CODEWITHSUNDEEP
iptablesebtables
atobi
atobi

Reputation: 123

MAC filtering using iptables/ebtables

I'm trying to drop a MAC address on a node in my network. Now, I tried two tools iptables and ebtables, but both attempts failed:

I'm working with Kernel version 2.6.32: uname -r results in "2.6.32-042stab049.6.emulab.1"

How can I make (at least one) it work? I've searched about this failures, but not much information is to be found. How do I make the kernel support the ebtables 'filter' table? How come there is "no chain/target/match by that name"?

Upvotes: 1

Views: 3780

Answers (2)

Oliver G.
Oliver G.

Reputation: 227

You need to enable the ebtables options in your Kernel configuration 

CONFIG_BRIDGE_NF_EBTABLES=y
CONFIG_BRIDGE_EBT_BROUTE=y
CONFIG_BRIDGE_EBT_T_FILTER=y
CONFIG_BRIDGE_EBT_T_NAT=y
CONFIG_BRIDGE_EBT_802_3=y
CONFIG_BRIDGE_EBT_AMONG=y
CONFIG_BRIDGE_EBT_ARP=y
CONFIG_BRIDGE_EBT_IP=y
CONFIG_BRIDGE_EBT_IP6=y
CONFIG_BRIDGE_EBT_LIMIT=y
CONFIG_BRIDGE_EBT_MARK=y
CONFIG_BRIDGE_EBT_PKTTYPE=y
CONFIG_BRIDGE_EBT_STP=y
CONFIG_BRIDGE_EBT_VLAN=y
CONFIG_BRIDGE_EBT_ARPREPLY=y
CONFIG_BRIDGE_EBT_DNAT=y
CONFIG_BRIDGE_EBT_MARK_T=y
CONFIG_BRIDGE_EBT_REDIRECT=y
CONFIG_BRIDGE_EBT_SNAT=y
CONFIG_BRIDGE_EBT_LOG=y
CONFIG_BRIDGE_EBT_ULOG=y
CONFIG_BRIDGE_EBT_NFLOG=y

then build the kernel and retry. Its also possible that something iptables relates is missing also.

Upvotes: 0

Mark Stanislav
Mark Stanislav

Reputation: 979

Verify that you can actually list an INPUT chain:

# iptables -L

Hopefully that should something akin to:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

As for ebtables, it apparently isn't actually part of your kernel.

Upvotes: 0

Related Questions