MAC based filtering on LAN

[n007]

Hi,

What is the best way of doing mac based filtering on the LAN ports? This is more specifically to create an "allow list" of MAC Addresses to control access between LAN ports and the WAN port as the traffic has to go through the router. (no wireless is involved)

While it's easy to change MAC address on a client, it wouldn't work if there's an explicit "allow list".

Can it be done using ip tables or is there a better way?

[shiro]

you could try something like this.

# /etc/firewall.user
mac_filter() {

  iptables -A forwarding_lan_rule -m mac --mac-source aa:bb:cc:dd:ee:ff -d 11.22.33.44 -j ACCEPT -m comment --comment "user_a"
  # or
  iptables -A forwarding_lan_rule -m mac --mac-source 11:22:33:44:55:66 -m limit --limit 5/s -j ACCEPT -m comment --comment "client_b"

  # --block-all
  iptables -A forwarding_lan_rule -j DROP -m comment --comment "last"
}
mac_filter

[trendy]

@n007

While it's easy to change MAC address on a client, it wouldn't work if there's an explicit "allow list".

It's rather easy to sniff the mac addresses that exist in the network and spoof them. If the switch doesn't support some port-security features, you are basically vulnerable to any malicious user.

[n007]

Makes sense, thanks for pointing out.