/

Firewalling IP Address dan MAC Address dengan iptables

0 Comments |

Sometimes we as a network administrator is to mess around with a few clients "rogue" who likes changing the IP Address. Whereas previously a certain IP Address from client we already block access to certain hours, or we block for accessing a particular site.
Maybe a little bit I can give here is, how can we overcome the "naughtiness" client-client so that they can not change the IP Address they are "just delicious." I hope you at least know what it is and what is the IP Address MAC Address. In conducting an experiment here I use Linux distro ClarkConnect Home Edition version 3.0 is equipped with iptables version 1.2.11. My colleagues can use other Linux distributions.

Gains and losses:

* The advantage is, we can easily monitor the "movement" and conduct client logging for network administration or other analyzes are needed, because the client can not make changes to an IP Address.
* The loss, if only the hardware interface client suffered damage and do change, we must do our reconfigure the firewall rules based on the new MAC Address. But the damage is very rare.


There are two methods that I use here, and colleagues can all choose one of them, namely:

* First, whether we will conduct registration of all the IP Address and MAC Address client-client and not allow all of us connected with our client can not keep changing the IP Address. If the IP and MAC address is not listed in the firewall rules, then the client can not connect.
* Second, if we only want the IP Address and MAC Address are not certain we want to keep changing the IP Address. Here, if there is a new IP and MAC Address with the new, client still can not connect.


Case, here we possessed three clients, namely:
Client 1 IP = 192.168.1.5
MAC Address 1 = 00:89: CD: 64:01: EF

2 = 192.168.1.20 Client IP
MAC Address 1 = 00:90: DD: 14:11: CF

3 = 192.168.1.14 Client IP
MAC Address 3 = 00:40: EE: 21:26: GE

All clients are connected via Ethernet (LAN Card / NIC), one that is named eth1.

Firewalling with the first method:

# Drop all prerouting on eth1
iptables-I PREROUTING-t nat-i eth1-j DROP

The first client #------------------- ------------------------
# Accept IP 192.168.1.5 to the mac address 00:89: CD: 64:01: EF
iptables-I PREROUTING-t nat-i eth1-s 192.168.1.5
-M mac - mac-source 00:89: CD: 64:01: EF-j ACCEPT

# Drop the IP 192.168.1.5 to the mac address 00:89: CD: 64:01: EF
# If you replace it with another IP other than 192.168.1.5
iptables-I FORWARD-i eth1-s! 192.168.1.5
-M mac - mac-source 00:89: CD: 64:01: EF-j DROP

# Drop prerouting IP 192.168.1.5 with mac address 00:89: CD: 64:01: EF
# If you replace it with another IP other than 192.168.1.5
iptables-I PREROUTING-t-s grout! 192.168.1.5
-M mac - mac-source 00:89: CD: 64:01: EF-j DROP

The second client #------------------- ------------------------
# Accept IP address 192.168.1.20 with a mac 00:90: DD: 14:11: CF
iptables-I PREROUTING-t nat-i eth1-s 192.168.1.20
-M mac - mac-source 00:90: DD: 14:11: CF-j ACCEPT

# Drop the IP address of 192.168.1.20 with a mac 00:90: DD: 14:11: CF
# If you replace it with another IP other than 192.168.1.20
iptables-I FORWARD-i eth1-s! 192.168.1.20
-M mac - mac-source 00:90: DD: 14:11: CF-j DROP

# Drop prerouting IP address 192.168.1.20 with a mac 00:90: DD: 14:11: CF
# If you replace it with another IP other than 192.168.1.20
iptables-I PREROUTING-t nat-s! 192.168.1.20
-M mac - mac-source 00:90: DD: 14:11: CF-j DROP

Note:
Here, because the client does not enter into three rules, it can not connect, although the same IP address change with the client first and second. While the first and second client can still connect, for not making changes IP Address.


Firewalling with both methods:

The first client #------------------- ------------------------
# Drop the IP 192.168.1.5 to the mac address 00:89: CD: 64:01: EF
# If you replace it with another IP other than 192.168.1.5
iptables-I FORWARD-s-i eth1! 192.168.1.5
-M mac - mac-source 00:89: CD: 64:01: EF-j DROP

# Drop prerouting IP 192.168.1.5 with mac address 00:89: CD: 64:01: EF
# If you replace it with another IP other than 192.168.1.5
iptables-I PREROUTING-t nat-s! 192.168.1.5
-M mac - mac-source 00:89: CD: 64:01: EF-j DROP

The second client #------------------- ------------------------
# Drop the IP address of 192.168.1.20 with a mac 00:90: DD: 14:11: CF
# If you replace it with another IP other than 192.168.1.20
iptables-I FORWARD-i eth1-s! 192.168.1.20
-M mac - mac-source 00:90: DD: 14:11: CF-j DROP

# Drop prerouting IP address 192.168.1.20 with a mac 00:90: DD: 14:11: CF
# If you replace it with another IP other than 192.168.1.20
iptables-I PREROUTING-t nat-s! 192.168.1.20
-M mac - mac-source 00:90: DD: 14:11: CF-j DROP

Note:
Here, although the client 3 does not enter into the rules, still can not connect, although the change of origin is not the same IP address IP address with the client first and second. Client 1 and 2 still can not connect, as long as no change IP Address.

Until here all the colleagues can develop it, possibly by limiting the bandwidth of a particular IP address belongs to a client, or can only do browsing but can not chat in a certain time.


Related Post



RSS Feed

0 Comments for Firewalling IP Address dan MAC Address dengan iptables

Leave a comment!

design by tikimedia © 2010 | Converted to Blogger by Blogger Templates | I Powered by Blogger
To top