iptables
works at the OSI layer 3, so it knows nothing whatsoever about MAC addresses.
In fact, it does have a mac module, which however contains only the further filter --mac-source
: this is because ethernet packets coming in do carry the MAC address of their source. However, such a MAC address does not exist for packets coming thru wifi, and it is not relevant to outgoing packets. The reference above states:
Note that this only makes sense for packets coming from an Ethernet device and entering the PREROUTING, FORWARD or INPUT chains.
As for ebtables
, first of all it can be used only with Ethernet frames, because wifi frames miss one MAC addrees. Second, MAC source addresses, as I said above, do not exist in IP packets.
If you wanted to control ARP packets, you would find out quickly that there is an instruction
arp-mac-dst [!] address[/mask]
The (R)ARP MAC destination address specification
but, once again, this is becausethe ARP protocol does use MAC addresses, unlike the IP protocol.