Re: [gentoo-user] OT: iptables mac filtering

[Hans-Werner Hilse <hilse@web.de>]

Hi,

On Wed, 9 Aug 2006 18:54:45 +0000 (UTC)
James <wireless@tampabay.rr.com> wrote:

> Where  the mac address xx...xx is the system allowed in, via ssh
> and the ip.address is that of the destination (/24 based) host
> The rule works well  when packets have to traverse
> a firewall/router as mac addresses do not get propagated (I think).

No, of course not. The incoming packet will have the MAC of the router
instead. Only ethernet frames carry a MAC, so there's no MAC in IP
tunnels, too.

> However, when I use  similar syntax to prevent a system on the same
> local (ethernet) segment from being able to ssh into a local system, 
> it does prevent ssh access, as expected. Granted MAC addresses
> can be foiled, especially on the same segment, but how do I make this
> rule work?: On a local segemnt how would I modify the syntax so 
> that only a select machine (maybe IP + MAC) could access a host,
> running iptables, via ssh?

Hm, by adding "-s <source IP>"? And of course, you need to change
INPUT's policy to REJECT or DROP, using iptables -P INPUT DROP. Note
that you probably want some rules allowing traffic local on that
machine, so also allow packets coming from "lo".

But you already mentioned it: There's not much point in blocking access
this way since MAC addresses can as well be spoofed as IP addresses.
Are you suffering from DOS attacks on your SSH server?

-hwh
-- 
gentoo-user@gentoo.org mailing list