Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup a simple isolated network consist of following Linux based machines (simplified example): Node1<---->Router<---->Node2 Router's eth0 is connected with Node1's eth0. Router's eth1 is connected with Node2's eth0.

I would like to limit the traffic rate between Node1 and Node2 based on their MAC addresses, say for example, to 150 KBps. I read the man page for iptables and I do see the "--limit" option but cant' find a way to specify the source and destination MAC address in conjunction with the the traffic limit rule.

In plain English, the rule would be "Limit all the traffic between MAC_Address_1 (for Node1) and MAC_Address_2 (for Node2) to a max. rate of 150 KBps".

Can this be done using iptables?

share|improve this question

No, it can't be done using iptables. The answer is in the name of the command and what you're trying to do.

In the OSI model, MAC addresses belong to the data link layer. This means that protocols such as IEEE 802.3 (Ethernet) have a concept of MAC addresses, but protocols such as IPv4 don't. Data link layer protocols can be thought of as transmitting "frames".

Note that iptables contains "IP", which means Internet Protocol. This is a protocol at the Network layer, which is a higher layer than the data link layer. Network layer protocols can be thought of as transmitting "packets".

Since the protocols are built on top of one another like a stack, it is only possible for lower level protocols to directly affect the behavior of higher level protocols, not the other way around. So, it is not possible for a tool which operates on the IP layer to directly affect the behavior of a hardware device operating on, say, the Ethernet (802.3) layer.

If you know about HTTP, you can think of it this way. How would you answer if someone asked you, "How can I send arbitrary data over TCP port 6790 by just using HTTP?" The answer is that you can't -- for one, the TCP port is already decided by the time the HTTP protocol is in play. Second, the HTTP protocol has mandatory headers and structural elements that can't be removed without violating the standard. So as soon as you say "HTTP" you're talking about operating within an existing TCP socket on a pre-determined port and you're stuck adhering to the protocol rules of HTTP.

The same is true of IP. Once you're dealing with logical addresses in the IP stack, you can't "reach down" into the physical layers and do low-level stuff. As a simple explanation why, it's possible for a device to have a valid IPv4 address, but to operate using a data link layer that does not use MAC addresses at all. For example, a USB protocol could be designed to transmit IP packets, but it would have no concept of "Ethernet" or "frames", so it wouldn't have a MAC address or implement the IEEE 802.3 standard.

What you need is ebtables. ebtables will allow you to perform similar processing at the ethernet frame layer. You will need to be certain that all the devices you want to firewall have a direct ethernet connection to the computer that is doing the firewalling, otherwise this won't work. And if any of your devices don't use ethernet at all, you're out of luck.

share|improve this answer
Thanks for the detailed reply. If iptables cannot operate on data belonging to Layer 2 then how come the rule like "iptables -I FORWARD 1 -i eth1 -m mac --mac-source xx:xx:xx:xx:xx:xx -j DROP" works in my above isolated network. In other words why is there a --mac-source option at all if iptables can only act at and above Layer 3. May be I am missing here something? – modest Oct 17 '12 at 19:07
That's actually a really good question, but I suspect it has something to do with the Address Resolution Protocol translating between physical addresses and logical addresses (MAC and IP, respectively) in a similar fashion to DNS translating between IP addresses and hostnames. Still, the ability to observe some of the inner workings of the data link layer by chance, doesn't automatically entitle the IP layer to be able to modify the data link layer as you want to do -- at least, not without a layering violation. – allquixotic Oct 17 '12 at 19:23
Regarding your comment about ebtables "direct ethernet connection" requirement, suppose if Node1 and Router are connected via Switch1 and Node2 and Router are connected via Switch2, does that mean I will not be able to use ebtables? – modest Oct 17 '12 at 20:54
Depends on what kind of switch it is. A layer 2 switch (a "hub" in common parlance) will allow you to operate at the ethernet frame level to all the other boxes, as if you had it directly plugged into your computer. A layer 3 switch (an "IP" switch) actually routes IP datagrams through a logical network, not ethernet frames. – allquixotic Oct 17 '12 at 21:36
I was talking a standard Layer 2 switch. Thanks for the clarification. I perhaps will start another thread regarding the iptables partial capability of acting on MAC addresses. It really intrigues me. – modest Oct 17 '12 at 21:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.