Mark packets with iptables by destination mac address

Question

I need to mark packets which goes to a specified mac address.

I need this to use in shaper with tc.

--mac-destination doesn't exist in iptables.

Also I tried to use ebtables:

ebtables -t nat -A POSTROUTING -d 9c:4e:36:aa:bb:cc -j mark --set-mark 0x2003 --mark-target ACCEPT

but it doesn't mark anything (at least ebtables -t nat -L --Lc shows me 0 counters)

Please help! Thank you so much!

Answer 1

The trick is to combine iptables --mac-source with CONNMARK:

• First use --mac-source to match packets coming from the mac address you're interested in. It's the wrong direction since you're interested in packets going to this mac address, but now you can
• use CONNMARK to mark the whole connection, ie both directions (!) and
• set the mark from the connection mark with --restore-mark

# lan interface
if_lan=eth0

# create 'mark_mac' table for marking connections:
iptables -t mangle -N mark_mac
iptables -t mangle -A mark_mac -j MARK --set-mark 1234
iptables -t mangle -A mark_mac -j CONNMARK --save-mark

# mark connections involving mac address:
iptables -t mangle -A PREROUTING -i $if_lan -m state --state NEW -m mac --mac-source 9c:4e:36:aa:bb:cc -j mark_mac

# mark packets going to mac:
iptables -t mangle -A POSTROUTING -o $if_lan -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark

Initially i thought this would only work for tcp connections originating from the lan, but given the definition of --state NEW it should work in both directions for both tcp and udp (!)

See also Policy Routing on Linux based on Sender MAC Address which was the inspiration for this answer.

Answer 2

iptablesworks at the OSI layer 3, so it knows nothing whatsoever about MAC addresses.

In fact, it does have a mac module, which however contains only the further filter --mac-source: this is because ethernet packets coming in do carry the MAC address of their source. However, such a MAC address does not exist for packets coming thru wifi, and it is not relevant to outgoing packets. The reference above states:

Note that this only makes sense for packets coming from an Ethernet device and entering the PREROUTING, FORWARD or INPUT chains.

As for ebtables, first of all it can be used only with Ethernet frames, because wifi frames miss one MAC addrees. Second, MAC source addresses, as I said above, do not exist in IP packets.

If you wanted to control ARP packets, you would find out quickly that there is an instruction

arp-mac-dst [!] address[/mask]

The (R)ARP MAC destination address specification

but, once again, this is becausethe ARP protocol does use MAC addresses, unlike the IP protocol.