Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wrote some rules to prevent all incomming packet from other computers in my private network except my router. That is why I still want my computer to access the Internet.

This is my rules:

iptables -F
iptables -P INPUT DROP
iptables -A INPUT -m mac --mac-source xx:xx:Xx:xx:xx:xx -j ACCEPT

It is a simple rule. xx:xx:Xx:xx:xx:xx is mac address of the router. I read the document so I know iptables -P INPUT DROP will drop all packets don't match with the below rule. In fact, the rules don't work. I just access to my router but I can not access the Internet. It's difficult to know because I make sure all incomming packets from the Internet come my computer with mac address of my router.

I wrote the rules to fix it:

iptables -F
iptables -P INPUT ACCEPT
iptables -A INPUT -m mac ! --mac-source xx:xx:xx:xx:Xx:xx -j DROP 

It works but I would like the idea "deny all, allow selected". It is simpler in configuration and design.

I hope someone makes me clear why the first rules do not work.

share|improve this question
1  
Can you elaborate on how you are testing the drop condition? Keep in mind that the INPUT table only applies to traffic destined for the machine itself, and traffic that passes between interfaces is subject to the FORWARD table instead. –  Andrew B Jun 9 '13 at 16:49
4  
have you tried adding a logging rule to your first set of rules to debug it further? –  dawud Jun 9 '13 at 16:49
    
Please show all the rules, (with iptables -S) may be the problem is in other place. –  Brigo Jun 9 '13 at 23:28

1 Answer 1

Thank you for your good advices. I found out the cause of the problem. This is my all rule:

-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -j LOG --log-prefix my_rule --log-level 6
-A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
-A INPUT -i lo -j ACCEPT

Basically, the rule is right except I forgot the last rule for loopback interface. When I surf the Internet, some dns request needed to send to dns service on my computer via loopback interface. If I forget it, I can not resolv any domains.

At first, my solution is add a rule that accept any incomming request has mac address is 00:00:00:00:00:00 because I see this is the mac address of all requests sent via loopback interface but iptables seem not to know. No packet with 00:00:00:00:00:00 is accepted. I read the iptables manual but I still don't see the description of iptables behavior with mac address 00:00:00:00:00:00. I guess iptables think 00:00:00:00:00:00 means 'no mac address'

P/S: I am learning English. Sorry about my mistake in grammar.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.