1

I tried to filter any packet with specific MAC coming to eth0. The commands below are used (ebtable and iptables) but did not work. Can anyone please give some advice?

I used ebtables because I used a bridge containing veth0, eth0, and eth1. The packet were sent from eth0 and is terminated on the eth0 of another node in the network.

I needed to use the destination address because the destination MAC address are the same so I know which packet to be terminated on eth0.

a. ebtables -A INPUT -i eth0 -d 11:22:33:44:55:66 -j DROP

b. iptables -A INPUT -m mac --mac-source aa:bb:cc:dd:ee:ff -j DROP

mido
  • 24,198
  • 15
  • 92
  • 117
mmc1115
  • 21
  • 1
  • 4

1 Answers1

0

Both ebtables and iptables INPUT chains are only run on packets destined for the local machine, NOT on packets that are being forwarded (either at layer 2 or layer 3).

Changing from using the INPUT chain to using the PREROUTING chain (especially in ebtables will likely fix your issue.

Joel C
  • 2,958
  • 2
  • 15
  • 18