MAC Address filter on wireless interface
Hi All,
I have been trying to get MAC address filtering to work on our wireless card - so far without success :
The rules I am using are listed below :
for M in $(cat /etc/mac.allow) ; do
$IPT -A INPUT -i $WIFI_IF -m mac --mac_source $M -j ACCEPT
done
for M in $(cat /etc/mac.allow) ; do
$IPT -A INPUT -i $WIFI_IF -m mac --mac-source ! $M -j DROP
done(I do have CONFIG_IP_NF_MATCH_MAC turned on).
I'm running on an ARM processor with kernel 2.4.21-rmk1
Is it in fact possible to filter on MAC addresses over a WiFi interface, or am I doing something stupid?
Best regards
Steve Comfort
Quoted 2 lines · Steve Comfort
I have been trying to get MAC address filtering to work on our wireless card - so far without success :
You should describe the problem. What's not working ? Everything goes through ? Nothing goes through ?
Quoted 3 lines
for M in $(cat /etc/mac.allow) ; do
$IPT -A INPUT -i $WIFI_IF -m mac --mac-source ! $M -j DROP
doneProbable typo here. Do you mean /etc/mac.deny ?
Another hint that comes to mind. Do you really want to filter traffic destined to this particular box, which is what you do using INPUT chain ? If you want to filter traffic going through the box, you have to use FORWARD chain.
Quoted 2 lines
Is it in fact possible to filter on MAC addresses over a WiFi interface, or am I doing something stupid?
Yes it is possible, but you have to consider the fact that MAC filtering is a very limited feature on y WiFi network. MAC spoofing is very easy (ifconfig $WIFI_IF hw ether $NEW_MAC) on most drivers and does not cause any problem or conflict as long as you don't use the IP the guy you're spoofing does. Thus, you MAC filter can be bypassed very easily...
Signature · 2 lines
http://sid.rstack.org/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 3 lines · Steve Comfort
mac.allow is a file we create containing permitted MAC addresses. The above was just a snippet, I have the same rule in place for the FORWARD chain.
OK. Then what I would do is check with an iptables -L -v rules counters to verify if thoses rules actually match. And if they don't, try to figure out why. Maybe you have one prior rule that allows all packets, bypassing this part of the ruleset.
On the other end, I would do a mac.allow file, and put a DROP policy so you'll never see anything go through until you get the right MAC, and the right ruleset ;) Maybe another "customer request" ?
Quoted 1 line
Yeah, I know. Customer requirement unfortunately.
Customers...
Signature · 2 lines
http://sid.rstack.org/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!