iptables restrict ssh session by mac address

Question

I'm in the process of restricting access to my Linux production box, where ssh access needs to be limited to only a few MAC addresses.

I've followed the instructions outlined in this guide and ran the following two commands:

/sbin/iptables -A INPUT -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP
/sbin/iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT

---

root@xxxx:~/#: iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            MAC XX:XX:XX:XX:XX:XX
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh MAC XX:XX:XX:XX:XX:XX

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

---

However I am still able to access the machine from other MAC addresses. Am I missing any steps to get this configured?

Answer 1

I see the problem from your output result:

Chain INPUT (policy ACCEPT)

Your system iptables default INPUT chain rule policy is ACCEPT, it does affect your inputed MAC only. So please change its default policy to DROP.

#iptables -P INPUT DROP

Now you can test again. Your computer can be accessed through allowed MAC only.

Answer 2

As commented above I think you are probably going about this the wrong way; MAC addresses can be spoofed and may even be duplicated in large networks.

If you want to limit ssh access to a few machines then restricting by IP address would be your best bet. Are these machines on a local network or global?

Note however that even blocking by IP may be a misguided approach:

• It will restrict you if you need to access from another machine at some point.

• ssh should be using an authentication method secure enough to keep unauthorised users out, wherever they are coming from.

My approach would be to:

• [Definitely] Rate limit ssh connection attempts using iptables or a package like fail2ban
• [Definitely] Only allow key based auth for shh
• [Probably] Allow only networks that that wish to access from within iptables

Answer 3

I think to do what you're asking what you actually want is ebtables.

But I think that's a bad idea (for reasons already mentioned). Better to generate ssh keys, and configure your server to only allow key based login (i.e., disable password authentication). You'll be much more secure that way.