I have two systems that are connected over Ethernet and one system has a WiFi radio which provides internet access.
In this diagram sys#2 has the WiFi radio
sys#1 <---> Ethernet <---> sys#2 <---> wifi <---> internet
sys#2 routes packages from Ethernet (interface eth0) out to wifi (interface wlan0). sys#2 connects to an AP, sys#2 does not act as an AP itself. I'm looking for a way to use nftables or iptables to filter and drop packets on sys#2 which do not have a MAC matching sys#1. I'd be more interested in dropping packets arriving on Ethernet. What I'm trying to protect is to prevent someone from plugging into sys#2 and gaining accesses to the WiFi network.
Is this possible with nftables? I know someone could spoof their MAC to get around this but this is just a temporary measure until we can secure the connection with IPSEC or a VPN.
Edit: Running the suggested nft command results in an error:
# nft add rule filter input iif eth0 ether saddr != A4:A3:A3:00:00:00 drop <cmdline>:1:1-68: Error: Could not process rule: No such file or directory # ifconfig eth0 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 metric 1 inet 10.0.1.1 netmask 255.255.255.0 broadcast 10.0.1.255 ...