Rate limiting traffic between specific hosts (based on their MAC) using iptables

Question

I have setup a simple isolated network consist of following Linux based machines (simplified example): Node1<---->Router<---->Node2 Router's eth0 is connected with Node1's eth0. Router's eth1 is connected with Node2's eth0.

I would like to limit the traffic rate between Node1 and Node2 based on their MAC addresses, say for example, to 150 KBps. I read the man page for iptables and I do see the "--limit" option but cant' find a way to specify the source and destination MAC address in conjunction with the the traffic limit rule.

In plain English, the rule would be "Limit all the traffic between MAC_Address_1 (for Node1) and MAC_Address_2 (for Node2) to a max. rate of 150 KBps".

Can this be done using iptables?

Answer 1

No, it can't be done using iptables. The answer is in the name of the command and what you're trying to do.

In the OSI model, MAC addresses belong to the data link layer. This means that protocols such as IEEE 802.3 (Ethernet) have a concept of MAC addresses, but protocols such as IPv4 don't. Data link layer protocols can be thought of as transmitting "frames".

Note that iptables contains "IP", which means Internet Protocol. This is a protocol at the Network layer, which is a higher layer than the data link layer. Network layer protocols can be thought of as transmitting "packets".

Since the protocols are built on top of one another like a stack, it is only possible for lower level protocols to directly affect the behavior of higher level protocols, not the other way around. So, it is not possible for a tool which operates on the IP layer to directly affect the behavior of a hardware device operating on, say, the Ethernet (802.3) layer.

If you know about HTTP, you can think of it this way. How would you answer if someone asked you, "How can I send arbitrary data over TCP port 6790 by just using HTTP?" The answer is that you can't -- for one, the TCP port is already decided by the time the HTTP protocol is in play. Second, the HTTP protocol has mandatory headers and structural elements that can't be removed without violating the standard. So as soon as you say "HTTP" you're talking about operating within an existing TCP socket on a pre-determined port and you're stuck adhering to the protocol rules of HTTP.

The same is true of IP. Once you're dealing with logical addresses in the IP stack, you can't "reach down" into the physical layers and do low-level stuff. As a simple explanation why, it's possible for a device to have a valid IPv4 address, but to operate using a data link layer that does not use MAC addresses at all. For example, a USB protocol could be designed to transmit IP packets, but it would have no concept of "Ethernet" or "frames", so it wouldn't have a MAC address or implement the IEEE 802.3 standard.

What you need is ebtables. ebtables will allow you to perform similar processing at the ethernet frame layer. You will need to be certain that all the devices you want to firewall have a direct ethernet connection to the computer that is doing the firewalling, otherwise this won't work. And if any of your devices don't use ethernet at all, you're out of luck.

Answer 2

It is possible to do it with iptables:

iptables can match based on source mac address with --mac-source so that's half of the problem solved. The other half is more tricky because destination mac address is not available to iptables. We can work around it with connection tracking though.

I'd suggest starting with something simpler like this question where there's only one mac address, then we can deal with two.

First, create tc classes for rate limiting:

rate=$[150*8]
for if in eth0 eth1 ; do
  tc qdisc add dev $if root handle 1: htb
  tc class add dev $if parent 1: classid 1:1 htb rate ${rate}kbit ceil ${rate}kbit prio 2
  tc qdisc add dev $if parent 1:1 handle 1: sfq perturb 10
done

Mark connections from each mac address with a specific bit:

mac1=11:22:33:44:55:66
mac2=12:34:56:78:9a:bc
iptables -t mangle -A PREROUTING -m state --state NEW -m mac --mac-source $mac1 -j CONNMARK --or-mark 0x1
iptables -t mangle -A PREROUTING -m state --state NEW -m mac --mac-source $mac2 -j CONNMARK --or-mark 0x2

If both bits are set we know this is mac1 <-> mac2, classify packet for rate limiting:

iptables -t mangle -A POSTROUTING -m state --state ESTABLISHED,RELATED -m connmark --mark 0x3 -j CLASSIFY 1:1