setting iptables

[Muhammad Imran Hussain]

hello all members
hope u r fine

i want to configure my iptables to authenticate users by their MAC is that possible or is there any other way to authenticate users in LAN.

plz advice

[Huc_1]

I am not to sure of what you need, so correct me if i am on the wrong track.

No not user you can identify the "node" from where a packet is from or going to by its mac address, this is very low in your network stack (4 level model), iptables deal with such a low level, so it knows about things like mac address(XX:XX:XX:XX:XX:XX),ip(XXX.XXX.XXX.XXX), it now about protocol like (tcp,udp..etc), but it does not know about thing at levels like user name.

If what you are after is how to construct an iptable rule to deal with a mac address then the following should do it.


iptables -A FORWARD -m mac --mac-source XX:XX:XX:XX:XX -j ACCEPT
iptables -A FORWARD -m mac --mac-source XX:XX:XY:XY:XY -j DROP

Let us know if this is what you need.

J-P

[Muhammad Imran Hussain]

hello

yes u r right,
& also plz guide how to allow or disallow known application & ports like allowing msn, yahoo,http & disallowing kazaa, imesh.

Thank u for understanding

[Jerome Henry]

First, allow the MAC addresses the way Jean Pierre suggested.
Then, the best is to allow the ports corresponding to what you need, and dissallow the rest (including imesh and other kazaas).
Steven provided a good example in this thread :
http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x67de68da2286d711abdc0090277a778c%2C00.html&admit=716493758+1066482174278+28353475
You may wish to try this one, adding at the begining the MAC addresses. You can also use the tips we gave you here :
http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x9d4b8b82cc91d711abdc0090277a778c%2C00.html&admit=716493758+1066481908866+28353475
Ask us if you want some comment on the file.

hth

J