I've a script to automatically block internet access after 11pm (23:00) and restore it at 6am (06:00). The script adds and remove some drop rules in iptables.

Unfortunately the filtering rule refers to the IP address. Since the user may easily change its ip address by hand he may thus bypass the filter.

The question is if its possible to define an IP table DROP rule that filters on ethernet address ?

PS: I expect an example as answer, not a simple yes or no ! ;)


In short:

iptables -A INPUT -m mac --mac-source 00:0C:F1:6C:CC:7D -j DENY
iptables -A INPUT -m mac --mac-source 00:E0:29:17:7E:78 -j DENY
iptables -A INPUT -m mac --mac-source 00:A0:CC:D4:FE:A7 -j DENY

Perhaps PREROUTING or FORWARD as appropriate for the chain, and ACCEPT not deny if you want a whitelist.

The man page fo iptables is your friend.

  • What is the -m mac for ? Looking at the man page I can't find a --mac-destination. I want to block incoming and outgoing packets to this mac address, whatever it is. I'm using shorewall in fact on a firewall dedicated host, where some net2loc and loc2net chain defines the forwarding rules in both directions. I added IP filtering rules in there and it worked nicely. So what about mac destination ? – chmike Jul 7 '09 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.