Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use a linux Centos 6.3 as an Internet gateway with NAT. I want to allow a specific host to have access to Internet, but I don't want to use its IP address since it may get a new IP address from the DHCP server. Instead I want to use a rule for a specific MAC address.

I used the following but it does not work:

iptables -t nat -A POSTROUTING -o $INTERNETDEVICE -j MASQUERADE
iptables -A INPUT -i $INTERNETDEVICE -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 10.1.1.0/24 -j ACCEPT
iptables -A FORWARD -m mac --mac-source {my mac address} -j ACCEPT

where INTERNETDEVICE is the ppp device to internet

If instead of 4th rule I enter

iptables -A FORWARD -s 10.1.1.39 -j ACCEPT

it works perfectly. But with the mac-address, it does not work.

Any help would be appreciated.

share|improve this question
    
(Not a solution to your problem necessarily, but if this isn't a particularly security-conscious environment you could just set your DHCP server to always give the same address to your MAC, and then use that IP in the firewall) –  nickgrim Mar 7 '13 at 10:44
    
@nickgrim Why not? It's what the rest of us do. –  Michael Hampton Mar 7 '13 at 10:57
    
Well, if your machine is not on, a Malicious Attacker could set their IP statically to whatever-your-usual-IP-is, and access whatever resource it is they're not supposed to be able to access. So, not good for security-conscious environments. (Although, yeah, you can fake MACs too) –  nickgrim Mar 7 '13 at 11:02
add comment

1 Answer

Found similar problem here.

Solution was to add this rule to your chain:

iptables -A FORWARD -m state --state ESTABLISHED -s 0/0 -j ACCEPT

Another thing was to verify that the module ipt_mac is loaded.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.