I'm running ISC DHCP deamon on centOS and want to block unwanted(by clients MAC address) discovery messages before they reach dhcpd.
how can I do this with iptables or anything else?
1
-
2If you've got "unwanted clients" on your network I'd recommend blocking them on your infrastructure (switches) and/or remove them physically. Disabling their DHCP doesn't prevent them from using a static address.– Zac67Jul 10, 2023 at 10:47
Add a comment
|
1 Answer
The Linux netfilter firewall has the ability to match on MAC address and then simply filter the DHCP protocol (UDP port 67,68) messages:
/sbin/iptables -I INPUT -m mac --mac-source 00:11:22:33:44:55 -p udp --sport 67:68 --dport 67:68 -j DROP
Although a better alternative is probably to configure your DHCP server to ignore requests from certain MAC addresses as described in this Q&A
-
-
I think the required form is
xx:xx:xx:xx:xx:xxbut I don't know ifxx:xx:xx:*:*:*works. Why don't you go and test that?– HBruijnOct 20, 2017 at 14:56 -
still getting discovery messages after adding following rule : sbin/iptables -I INPUT -m mac --mac-source 00:11:22:33:44:55 -j DROP– mishaOct 23, 2017 at 12:13
-
You did replace the sample MAC address with the actual MAC you're trying to block, right?– HBruijnOct 23, 2017 at 12:19
-
yes I did.I found that all the requests are from same mac addr(GW dhcp server is using) so, inspecting just layer 2 mac will not help. it needs to inspect dhcp message headers.– mishaOct 23, 2017 at 12:27