Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an OpenVPN client set up on my DD-WRT home router which maintains a VPN into my workplace.

Slight problem: I don't want random lusers who access my wireless AP to have access to my company's VPN. (yes, it's secured acceptably well, but I have reason to take further steps.)

Can iptables be convinced to deny routing to all source MAC addresses except a select few which I specify? I tried using the --mac-source parameter as follows:

iptables -I FORWARD -i br0 -o tap0 -j REJECT
iptables -I FORWARD -i br0 -o tap0 -j ACCEPT --mac-source 00:01:02:03:04:05

The REJECT rule works, but the ACCEPT rule does not. (note that the -I parameter is being used to ensure that the ACCEPT rule comes before the REJECT rule.)

Has anyone else had experience setting up a whitelist like this?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.