Welcome back.
If you want to make space based on a source Mac address, use the minus Mac match option.
Note that you can filter Ethernet or wireless traffic only by source Mac address and not by destination
Mac address.
This mix could be very useful sometimes.
Imagine you have a server in your local network and want to allow only a list of trusted machines to
access the services that are running on the server.
Or you have one network out there that are running Linux and want only the corporate devices to access
the Internet.
Or in other words, you don't allow devices that are not yours or trusted in your network.
Keep in mind that Mac addresses are only valid inside the local area network.
The first router towards destination will change the source Mac address of the packet with its own Mac
address, the Mac address of its outgoing interface.
Also, note that you cannot impose a strong security policy based on a Mac addresses because Mac addresses
can be spoofed easily.
When we want to make Becket's by sauce Mac address, we use minus M Mac match.
In this example, we are dropping any incoming packets, it's the input chain that are coming on double
YULAN zero interface and have that given sauce Mac address.
Let's see two more use cases, the first task is to drop incoming packets that are coming with a specified
Mac address and to the second task is to configure the network out there, which, of course, is running
Linux to permit the access to the Internet only to a list of trusted devices or a Mac addresses.
Let's do the first task.
I'll drop all incoming traffic to Linux one if the source Mac address is the of Linux to.
Mack belongs to Latu, so if you are dropping by Mac address, you are dropping all protocols like IP,
ICMP, Tsipi, UDP and so on.
First, I want to test whether the connection between Linux too and Linux one is up.
Perfect Binky's porking.
Let's see what is the Mac address of Linux to.
This is the Mac address, and I'll copy it to the clipboard.
And only to I'll write the VIP table, single IP tables, minus a both incoming traffic, minus Mac
minus minus MC minus source and I'll paste the Mac address.
Minus A.J. drop.
Let's bring this host again.
We notice that pink is not working anymore.
I am stopping the Pink comment back on Linux, one at to the viral.
And we see a lot of mixed and dropped packages, all packages that have this source Mac address will
be dropped.
Let's move on and to do the second task, I'm going to create the script and the writer there, all
the necessary IP tables is.
As in all other examples at the beginning of the script, I am flashing the Ferragut chain.
Because there could be tens of Mac addresses that I must permit, I'll define a new variable and store
those Mac addresses that variable.
So this is the name of my new variable palmitate, Max.
Equals.
And a list of Mac addresses separated by comma.
The first Mac address, the second Mac address, the third and so on.
I'll exchange something at each Mac address to have different addresses.
It's good practice to write a variable in uppercase letters don't use spaces on the left and the right
side of the equals sign and use the white space between addresses.
Now, using a for loop, I'll iterate over the list of Mac addresses and to run an IP table for each
Mac embellished.
So for Mac, this is a temporary variable in dialer permitted Macs.
Do and done between two and done we have the four block of code, so IP table is minus a forward, remember
that we are out there minus EMAC, minus minus make minus source $ MC minus J accept.
And I'll print out a message to know what the script is doing.
Echo thalamic permitted.
And finally, I'll set the policy to drop on the Forbath chain, so all other packages that are not
accepted will be dropped.
Hyperboles minus B forward drop.
Perfect.
I am saving the Firehole.
Then I'll make it executable and run it.
We see how these four Mac addresses have been permitted.
Only the packets from devices with those Mac addresses can access the Internet.
This kind of script is useful also for a local server, if you want a server to be accessed only by
a list of trusted hosts, you just replace the machine by the input chain.
When you want to add or to remove a Mac address from the list, you simply remove that address from
the list, save the script and run it again.
I have removed two addresses.
Sorry, I have noticed a small error here is the chain, not input.
OK, I am saving the script and then run it again now, only these two Mac addresses are permitted.
You see that it's very easy to add or to remove Mac addresses from the list.