I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access.

In this diagram sys#2 has the WiFi radio

sys#1  <---> Ethernet <---> sys#2 <---> wifi <---> internet

sys#2 routes packages from Ethernet (interface eth0) out to wifi (interface wlan0). sys#2 connects to an AP, sys#2 does not act as an AP itself. I'm looking for a way to use nftables or iptables to filter and drop packets on sys#2 which do not have a MAC matching sys#1. I'd be more interested in dropping packets arriving on Ethernet. What I'm trying to protect is to prevent someone from plugging into sys#2 and gaining accesses to the WiFi network.

Is this possible with nftables? I know someone could spoof their MAC to get around this but this is just a temporary measure until we can secure the connection with IPSEC or a VPN.

Edit: Running the suggested nft command results in an error:

# nft add rule filter input iif eth0 ether saddr != A4:A3:A3:00:00:00 drop
<cmdline>:1:1-68: Error: Could not process rule: No such file or directory
# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500  metric 1
    inet  netmask  broadcast
  • if you use nft, you will have to create the chains in first place before you can add rules into them, eg. nft add chain filter input {type filter hook input priority 0; policy accept; }. If you don't already have nft already set up, it might be easier to use iptables instead.
    – sebasth
    Commented Jul 7, 2018 at 23:28

1 Answer 1


Using nft, to drop all ethernet frames which are received from network interface eth0 and do not have source address of 00:00:5e:00:53:00:

nft add rule filter input iif eth0 ether saddr != 00:00:5e:00:53:00 drop

iptables allows similar filtering with mac extension:

iptables -A INPUT -i eth0 -m mac ! --mac-source 00:00:5e:00:53:00 -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .