I have added some rules to my PREROUTING chain in NAT. Usually at the beginning of a new machine joining the network, these matches don't always match correctly?

Im using iptables v1.4.21 on OpenWRT Barrier Breaker This is on a linux bridge where ebtables is sending packets through iptables


In it's simplest form

    -A PREROUTING -m mac --mac-source <my mac> -j ACCEPT
    -A PREROUTING -m limit --limit 1/min -j LOG --log-prefix "id=Unknown-Device " --log-level 5

But I get log messages showing that it didn't match. The mac addresses are definitely correct

id=Unknown-Device IN=br-lan OUT= PHYSIN=wlan0 MAC=<dst>:<src>:08:00 SRC= DST= LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=1 DF PROTO=TCP SPT=23058 DPT=80 WINDOW=8688 RES=0x00 SYN URGP=0

migrated from stackoverflow.com May 17 '16 at 11:38

This question came from our site for professional and enthusiast programmers.

  • Is the client with <my-mac> connected via Ethernet or WIFI ? – Sanael May 18 '16 at 12:12
  • It can occur on both. WAN is bridged with WLAN0 and LAN – Adam Mills May 19 '16 at 0:09
  • Have you checked the case of the MAC address? Simple but might help! – shearn89 May 19 '16 at 9:33

If I correctly understand you, your setup is working, and sometimes, when a new machine is connecting, some logs shows up. You are tring to understand why. Is that true?

I have several ideas about your issues, although I can't provide an answer yet.

First, I want to be sure there are some "good" connections. To confirm this, you could disable the 1 packet per minute limitation in the log rule, and add another log rule before the accept one :

-A PREROUTING -m mac --mac-source <my mac> -j LOG --log-prefix "id=Well-known-Device " --log-level 5
-A PREROUTING -m mac --mac-source <my mac> -j ACCEPT
-A PREROUTING -j LOG --log-prefix "id=Unknown-Device " --log-level 5

In order to dismiss some hypothesis, can you confirm that:

  1. you are not using DNAT in the nat table (it looks like you aren't)
  2. packets are going through FORWARD chain (it looks like they are)
  3. it occurs over ethernet (it looks like it does)
  • 1. In the real rules I am using DNAT, instead of jumping to accept I jump to a chain that may DNAT certain requests to the bridges IP. But this is only if the MAC matches. – Adam Mills May 24 '16 at 1:11
  • 2. Correct. Almost all packets correctly match the MAC filters and proceed as expected. – Adam Mills May 24 '16 at 1:12
  • 3. Yes, it occurs over wireless and ethernet interfaces – Adam Mills May 24 '16 at 1:12
  • Damn, I'm not sure I still can help then. In your custom chain (the one into you jump from prerouting), have you some -j RETURN? Do you end the chain with a global -j ACCEPT? – Sanael May 24 '16 at 14:47
  • The custom chain either ends on a -J ACCEPT or a DNAT (i dont need a return for either I didn't think) – Adam Mills May 25 '16 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.