2

I have an interface on a remote host:

2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:05:68:02:68:dd brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.1/24 brd 192.168.3.255 scope global eth0

and on my local machine I have:

2: eth6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:13:3b:0f:24:fc brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.150/24 brd 192.168.3.255 scope global eth6
       valid_lft forever preferred_lft forever
    inet6 fe80::213:3bff:fe0f:24fc/64 scope link 
       valid_lft forever preferred_lft forever

And do:

ebtables -A OUTPUT -d 00:05:68:02:68:dd -j DROP

So I get:

Bridge chain: OUTPUT, entries: 1, policy: ACCEPT
-d 0:5:68:2:68:dd -j DROP

I do the above in order to block all communication to mac address (on remote interface) 00:05:68:02:68:dd

However I can still ping my remote interface using 192.168.3.1. Why? Do I have to enable eptables somehow or something?

  • Are they on the same IP range? – jcbermu May 18 '15 at 13:28
  • See updated answer – JohnyTex May 18 '15 at 13:31
3

Ebtables acts only on frames going through a bridge interface.

If you want to block a site based on its MAC address, make a bridge and add your interface to it. Then route traffic via the bridge and use ebtables to prevent traffic out from the bridge to that mac-address, as such:

ebtables -A OUTPUT -d 00:05:68:02:68:dd -j DROP

It works.

| improve this answer | |
  • Thanks for your input. The first part I agree with, however not the second part. As I understand it the next time you would like to send a message to a mac address, the IP address would use the ARP cache to find out the mac address associated with that IP. The IP protocol doesn't stop using mac addresses only because it has once found them out. I mean its IP over Ethernet, and ethernet uses mac addresses to send messages, right? So you would still always need a mac address whenever you'd wish to send an IP message. – JohnyTex May 19 '15 at 9:55
  • See for complete packet: laneye.com/network/… – JohnyTex May 19 '15 at 10:03
  • Comments above for previous version of answer. – JohnyTex May 19 '15 at 12:33
  • However the mac source would always be myself, no? There seems to be no --mac-destination option. – JohnyTex May 19 '15 at 12:38
  • 1
    @JohnyTex If you really want to block OUTPUT (why??) , then set up a bridge between your ethernet card and a virtual NIC, then go back to using ebtables on the bridge. – MariusMatutiae May 19 '15 at 13:20
0

Could it be that ebtables is only for bridges, and not just any Ethernet interface?

ebtables - Ethernet bridge frame table administration

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.