1

I posted this over on stackoverflow but it was off-topic.

I have looked around and couldn't find the answer to my question. I am using a raspberry pi as an internet gateway between my LAN and two WANs. Here is an example of my FORWARD chain in iptables.

Chain FORWARD (policy ACCEPT 541 packets, 164K bytes)
pkts bytes target     prot opt in     out     source               destination
0     0 wifi.usb   all  --  *      *       0.0.0.0/0            0.0.0.0/0            MAC 00:11:22:33:44:55
0     0 other.dev  all  --  *      *       0.0.0.0/0            0.0.0.0/0            MAC 66:77:88:99:aa:bb
0     0 Local      all  --  *      *       0.0.0.0/0            0.0.0.0/0

These devices jump to their own chains for byte counting and ACCEPT. The jump to Local suppose to catch any packets not from the above devices and REJECT WAN but allow LAN.

Chain Local (0 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       192.168.100.0/24       192.168.100.0/24
67  698 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

All the user chains for devices jump to ACCEPT.

Chain wifi.usb (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

However, with the jump to Local rule in FORWARD all internet traffic enters Local chain and is REJECTED. How can I still use the Local chain to catch unknown devices without catching the known ones?

Edit: One thing I did forget to mention is when I filter by soure IP address it works like I want, but I perfer to filter by MAC address.

0

I found out what the problem was. And it answered 2 problems I had.

I am using this to count the bytes a user uses and then forward it to its destination. The problem was the usage was not adding up along with the question above.

I had forgotten to include a rule for downloads for each rule for uploads. Adding these rules,

277K  330M wifi.usb   all  --  *   *   0.0.0.0/0       192.168.100.3
144K   20M wifi.usb   all  --  *   *   192.168.100.3   0.0.0.0/0       MAC 00:11:22:33:44:55
   0     0 Local      all  --  *   *   0.0.0.0/0       0.0.0.0/0

So, I still had to use IP address being that I cannot use iptables to specify a destination MAC address. But with fix I can still make sure that the IP address matches the MAC address.

If anyone has questions about this I can try to explain more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.