Regarding iptables mac matching

Dear All,
I'm using iptables on Fedora 9. I need to block network access to a
specific mac address. My LAN uses a gateway. On the gateway I'm using iptables for firewalling. I monitor the network traffic from hosts on my LAN, and need to block the hosts which are consuming too much of network traffic. To block a host with MAC address 00:E0:4D:02:1F:B8, I added these rules in iptables:

iptables -A INPUT -m mac --mac-source 00:E0:4D:02:1F:B8 -j DROP iptables -A FORWARD -m mac --mac-source 00:E0:4D:02:1F:B8 -j DROP

I tested the network connection on the host with the mac address matching 00:E0:4D:02:1F:B8 and I got the following results:

* The gateway blocked ssh and ping requests from the host.
* But I was still able to access other servers on real ip (say pinging google.com, worked fine)

I like to block the access of that host to other hosts, the gateway and the internet as well. But I'm unable to do that using the above mentioned rules. I'm quite optimistic that someone help me with this problem. Thanks in advance.

Regards,
Abhishek Singh

In short I am fairly certain that you will not (reliably) be able to block host to host communications on your LAN. Here's a quick synopsis of a very similar discussion on the EBTables mailing list.

Consider your LAN a small room with multiple people in it, all of which are in ear shot of each other. So when one person tries to talk to another person they can do it with out a problem because it is directly between each other. Your firewall only enters the picture when someone tries to leave the room to go out to the world. With out shouting at everyone, there is very little that you can do to prevent each other from talking between them selves.

*nod*

Grant. . . .

P.S. This assumes that all the systems are on the same subnet. If they are on different subnets and have to pass through the router to get between subnets you can do something if you want to.