I have an Oculus Quest and I want only the Oculus to be able to see my miniDLNA server. So on the server itself I have the following config:

The Mac Adress I've given is 100% correct and when disabling nft all works fine.

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;

        # Allow established and related connections
        ct state established,related accept

        # Allow loopback interface
        iif lo accept

        # Allow SSH connections on port 22222
        tcp dport 22222 accept

        # Allow ICMP (ping) from LAN IP range (192.168.1.x)
        ip protocol icmp icmp type echo-request ip saddr counter accept

        # Allow HTTP (port 80) from LAN IP range (192.168.1.x)
        tcp dport 80 ip saddr accept
    #tcp dport 80 accept

        # Allow HTTPS (port 443) from LAN IP range (192.168.1.x)
        tcp dport 443 accept

        # Allow incoming connections on port 64293 from LAN (
        tcp dport 64293 ip saddr accept

        iifname eno1 udp dport 53 accept
        iifname eno1 tcp dport 53 accept

        # Allow incoming Samba traffic from LAN IP range
        tcp dport 445 ip saddr accept

        # Allow MiniDLNA only from a specific MAC address
    ether saddr YX:XY:XY:XY:XY:XY ether daddr YX:XY:XY:XY:XY:XY tcp dport 8200 accept
    # Drop all other incoming connections

1 Answer 1


As far as I've understood, table inet + hook input will only process traffic at Layer-3 and higher, i.e. the Ethernet information is already discarded at that point.

Since you apparently aren't doing any bridging, perhaps you should put the MAC address rules into the ingress hook of table netdev instead:

table netdev l2filter {
    chain l2input-eno1 {
        type filter hook ingress device eno1 priority 0;
        # ingress hooks are specific to ^^^^ a particular network interface

        # Allow MiniDLNA from specific source MAC address only
        ether saddr YX:XY:XY:XY:XY:XY tcp dport 8200 accept
        # MiniDLNA requests from any other source will be dropped
        tcp dport 8200 drop

Note: I have not tested this. If someone knows better, feel free to edit this or write a better answer.

l2filter and l2input-eno1 are just human-readable names you can choose as you like.

If you are not bridging or otherwise having the network interface in promiscuous mode, the NIC hardware should already be filtering the incoming unicast traffic by destination MAC address for you, so the ether daddr rule should be unnecessary.

Also note that DLNA servers may/should also announce themselves by the UPnP discovery protocol (SSDP = UDP port 1900), and that protocol works by multicast, so you may not be able to completely hide the presence of a DLNA server in the network segment, unless you are willing to block all outgoing SSDP announcements, which might make it harder for the Oculus Quest to find the DLNA server.

The above rule should certainly block any other hosts from actually accessing the MiniDLNA server, although the SSDP announcements will reveal its existence.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .