo iptables is your friend.

share|improve this answer
Sorry, can't vote up yet. Thank you very much. – chmike Jul 7 '09 at 8:03
What is the -m mac for ? Looking at the man page I can't find a --mac-destination. I want to block incoming and outgoing packets to this mac address, whatever it is. I'm using shorewall in fact on a firewall dedicated host, where some net2loc and loc2net chain defines the forwarding rules in both directions. I added IP filtering rules in there and it worked nicely. So what about mac destination ? – chmike Jul 7 '09 at 8:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.