I am trying to stop some hosts on the network from going outside/calling home.

So I have 2 zones.

[root@eagle ~]# firewall-cmd --get-active-zones 
  interfaces: enp2s0
  interfaces: eno1

With masquerading on for external

[root@eagle ~]# firewall-cmd --zone=internal --query-masquerade
[root@eagle ~]# firewall-cmd --zone=external --query-masquerade

And I have a rich rule to drop data for the MAC address I want

[root@eagle ~]# firewall-cmd --zone=external --list-rich-rules 
rule source mac="40:16:3B:63:72:E0" drop

But it doesn't seem to be working. Obvious things I checked are adding them as permanent and making sure I reloaded the rules.

Any help appreciated

  • 1
    I believe it might be a good question, but don't you think you should add some information what kind of firewall you are using? — Just as Example, you're telling I'm driving a Car — no one will know which car your driving (Or is that a secret?) :-)
    – djdomi
    Oct 21, 2021 at 4:24
  • If you mean the backend for firewalld its nftables. Oct 21, 2021 at 13:04

1 Answer 1


You are adding the MAC rule on external zone, which is enp2s0. The ethernet frames sent out via that interface have MAC address of enp2s0 as their source MAC address.

If you want to match devices in the internal network, you need to add MAC matching rules in the internal zone, which is using interface eno1, and sees the client MAC addresses as the source MAC address when it receives frames from clients.

This means that you need to add destination IP address matching in the rule too.

  • If I add it to the internal zone, then won't that mean it is unable to communicate with anything else on the LAN too. Would there be an equivalent to iptables POSTROUTING in nftables to add a rule there? Oct 21, 2021 at 19:11
  • 1
    LAN side traffic is switched on L2, it doesn't go through IPTables. If you run a bridge on the box bridging different LAN side interfaces, the bridge is still assigned to internal zone, so traffic still flows. Oct 21, 2021 at 20:22
  • Thanks for your help. I moved the MAC rule to internal - but I wasn't clear on what you meant by dest ip - I want to block all outgoing. I cut all connection with conntrack but 40:16 is still getting out. 15:27:20.930195 40:16:3b:63:72:e0 > 64:00:6a:57:f8:1f, ethertype IPv4 (0x0800), length 1514: > Flags [.], seq 543929265:543930713, ack 3518997520, win 331, options [nop,nop,TS val 36061421 ecr 1532501099], length 1448 Oct 21, 2021 at 21:30
  • 1
    The packets are visible on the internal interface that you used when you run TCPDump. The packets shouldn't be visible on the outgoing interface. Oct 22, 2021 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.