0

I read in a paper that some middleboxes like firewalls don't have a MAC address for security purposes. I couldn't confirm using Google search. Is this common practice? How is this done?

3 Answers 3

1

If the sole purpose of your firewall is to inspect and discard packets, there is no reason for it to have a MAC address. I mean, the whole point if a MAC address is to give the device a local (unique) identifier that other devices can use to talk to it. Since, in reality, they're only going to want to talk through it, it doesn't really need one.

In terms of implementation detail, the best one would be for it to pretend it's not there (which may violate standards). For example, take a packet. Inspect it, if it looks good, forward it on unmodified. If it looks bad, drop it like nothing happened.

1

How is this done is easily answered. You only need a MAC if you need to be reachable as a destination via IP. Not for the simple task of echoing data (like a simple hub does, or like an unmanaged switch).

And as a firewall you do not need to echo/forward everything, just the ports which are opened.

1

Host's interfaces can be grouped into the "bridge" - equivalent of the ethernet hub that simply retranslate everything incoming on the one interface to the others. All interfaces are works in so-called "promiscuous" mode and received every incoming packet despite of its destination MAC/IP-address at all. Host with bridge and packet filter inside called filtering bridge.

Filtering bridges was a common practice before vlans has been populated. They allow to seperate subnets in various ways and filter the traffic with complex rulesets. In fact, modern switches with vlans - are the same filtering bridges with the same logic inside.

Bridged promiscuous interfaces don't brodcast their MAC/IP over ARP so host become "stealth-host", invisible, insensible and inaccessible, manageable exclusively via console.

2

Not the answer you're looking for? Browse other questions tagged .