I need to block certain hosts (multi-OS) on our LAN from gaining internet access. I decided to try and block certain hosts by mac address via iptables but I can't use the mac address of the workstation as it traverses an L3 switch and the frame gets rebuilt with the switch's interface mac. I've confirmed this using wireshark's tshark utility.

I know that I can block by IP address but I can't control if a user were to change his/her IP and thus the block would be circumvented. I'm thinking a solution could be achieved with a script that does the following:

  1. Update the arp table using fping: fping -c 1 -g
  2. Grep the arp table to get IP from a list of mac addresses, say in a file: arp -n | grep "00:11:22:aa:bb:cc" | awk '{print $1}'
  3. Build a hash or array and dynamically update iptables with the IP addresses that need to be block. I would probably use a file and do something like iptables-restore < ips_to_deny.
  4. Run this script say every 5 mins or so. (Not to sure about timing)

So... the question. Does you see any flaws in this method? Or ways to make it better?

  • Mac spoofing comes to mind but host users don't have admin access.

I'd use either perl or ruby for the script if that matters much.


I had to deal with a similar situation when organizing large LAN parties (>500 users), where you don't have control over the workstations, pretty interesting.

if your L3 switch (router, technically) is reasonably high grade, it is probably manageable by SNMP, and you can read its ARP table for the appropriate subnet (the one that directly connects to the stations), to retrieve the effective mac/ip mappings.

However, if you are afraid about the machine changing IPs without your consent, you should probably also worry about the machine changing MAC. If you trust the machine not to change MACs, another option we were using was to parse the logs of the DHCP server. As a bonus, you can also correlate the DHCP logs and ARP tables to detect spoofers.

If your switches support it, you can also use 802.1x authentication. In this mode, a machine must authenticate to the switch over Radius before it starts actually switching packets, and for every authentication, the Radius server receives the identity, physical location, and MAC of the station.

  • Yes I could get arp table via snmp from the switch (Dell S4810) but would that be much different from the proposed solution above? Considered 802.1x but it would be overkill and I would only want to authenticate internet access and not ability to switch frames. Well EAPOL is on network layer I think so packets. Plus we'd have to configure each supplicant. – Dru May 15 '15 at 22:35
  • Yes, i'm only sharing my personal experiences in that direction, as they might have been of interest. The key point is that if you are behind one or several routers, your local ARP table will contain the router's mac for your station's ip addresses, just like you saw in tshark. You have to hit the remote ARP table of the router, to see the actual MACs. – b0fh May 15 '15 at 22:39
  • Yes of course and thanks for sharing. Actually I can get the correct mac/ip pair from the arp table on the server. – Dru May 15 '15 at 23:37

That all seems overly complicated to me and subject to becoming one of those "customized" solutions that tend to become a problem in the future (i.e. "so-and-so set this up long ago before leaving the company and no one knows how to change it"). So, I personally would look at something that is a bit more standards based.

Unless you have a need for devices with Internet access and without Internet access to be on the same L2 network segment, I would implement 802.1X mac authentication bypass (MAB). You can do this so that authenticated devices are given one VLAN and devices that fail to authenticate are placed in a second VLAN.

If your switches do not support MAB only (i.e. MAB only takes effect once the IEEE 802.1X authentication fails), you can reduce the retry and timeout values for the IEEE authentication to their minimum values. Since you don't care about the IEEE authentication and it will fail quickly, you would not be required to configure any sort of supplicant unless you chose to do so.

To be more secure, you would configure the MAC addresses for all the devices that should have Internet access allowing only those devices to authenticate and get put into the VLAN that provides Internet access. However, if you only care to restrict certain devices (and let new devices automatically connect to the Internet), you could configure it so that failed authentications get put in the VLAN with Internet access while successful authentications get placed in the VLAN without access.

You don't give the reasons behind why you want to do this, but this would also provide the opportunity to easily restrict access between the two sets of hosts as well if there was any reason to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.