Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm doing some testing on my linux VM with one nic, I want to use it as some kind of a firewall which can block traffic of some clients based on a mac address.

The client itself is having the VM as a default gateway (.254), the VM itself has (.1 the actual router) as default gateway.

This is the iptable script that I'm using at the moment. I have internet on my client, but .14 is still getting internet, when using the mac address, nothing is beging blocked.

Am I missing something?

    # Generated by iptables-save v1.4.14 on Sun Feb 23 12:16:26 2014
*filter
:INPUT ACCEPT [869:78983]
:FORWARD ACCEPT [1183:197765]
:OUTPUT ACCEPT [644:128360]
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

# log iptables denied calls (access via 'dmesg' command)
-P FORWARD DROP
-F FORWARD
-A FORWARD -i eth0 -m mac --mac-source 64:20:0c:ac:f4:49 -j DROP
-A FORWARD -i eth0 -s 192.168.1.14 -j DROP
-A FORWARD -i eth0 -j ACCEPT
# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT
# Completed on Sun Feb 23 12:16:26 2014
share|improve this question
    
Use tcpdump/wireshark. Are packets going where you think they should? –  Zoredache Feb 24 at 22:53
add comment

2 Answers 2

up vote 0 down vote accepted

You need to put these rules on the gateway .254, who is used by .14.

If you need to block .14 at .1 gateway level, you need to ensure who the packets are being reaching with the mac address from .14, if the packets are being forwarded by .254 via NAT, then these packets will be repacked with .254 mac address.

I recommend you to create a subnet for client .14 not be able to connect directly to .1 gateway.

share|improve this answer
    
Hi fgbreel, I've put these rules on the .254, but I got the feeling that the ip rule is not really blocking traffic. (the mac rule can be ignored) –  Wouter Feb 24 at 22:45
    
Can you check on the client .14 who are gateway default? –  fgbreel Feb 24 at 23:05
    
.14 has a default gateway of .254 –  Wouter Feb 25 at 18:27
    
Try to set the DROP rule with mac module in the PREROUTING chain from nat tables as described by @quadruplebucky. iptables -t nat -A PREROUTING -p all -m mac --mac-source 64:20:0C:AC:F4:49 -j DROP –  fgbreel Feb 25 at 18:31
    
I'm noticing that the drop action is not permitted by iptables. The "nat" table is not intended for filtering, the use of DROP is therefore inhibited. –  Wouter Feb 25 at 18:39
show 4 more comments

MAC address filtering needs to happen in the PREROUTING chain, by the time the packet reaches the FORWARD chain the MAC address is already rewritten to that of the (internal) iptables bridge.

See Paragraph 9 of http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html#section8 for a more detailed explanation.

You also flush the FORWARD chain after setting the default policy (the -F FORWARD line), I doubt you want to do that (it restores the default policy of ACCEPT).

I don't see why "-A FORWARD -i eth0 -s 192.168.1.14 -j DROP" isn't blocking that source IP, but at any rate you shouldn't need the "-i eth0" in there. Are you sure that 1.14 is using 254 as the default gw?

It would also help to post the output of iptables -L -v to see what is actually loaded.

share|improve this answer
    
This is the output of the iptables command link. I'll look into ebtables. –  Wouter Feb 25 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.