Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm doing some testing on my linux VM with one nic, I want to use it as some kind of a firewall which can block traffic of some clients based on a mac address.

The client itself is having the VM as a default gateway (.254), the VM itself has (.1 the actual router) as default gateway.

This is the iptable script that I'm using at the moment. I have internet on my client, but .14 is still getting internet, when using the mac address, nothing is beging blocked.

Am I missing something?

    # Generated by iptables-save v1.4.14 on Sun Feb 23 12:16:26 2014
:INPUT ACCEPT [869:78983]
:FORWARD ACCEPT [1183:197765]
:OUTPUT ACCEPT [644:128360]
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d -j REJECT

# log iptables denied calls (access via 'dmesg' command)
-A FORWARD -i eth0 -m mac --mac-source 64:20:0c:ac:f4:49 -j DROP
-A FORWARD -i eth0 -s -j DROP
-A FORWARD -i eth0 -j ACCEPT
# Reject all other inbound - default deny unless explicitly allowed policy:

# Completed on Sun Feb 23 12:16:26 2014
share|improve this question
Use tcpdump/wireshark. Are packets going where you think they should? – Zoredache Feb 24 '14 at 22:53
up vote 0 down vote accepted

You need to put these rules on the gateway .254, who is used by .14.

If you need to block .14 at .1 gateway level, you need to ensure who the packets are being reaching with the mac address from .14, if the packets are being forwarded by .254 via NAT, then these packets will be repacked with .254 mac address.

I recommend you to create a subnet for client .14 not be able to connect directly to .1 gateway.

share|improve this answer
Hi fgbreel, I've put these rules on the .254, but I got the feeling that the ip rule is not really blocking traffic. (the mac rule can be ignored) – Wouter Feb 24 '14 at 22:45
Can you check on the client .14 who are gateway default? – fgbreel Feb 24 '14 at 23:05
.14 has a default gateway of .254 – Wouter Feb 25 '14 at 18:27
Try to set the DROP rule with mac module in the PREROUTING chain from nat tables as described by @quadruplebucky. iptables -t nat -A PREROUTING -p all -m mac --mac-source 64:20:0C:AC:F4:49 -j DROP – fgbreel Feb 25 '14 at 18:31
I'm noticing that the drop action is not permitted by iptables. The "nat" table is not intended for filtering, the use of DROP is therefore inhibited. – Wouter Feb 25 '14 at 18:39

MAC address filtering needs to happen in the PREROUTING chain, by the time the packet reaches the FORWARD chain the MAC address is already rewritten to that of the (internal) iptables bridge.

See Paragraph 9 of for a more detailed explanation.

You also flush the FORWARD chain after setting the default policy (the -F FORWARD line), I doubt you want to do that (it restores the default policy of ACCEPT).

I don't see why "-A FORWARD -i eth0 -s -j DROP" isn't blocking that source IP, but at any rate you shouldn't need the "-i eth0" in there. Are you sure that 1.14 is using 254 as the default gw?

It would also help to post the output of iptables -L -v to see what is actually loaded.

share|improve this answer
This is the output of the iptables command link. I'll look into ebtables. – Wouter Feb 25 '14 at 18:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.