Home network to accept only certain MAC addresses from LAN

Question

I have Ubuntu 10 as router with WAN(eth0) and LAN(eth1). How can I restric eth1 to accept only packets from certain MAC addresses and drop the rest? I am also about to setup DHCP to certain MAC addresses, however, anyone can manually set IP address. I have like 4-6 my own devices which can use the network.

Answer 1

As I mentioned in the comments, I don't think this buys you any real security, or even any more security than blocking based on IP, but something like this should do it:

/sbin/iptables -A INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT

Assuming, of course, that your default policy is DROP.

Answer 2

( I am user63709; somehow my Google OpenID login and MyOpenID login got split, when it's actually the same in Stack Overflow)

arptables has its own policy. Do not confuse it with iptables's policy.

Since you want to "restric [sic] eth1 to accept only packets from certain MAC addresses and drop the rest", you will want a default DROP policy.

(BTW, I made a slight mistake in the arptables rules above. They should be:)

arptables -P IN DROP
arptables -A IN -i eth1 --source-hw <allowed_mac_address> -j ACCEPT
arptables -A IN -i eth1 --source-hw <allowed_mac_address> -j ACCEPT
... and so on ...

(Note again, that IN is a built-in chain specifically found only in arptables. Read arptables' man page for more information).

Answer 3

Here is a start for you:

iptables -P FORWARD DROP
iptables -I FORWARD -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT
iptables -I FORWARD -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:BB -j ACCEPT
iptables -P INPUT DROP
iptables -I INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT
iptables -I INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:BB -j ACCEPT

All mac addresses other than XX:XX:XX:XX:XX:XX and XX:XX:XX:XX:XX:BB will not be able to access your router or the internet.

Answer 4

You might be interested in arptables.

It's kind of iptables, but specifically for layer 2. Although it can also 'peek' into some L3 information.

arptables -P IN DROP
arptables -A IN --source-hw <allowed_mac_address> -j ACCEPT
arptables -A IN --source-hw <allowed_mac_address> -j ACCEPT
... and so on ...

Whenever there's a new MAC Address you want to allow, just do arptables -A IN --source-hw <address> -j ACCEPT. The DROP policy ensures other addresses will be, uh, dropped.

Answer 5

Michael, you can not specify more than one mac source per rule so you will need a set of rules like the following (if you are going to use iptables)

#Rules for allowing your mac addresses
/sbin/iptables -A FORWARD -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:11 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:22 -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:33 -j ACCEPT
#One final rule to drop all packets which do not match one of the rules above (are not from one of your allowed macs)
/sbin/iptables -A FORWARD -i eth1 -j DROP

Note that these are in the FORWARD chain and not the INPUT chain. By having these rules in the FORWARD chain your linux router will not let any mac except your allowed ones to send or receive any traffic through the router. They will still be able to communicate with machines on the same subnet as their own (because that doesn't require them to pass through the router).

You can also control who can connect to your router by duplicating the above rules for the input chain.

#Rules for allowing your mac addresses
/sbin/iptables -A INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:11 -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:22 -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:33 -j ACCEPT
#One final rule to drop all packets which do not match one of the rules above (are not from one of your allowed macs)
/sbin/iptables -A INPUT -i eth1 -j DROP

Reading your comment on one of the other shorter answers about which cases FORWARD and INPUT work with, here is a short explanation.

FORWARD only applies to packets going through your router to other subnets or to the outside world (through the WAN) interface. INPUT applies to packets which are destined to terminate on the router itself (eg. SSH connections to the router/linux box itself).