CODEWITHSUNDEEP
linuxiptablesbridgeebtables
mmc1115
mmc1115

Reputation: 21

How to use ebtables or ptables to drop packet with specific MAC address?

I tried to filter any packet with specific MAC coming to eth0. The commands below are used (ebtable and iptables) but did not work. Can anyone please give some advice?

I used ebtables because I used a bridge containing veth0, eth0, and eth1. The packet were sent from eth0 and is terminated on the eth0 of another node in the network.

I needed to use the destination address because the destination MAC address are the same so I know which packet to be terminated on eth0.

a. ebtables -A INPUT -i eth0 -d 11:22:33:44:55:66 -j DROP

b. iptables -A INPUT -m mac --mac-source aa:bb:cc:dd:ee:ff -j DROP

Upvotes: 1

Views: 4167

Answers (1)

Joel C
Joel C

Reputation: 3158

Both ebtables and iptables INPUT chains are only run on packets destined for the local machine, NOT on packets that are being forwarded (either at layer 2 or layer 3).

Changing from using the INPUT chain to using the PREROUTING chain (especially in ebtables will likely fix your issue.

Upvotes: 0

Related Questions