Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux box that am using as a router. The box's 'WAN' connection is actually another LAN (the primary LAN). I am trying to use my box/router to create another LAN (the secondary LAN). The purpose of the secondary LAN is to isolate a section of the network from the primary LAN. When I say isolate, I mean any network discovery protocols (bonjour, whatever windows uses, and anything else that uses the broadcast address) would not extend outside of the secondary LAN and any traffic between devices in the secondary LAN would never pass into the primary LAN. The main issue is that I need one-to-one NAT between the primary and secondary LANs, also in such a way that MAC addresses are passed through the NAT.

Ideally, I would have three lists of MAC addresses. Devices on the first list would be treated as described above. Devices on the second list would not be able to connect to anything outside the secondary LAN (my printer). Devices on the third list would effectively be only in the primary LAN (as if they were connected directly and only to the same WAN port).

1) How do I create a one-to-one NAT?

2) How do I pass MAC addresses through that NAT?

3) (Less important) How do I set up different routing rules dependent on MAC address as described in the second paragraph?

share|improve this question

migrated from Oct 5 '12 at 22:30

This question came from our site for professional and enthusiast programmers.

It sounds like you don't need a router but a bridge with filtering. Try this, although it might be tricky to create such rules. – Banthar Oct 5 '12 at 20:45
Trying to do both NAT and keeping MAC addresses makes this a whole lot harder than it needs to be based on the explanation you've provided. A filtering bridge (the tool for this is ebtables) between the physical networks (with all hosts in the same IP network) should do the job just fine. – DerfK Oct 5 '12 at 23:21
Filtering at the MAC address level is the wrong way to do it. Why do you need to pass the MAC addresses? There is almost no good reason to do this. In addition to the ebtables suggestion you could do something simple with proxyarp. – Zoredache Oct 5 '12 at 23:23
The way the primary LAN is managed makes it necessary pass MAC addresses. If I have multiple devices connecting behind one MAC address (a router), my access will be revoked. – Ethan Reesor Oct 6 '12 at 0:36
@FireLizzard that sounds like a kind of port security on the switch to prevent man-in-the-middle attacks. Why can't you disable this? The solution is still more easily addressed using Layer 3 subnetting. – Alastair McCormack Oct 10 '12 at 8:59

Apologies for not answering the question directly and perhaps teaching you how to suck eggs.

I know you've said this is an experiment but it doesn't sound like a good idea for day-to-day. I'm also confused about what you mean about "passing MAC address through NAT". It sounds like you're hacking Layer 3 in order to control Layer 2.

Instead, to achieve your "security zones" you can easily create three subnets:, and These can run on the same physical Ethernet hardware. Use your Linux box to route between the subnets and firewall traffic as required.

You could implement some level of Layer 2 segregation by using VLANs, either created on the switch or with VLAN tagging.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.