Batman-Adv & iptables mac filtering
This is probably a openwrt question but even so it might have some impact on batman-adv.
I am planing to use mac filtering through iptables on openwrt with a default policy of deny all, allowing only by white list the clients that will be allowed t connect.
My question to the batman team is if by applying this idea and since batman-adv uses MACs to manage the routing; if i will have to white list the other router MACs on the router or routers that will be filtering MACs with iptables or batman-adv is not affected by mac filtering.
Quoted 8 lines · On Tuesday, December 18, 2012 08:10:30 HeXiLeD wrote:
This is probably a openwrt question but even so it might have some impact on batman-adv.
I am planing to use mac filtering through iptables on openwrt with a default policy of deny all, allowing only by white list the clients that will be allowed t connect.
Quoted 4 lines
My question to the batman team is if by applying this idea and since batman-adv uses MACs to manage the routing; if i will have to white list the other router MACs on the router or routers that will be filtering MACs with iptables or batman-adv is not affected by mac filtering.
iptables works on layer3. Even though you have a mac address filter option it will only catch anything if the packet is moved up to layer3 which does not happen for batman-adv packets. So, iptables will never even see the packets used by batman-adv.
Cheers,
Marek
Could you use ebtables instead?
2012/12/17 Marek Lindner <[email protected]>:
Quoted 21 lines · On Tuesday, December 18, 2012 08:10:30 HeXiLeD wrote:
Quoted 8 lines
This is probably a openwrt question but even so it might have some impact on batman-adv.
I am planing to use mac filtering through iptables on openwrt with a default policy of deny all, allowing only by white list the clients that will be allowed t connect.
Quoted 4 lines
My question to the batman team is if by applying this idea and since batman-adv uses MACs to manage the routing; if i will have to white list the other router MACs on the router or routers that will be filtering MACs with iptables or batman-adv is not affected by mac filtering.
iptables works on layer3. Even though you have a mac address filter option it will only catch anything if the packet is moved up to layer3 which does not happen for batman-adv packets. So, iptables will never even see the packets used by batman-adv.
Cheers,
Marek
Signature · 1 line
Esteban
Quoted 1 line · On Friday, December 28, 2012 06:59:40 Esteban Municio wrote:
Could you use ebtables instead?
I was told you can use ebtables but I never used it.
Cheers,
Marek
Quoted 4 lines · Marek Lindner
Quoted 1 line · On Friday, December 28, 2012 06:59:40 Esteban Municio wrote:
Could you use ebtables instead?
I was told you can use ebtables but I never used it.
But keep in mind that ebtables works with bridge interfaces only, therefore you must first create a bridge, add bat0 to it and then use ebtables onto the bridge interface.
Cheers,
Signature · 4 lines
Antonio Quartulli ..each of us alone is worth nothing.. Ernesto "Che" Guevara