Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN client set up on my DD-WRT home router which maintains a VPN into my workplace.

Slight problem: I don't want random lusers who access my wireless AP to have access to my company's VPN. (yes, it's secured acceptably well, but I have reason to take further steps.)

Can iptables be convinced to deny routing to all source MAC addresses except a select few which I specify? I tried using the --mac-source parameter as follows:

iptables -I FORWARD -i br0 -o tap0 -j REJECT
iptables -I FORWARD -i br0 -o tap0 -j ACCEPT --mac-source 00:01:02:03:04:05

The REJECT rule works, but the ACCEPT rule does not. (note that the -I parameter is being used to ensure that the ACCEPT rule comes before the REJECT rule.)

Has anyone else had experience setting up a whitelist like this?

share|improve this question

As I understand it, your issue here is that MAC addresses are only a valid option for the PREROUTING and POSTROUTING tables. I did this in the following clunky fashion...

  1. In prerouting table on the incoming interface from the LAN, select the MAC address of the machine you want to let through, and use DNAT to alter the IP address to one of your choosing which would not otherwise be in use.

    -A PREROUTING -i eth1 -m mac --mac-source xx:xx:xx:xx:xx:xx -j DNAT -- to -m comment --comment "machine to be allowed"

  2. In the FORWARD table, set a rule to accept that IP, with a policy for FORWARD otherwise to drop all traffic.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.