I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access.

In this diagram sys#2 has the WiFi radio

sys#1  <---> Ethernet <---> sys#2 <---> wifi <---> internet

sys#2 routes packages from Ethernet (interface eth0) out to wifi (interface wlan0). sys#2 connects to an AP, sys#2 does not act as an AP itself. I'm looking for a way to use nftables or iptables to filter and drop packets on sys#2 which do not have a MAC matching sys#1. I'd be more interested in dropping packets arriving on Ethernet. What I'm trying to protect is to prevent someone from plugging into sys#2 and gaining accesses to the WiFi network.

Is this possible with nftables? I know someone could spoof their MAC to get around this but this is just a temporary measure until we can secure the connection with IPSEC or a VPN.

Edit: Running the suggested nft command results in an error:

# nft add rule filter input iif eth0 ether saddr != A4:A3:A3:00:00:00 drop
<cmdline>:1:1-68: Error: Could not process rule: No such file or directory
# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500  metric 1
    inet  netmask  broadcast
  • if you use nft, you will have to create the chains in first place before you can add rules into them, eg. nft add chain filter input {type filter hook input priority 0; policy accept; }. If you don't already have nft already set up, it might be easier to use iptables instead. – sebasth Jul 7 '18 at 23:28

Using nft, to drop all ethernet frames which are received from network interface eth0 and do not have source address of 00:00:5e:00:53:00:

nft add rule filter input iif eth0 ether saddr != 00:00:5e:00:53:00 drop

iptables allows similar filtering with mac extension:

iptables -A INPUT -i eth0 -m mac ! --mac-source 00:00:5e:00:53:00 -j DROP
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.