Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use a linux Centos 6.3 as an Internet gateway with NAT. I want to allow a specific host to have access to Internet, but I don't want to use its IP address since it may get a new IP address from the DHCP server. Instead I want to use a rule for a specific MAC address.

I used the following but it does not work:

iptables -A FORWARD -d -j ACCEPT
iptables -A FORWARD -m mac --mac-source {my mac address} -j ACCEPT

where INTERNETDEVICE is the ppp device to internet

If instead of 4th rule I enter

iptables -A FORWARD -s -j ACCEPT

it works perfectly. But with the mac-address, it does not work.

Any help would be appreciated.

share|improve this question
(Not a solution to your problem necessarily, but if this isn't a particularly security-conscious environment you could just set your DHCP server to always give the same address to your MAC, and then use that IP in the firewall) – nickgrim Mar 7 '13 at 10:44
@nickgrim Why not? It's what the rest of us do. – Michael Hampton Mar 7 '13 at 10:57
Well, if your machine is not on, a Malicious Attacker could set their IP statically to whatever-your-usual-IP-is, and access whatever resource it is they're not supposed to be able to access. So, not good for security-conscious environments. (Although, yeah, you can fake MACs too) – nickgrim Mar 7 '13 at 11:02

Found similar problem here.

Solution was to add this rule to your chain:

iptables -A FORWARD -m state --state ESTABLISHED -s 0/0 -j ACCEPT

Another thing was to verify that the module ipt_mac is loaded.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.