allowing connection

Hi,
Right now I am allowing only my client's LAN access one of my design's machine from the internet. Their LAN is a simple network, with a single IP and other machines are masqueraded. Now I want to allow only one of their machine to access my machine. Can I do it? I mean the machine is on 192.168.1.x series of IP, but can I restrict it on mac address basis? If yes, how do I do it?

With warm regards,
-Payal

Hi Payal,

You can use the MAC match to restrict access.

Something like this:

iptables -t mangle -A PREROUTING -s (Masqueraded_IP) -m mac --mac-source (MAC_ADDR_MACHINE) -j ACCEPT

Please follow the link below and read 6.4.3.2 for further understanding:

http://iptables-tutorial.frozentux.net/chunkyhtml/matches.html#GENERICMATCHE
S

Hope this helps!

Regards,

Deepak Seshadri

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Payal Rathod
Sent: Friday, September 10, 2004 2:18 PM
To: Netfilter ML
Subject: allowing connection

Hi,
Right now I am allowing only my client's LAN access one of my design's machine from the internet. Their LAN is a simple network, with a single IP and other machines are masqueraded. Now I want to allow only one of their machine to access my machine. Can I do it? I mean the machine is on 192.168.1.x series of IP, but can I restrict it on mac address basis? If yes, how do I do it?

With warm regards,
-Payal

so essentially:

+------------+  +----------------+
| CLIENT LAN |--| CLIENT MACHINE |
+------------+  +----------------+
      |
+-----------+
| CLIENT FW |
+-----------+
      |
      |
+----------+
| INTERNET |
+----------+
      |
      |
+---------+
| YOUR FW |
+---------+
      |
+---------+  +----------------+
|YOUR LAN |--| DESIGN MACHINE |
+---------+  +----------------+

Right you allow whatever IP all of "Client LAN" is MASQ'ed behind to access "Design Machine."

To answer the question, can you filter by MAC address--the answer is a resounding, "no!" The MAC address of "Client Machine" is stripped off by "Client FW" never to be seen again by any network device.

The only MAC address that you'll see on the external interface of "Your FW" is that of your Internet router.

My suggestion: protect the resource in question with a username/password or certificate or whatever authentication suits you. Only give the one person who needs access credentials to get in. Keep the filtering policy as-is.

-j

Jason Opperisano <[email protected]>

If you have 2 lan cards.
eth0 --connected to internet
eth1 --connected to lan

then ..
Make the default policy of FORWARD to DROP
Just FORWARD the client's ip so that it can get internet access. All other machines will communicated with each other but not with the internet.

Without mac binding.
iptables -A FORWARD -i eth1 -s 192.168.1.x -j ACCEPT iptables -A FORWARD -i eth0 -d 192.168.1.x -j ACCEPT

With mac binding.
iptables -A FORWARD -i eth1 -s 192.168.1.x -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A FORWARD -i eth0 -d 192.168.1.x -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT

Regards,

Joel N.Solanki
Network Administrator
Phone No: 0265-550001/2/3/4/5 Ext: 211/212
Digtial 2 Virtual Internet Service Provider.
http://www.packetraptor.com/
http://www.d2visp.com/
Gujarat (India)